Answer by Reto Weiss

Reto Weiss — Tue, 21 Oct 2014 10:01:54 -0400

In the PublicAPI javadoc the permissions a user needs to call an API method is documented. Like the describtion of the "Parameters" or "Throws" of a method there maybe also a "Security:" part in the method description. The "Security:" part contains the security rule that is performed before the method is executed. E.g. for IRole#getName() the security rule is:

SESSION OWNS RoleReadName PERMISSION OR OWNS RoleReadName@SYSTEM PERMISSION

This means that the session that executes the method call must own permission RoleReadName either application wide (first part) or system wide (second part @SYSTEM).

Another example is the security role of IUser#getName():

SESSION (MATCHES THIS AND OWNS UserReadOwnName PERMISSION) OR OWNS UserReadName PERMISSION OR OWNS UserReadName@SYSTEM PERMISSION

This means that the session that executes the method call either must be:

login with the user this method is executed on (MATCHES THIS) and the session must own the permission UserReadOwnName (OWNS UserReadOwnName PERMISSION) or
owns the permission UserReadName (OWNS UserReadName PERMISSION) or
owns the permission UserReadName system wide (OWNS UserReadName@SYSTEM PERMISSION)

Next example is method IWorkflowSession#resumeTask(...):

SESSION IS SYSTEM

This means that only internal Axon.ivy code (SYSTEM) can execute this method.

Answers to: Permissions needed to call a API method

Answer by Reto Weiss