Authorization for IBM BPM Standard REST APIs

The IBM® BPM Standard REST APIs use authorization roles to determine the actions that a user can take on objects, such as processes and tasks.

Authorization roles

The following list includes the roles that are used by the IBM BPM Standard REST APIs:

IBM BPM administrators: Users with wide-ranging privileges for actions on IBM BPM objects including users, groups, teams, tasks, and processes.
Process application administrators (IBM Process Portal administrator team): Users who can perform actions on instances or tasks in a specific process application.
Team managers: Users who can perform actions on tasks and processes that are accessible to the members of the managed team.
Potential task owners: Users who can work on a task in a process.
Manager team of task team: Users who can work on and reassign tasks assigned to members of the managed team.
Task owner: The user who is assigned to or has claimed the task and is responsible for completing it.
Task collaborator: A user whom was invited by the task owner to collaborate on the task, that is, to provide relevant data but not complete the task.
Instance owners: Users who can administer instances of a specific process.

Table 1. Eligible roles for actions on processes and process instances
Action	Eligible roles
Retrieve a list of processes that the user is allowed to see (GET) `/bpm/processes`	IBM BPM administrator Process application administrator
Start a new instance of a process (POST) `/bpm/processes/{process-id}`	Members of teams assigned to the Expose to start option for the process
Retrieve the details of a process instance (GET) `/bpm/processes/{process-id}`	IBM BPM administrator Process application administrator Instance owner Follower of the instance Tagged in the instance Members of teams assigned to the Expose Performance Metrics option for the process
Delete a process instance (DELETE) `/bpm/processes/{process-id}`	IBM BPM administrator Process application administrator Instance owner

Table 2. Eligible roles for actions on user tasks
Action	Eligible roles
Retrieve a list of tasks that the user is allowed to see (GET) `/bpm/user-tasks`	IBM BPM administrator Task owner Potential task owner for unclaimed tasks
Retrieve task details (GET) `/bpm/user-tasks/{task-id}`	IBM BPM administrator Process application administrator Instance owner Task team manager Task owner Potential task owner Collaborator
Claim a task (PUT) `/bpm/user-tasks/{task-id}/claim`	IBM BPM administrator Process application administrator Potential task owner if an owner is not assigned
Complete a task (PUT) `/bpm/user-tasks/{task-id}/complete`	IBM BPM administrator Process application administrator Instance owner Task owner