API.Endpoint Auth Modes

| |Each API endpoint has an authMode that determines how Roles are checked when both a User and a Consumer (Application) are present in the request. | |The four auth modes are: | |* UserOnly (default): Only the User's Entitlements are checked. Consumer Scopes are ignored. | |* ApplicationOnly: Only the Consumer's Scopes are checked. No User is required. | |* UserXORApplication: Either a person or the Application acting as itself, never a mix. When the Application acts as itself (there is no User, or the User is the Application's own, the one an OBP-OIDC client-credentials token resolves to: provider obp-oidc#client, named after the client id), only the Consumer's Scopes are checked. Otherwise a person is acting, and only the User's Entitlements are checked: the Consumer's Scopes are ignored. It was called UserOrApplication until October 2026, when it granted access if either held the Role. | |* UserAndApplication: Access is granted only if the Consumer has the required Scope AND the User has the required Entitlement. Both are required. | |For example, if a User logs in via DirectLogin with a Consumer that has the Scope CanGetConsumers, and the endpoint's authMode is UserXORApplication, the User still needs a personal CanGetConsumers Entitlement: a person never acts on the Consumer's Scopes. The same Consumer calling with a client-credentials token, as itself, is let in on its Scope. So whoever is let in is also who is recorded as acting. | |The authMode is set in the ResourceDoc definition for each endpoint, for example: | | |resourceDocs += ResourceDoc( | getConsumers, | implementedInApiVersion, | nameOf(getConsumers), | "GET", | "/management/consumers", | "Get Consumers", | ..., | Some(List(canGetConsumers)), | authMode = UserXORApplication |) | | |If authMode is not specified, it defaults to UserOnly. | |Note: If the property require_scopes_for_all_roles is set to true (or require_scopes_for_listed_roles lists the Role), endpoints behave as UserAndApplication regardless of their configured authMode, except that an Application acting as itself on an ApplicationOnly or UserXORApplication endpoint still needs only its Scopes: it has no Entitlements to add. | |See also: Access Control, Scopes, Roles | |