RBAC rule management
Administrators manage RBAC rules by using the RBAC Rule Management APIs. The APIs are available in the rpaactuatorsvc menu of the Infor API Gateway.
Each rule includes a principals list. The Create Rule, Update Rule, and Get Rule APIs accept and return a principals array, which enables a single rule to apply to multiple principals.
Existing rules that are created with a single principal continue to be supported. These rules are returned with a principals array that contains a single entry.
These operations are supported:
| Method | Endpoint | Description |
| POST | /api/v1/rpa/exception/usecase-types/{id}/rbac/rules | Creates a new RBAC rule for a use case type. |
| GET | /api/v1/rpa/exception/usecase-types/{id}/rbac/rules | Retrieves all RBAC rules for a use case type. The request supports the optional query parameter ac-tive=true to return only active rules. |
| GET | /api/v1/rpa/excep-tion/rbac/rules/{ruleId} | Retrieves an RBAC rule by rule identifier. |
| PUT | /api/v1/rpa/exception/usecase-types/{id}/rbac/rules/{ruleId} | Replaces an existing RBAC rule with a complete definition. |
| PATCH | /api/v1/rpa/exception/usecase-types/{id}/rbac/rules/{ruleId} | Updates specific fields of an exist-ing RBAC rule. |
| Method | Endpoint | Description |
| DELETE | /api/v1/rpa/excep-tion/rbac/rules/{ruleId} | Deletes an RBAC rule by rule identifier. |
| DELETE | /api/v1/rpa/exception/usecase-types/{id}/rbac/rules | Deletes all RBAC rules associated with a use case type. |
| GET | /api/v1/rpa/exception/usecase-types/{id}/rbac/permis-sions/{userId} | Retrieves effective permissions for a specific user on a use case type. |
The effective permissions API returns the user identifier, the use case type identifier, and the resolved permissions grouped by category. Each category lists the actions that the user can perform based on all matching RBAC rules.
{
"user_id": "e0dcd0b0-053c-4973-9452-2bf25cb09eb1",
"usecase_type_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"mode": "rbac",
"matching_rules_count": 1,
"effective_permissions": [
{
"usecase_category": "MISSINGINFORMATION",
"permissions": ["view_document", "edit_document_fields", "edit_table_data", "submit", "archive", "move"]
},
{
"usecase_category": "NEEDSVERIFICATION",
"permissions": ["view_document", "submit"]
}
]
}
The response lists the permissions assigned to each category for the specified user. In this example, the application assigns a full set of permissions for the MISSINGINFORMATION category and assigns limited permissions for the NEEDSVERIFICATION category. The has_blanket_rules attribute indicates whether any matching RBAC rule grants permissions through a grant_all_document configuration.