[Zivxx]

Stacked on docs#681 (PER-17948), which adds PDP_BACKEND_URL to this page. This PR's own diff is one commit.

Documents cloud-pdp #433 (PER-17944), stacked on cloud-pdp #432. Keep it a draft until the Nexus PDP release that carries that PR ships.

What changes on the Nexus PDP configuration page

• The PDP_BACKEND_URL row now also says Nexus PDP forwards /cloud and /facts requests to it.
• A new subsection, "Requests forwarded to the Permit API", under Credentials:
  • The three route mappings: /cloud, /facts, and /v2/facts/{project}/{environment}. The last one always uses the PDP's own project and environment.
  • The bearer is PDP_API_KEY. Only Authorization and Content-Type are forwarded, and the answer comes back unchanged.
  • The limits: 75 s (504 if no answer has started, otherwise the connection closes), a 10 MiB body (413), 64 requests at once (503), and 502 when the API is unreachable.
  • A note: as of November 2026, /facts writes don't wait for the change. X-Wait-timeout and X-Timeout-Policy are ignored, and the legacy /sdk routes are not forwarded. The wait is PER-17943.

Not built locally.

🤖 Generated with Claude Code

[linear-code]

PER-17944

[omer9564]

This matches cloud-pdp #433. I'll approve when it leaves draft for the release.

• The three route mappings. The compat route uses the edge's own project and environment "whatever the request names". That's exactly what Route::rest does.
• The bearer. It must be PDP_API_KEY, and only Authorization and Content-Type are forwarded.
• The limits and their statuses: 75 s (504 before the answer starts, the connection closed after), 10 MiB (413), 64 at once (503), and unreachable (502).
• The /facts note (no wait yet, PER-17943, with X-Wait-timeout and X-Timeout-Policy ignored) and no /sdk both match.

One thing to follow: on #433 I've suggested dropping Set-Cookie from relayed answers. If that lands, "returns the Permit API's answer unchanged" would want "apart from Set-Cookie".