Register
API Explorer
https://obp-api-sandbox.nmbbank.co.tz

ABAC_Parameters_Summary

ABAC Rule Parameters Summary

The ABAC Rules Engine provides 18 parameters to your rule function, organized into three categories:

User Parameters (6 parameters)

  1. authenticatedUser: User - The logged-in user
  2. authenticatedUserAttributes: List[UserAttributeTrait] - Non-personal attributes of authenticated user (IsPersonal=false)
  3. authenticatedUserAuthContext: List[UserAuthContext] - Auth context of authenticated user
  4. onBehalfOfUserOpt: Option[User] - User being acted on behalf of (if provided)
  5. onBehalfOfUserAttributes: List[UserAttributeTrait] - Non-personal attributes of on-behalf-of user (IsPersonal=false)
  6. onBehalfOfUserAuthContext: List[UserAuthContext] - Auth context of on-behalf-of user

Target User Parameters (3 parameters)

  1. userOpt: Option[User] - Target user being evaluated
  2. userAttributes: List[UserAttributeTrait] - Non-personal attributes of target user (IsPersonal=false)
  3. user: User - Resolved target user (defaults to authenticatedUser)

Resource Context Parameters (9 parameters)

  1. bankOpt: Option[Bank] - Bank context (if bank_id provided)
  2. bankAttributes: List[BankAttributeTrait] - Bank attributes
  3. accountOpt: Option[BankAccount] - Account context (if account_id provided)
  4. accountAttributes: List[AccountAttribute] - Account attributes
  5. transactionOpt: Option[Transaction] - Transaction context (if transaction_id provided)
  6. transactionAttributes: List[TransactionAttribute] - Transaction attributes
  7. transactionRequestOpt: Option[TransactionRequest] - Transaction request context
  8. transactionRequestAttributes: List[TransactionRequestAttributeTrait] - Transaction request attributes
  9. customerOpt: Option[Customer] - Customer context (if customer_id provided)
  10. customerAttributes: List[CustomerAttribute] - Customer attributes

Usage in Rules

// Access user email
authenticatedUser.emailAddress

// Check if account exists and has sufficient balance
accountOpt.exists(account => account.balance.toDouble >= 1000.0)

// Check user attributes (non-personal only)
authenticatedUserAttributes.exists(attr =>
  attr.name == "role" && attr.value == "admin"
)

// Note: Only non-personal attributes (IsPersonal=false) are included

// Check delegation
onBehalfOfUserOpt.isDefined

Related Documentation:

  • ABAC_Simple_Guide - Getting started guide
  • ABAC_Object_Properties_Reference - Detailed property reference
  • ABAC_Account_Access_Enforcement - Runtime gate model