Register
API Explorer
https://obp-api-sandbox.nmbbank.co.tz

ABAC_Simple_Guide

ABAC Rules Engine - Simple Guide

Overview

The ABAC (Attribute-Based Access Control) Rules Engine allows you to create dynamic access control rules in Scala that evaluate whether a user should have access to a resource.

API Usage

Endpoint

POST https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/{RULE_ID}/execute

Request Example

curl -X POST \
  'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/admin-only-rule/execute' \
  -H 'DirectLogin: token=eyJhbGciOiJIUzI1...' \
  -H 'Content-Type: application/json' \
  -d '{
    "bank_id": "gh.29.uk",
    "account_id": "8ca8a7e4-6d02-48e3-a029-0b2bf89de9f0"
  }'

Understanding the Three User Parameters

1. authenticatedUserId (Required)

The person actually logged in and making the API call

  • The real user who authenticated
  • Retrieved from the authentication token

2. onBehalfOfUserId (Optional)

When someone acts on behalf of another user (delegation)

  • Used for delegation scenarios
  • The authenticated user is acting for someone else
  • Common in customer service, admin tools, power of attorney

3. userId (Optional)

The target user being evaluated by the rule

  • Defaults to authenticatedUserId if not provided
  • The user whose permissions/attributes are being checked
  • Useful for testing rules for different users

Writing ABAC Rules

Simple Rule Examples

Rule 1: User Must Own Account

accountOpt.exists(account =>
  account.owners.exists(owner => owner.userId == user.userId)
)

Rule 2: Admin or Owner

val isAdmin = authenticatedUser.emailAddress.endsWith("@admin.com")
val isOwner = accountOpt.exists(account =>
  account.owners.exists(owner => owner.userId == user.userId)
)

isAdmin || isOwner

Rule 3: Account Balance Check

accountOpt.exists(account => account.balance.toDouble >= 1000.0)

Available Objects in Rules

authenticatedUser: User                    // The logged in user
onBehalfOfUserOpt: Option[User]           // User being acted on behalf of (if provided)
user: User                                 // The target user being evaluated
bankOpt: Option[Bank]                      // Bank context (if bank_id provided)
accountOpt: Option[BankAccount]            // Account context (if account_id provided)
transactionOpt: Option[Transaction]        // Transaction context (if transaction_id provided)
customerOpt: Option[Customer]              // Customer context (if customer_id provided)

Related Documentation:

  • ABAC_Parameters_Summary - Complete list of all 18 parameters
  • ABAC_Object_Properties_Reference - Detailed property reference
  • ABAC_Testing_Examples - More testing examples
  • ABAC_Account_Access_Enforcement - Runtime gate model