ABAC Testing Examples

API Endpoint

POST https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/{RULE_ID}/execute

Example 1: Admin Only Rule

Rule Code:

authenticatedUser.emailAddress.endsWith("@admin.com")

Test Request:

curl -X POST \
  'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/admin-only-rule/execute' \
  -H 'DirectLogin: token=YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{}'

Expected Result:

• Admin user → {"result": true}
• Regular user → {"result": false}

Example 2: Account Owner Check

Rule Code:

accountOpt.exists(account =>
  account.owners.exists(owner => owner.userId == user.userId)
)

Test Request:

curl -X POST \
  'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/account-owner-only/execute' \
  -H 'DirectLogin: token=YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "user_id": "alice@example.com",
    "bank_id": "gh.29.uk",
    "account_id": "8ca8a7e4-6d02-48e3-a029-0b2bf89de9f0"
  }'

Example 3: Balance Check

Rule Code:

accountOpt.exists(account => account.balance.toDouble >= 1000.0)

Test Request:

curl -X POST \
  'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/high-balance-only/execute' \
  -H 'DirectLogin: token=YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "bank_id": "gh.29.uk",
    "account_id": "8ca8a7e4-6d02-48e3-a029-0b2bf89de9f0"
  }'

Example 4: Transaction Amount Check

Rule Code:

transactionOpt.exists(tx => tx.amount.abs.toDouble < 100.0)

Test Request:

curl -X POST \
  'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/small-transactions/execute' \
  -H 'DirectLogin: token=YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
    "bank_id": "gh.29.uk",
    "account_id": "8ca8a7e4-6d02-48e3-a029-0b2bf89de9f0",
    "transaction_id": "trans-123"
  }'

Testing Patterns

Pattern 1: Test Different Users

# Test for admin
curl -X POST 'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/RULE_ID/execute' \
  -d '{"user_id": "admin@admin.com", "bank_id": "gh.29.uk"}'

# Test for regular user
curl -X POST 'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/RULE_ID/execute' \
  -d '{"user_id": "alice@example.com", "bank_id": "gh.29.uk"}'

Pattern 2: Test Edge Cases

# No context (minimal)
curl -X POST 'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/RULE_ID/execute' -d '{}'

# Full context
curl -X POST 'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/RULE_ID/execute' -d '{
  "user_id": "alice@example.com",
  "bank_id": "gh.29.uk",
  "account_id": "8ca8a7e4-6d02-48e3-a029-0b2bf89de9f0",
  "transaction_id": "trans-123",
  "customer_id": "cust-456"
}'

Common Errors

Error 1: Rule Not Found

curl -X POST 'https://obp-api-sandbox.nmbbank.co.tz/obp/v6.0.0/management/abac-rules/nonexistent-rule/execute' \
  -H 'DirectLogin: token=YOUR_TOKEN' \
  -d '{}'

Response: {"error": "ABAC Rule not found with ID: nonexistent-rule"}

Error 2: Invalid Context

Response: Objects will be None if IDs are invalid, rule should handle gracefully

Related Documentation:

• ABAC_Simple_Guide - Getting started guide
• ABAC_Parameters_Summary - Complete parameter list
• ABAC_Object_Properties_Reference - Property reference
• ABAC_Account_Access_Enforcement - Runtime gate model