Authorization

|If Authentication involves the process of determining the identity of a user or application, Authorization involves the process of determining what the user or application can do. | |In OBP, Endpoints are protected by "Guards". | |There are two types of permissions which can be granted: | |1) Entitlements to Roles provide course grained access to resources which are related to the OBP system or a bank / space e.g. CanCreateAtm would allow the holder to create an ATM record. | |2) Account Access records provide fine grained permissions to customer bank accounts, their transactions and payments through Views. e.g. the A User with the Balances View on Account No 12345 would be allowed to get the balances on that account. | |Both types of permissions can be encapsulated in Consents or other authentication mechanisms. | |When OBP receives a call, after authentication is performed, OBP checks if the caller has sufficient permissions. | |If an endpoint guard blocks a call due to insufficient permissions / authorization, OBP will return an OBP- error message. | |If the caller passes the guards, the OBP-API forwards the request to the next step in the process. | |Note: All OBP- error messages can be found in the OBP-API logs and OBP source code for debugging purposes.