User permissions and authentication modes

The decision runtime uses user permission and authentication modes to control access to REST API endpoints and manage decision service archives and their metadata.

User permissions

The following distinct permissions exist to control access to the various REST API endpoints.

Table 1. Permissions
User permissions	Description
`decision service user`	Users with this permission can execute decisions and invoke related endpoints. Examples of what related endpoints can do: List the operations of a decision service. Generate an OpenAPI specification for a decision service. Retrieve an example payload for a decision service. Generate the schemas of the input and output for a decision service. For more information, see the Decision runtime section for the Decision runtime REST API in Reference.
`decision service manager`	Users with this permission can manage the decision service archives and associated metadata by using the create, retrieve, update, and delete operations on their respective storage service. For more information, see the Decision storage management section for the Decision runtime REST API in Reference.
`decision runtime monitor`	This role allows users to take a snapshot of the state of the decision runtime on demand. For more information, see the GET /health and GET /snapshot methods in the Decision runtime section for the Decision runtime REST API in Reference.
`automation developer`	Users with this permission can use business applications and business automation. Users with this permission can do the following actions: Execute, deploy, or undeploy to/from the decision runtime Download, upload, or delete a decision service archive Create, read, update, or delete metadata Execute decision services either with decisionId or through selectors For more information about the selectors, see Selecting decision services for execution. Users with this permission cannot do the following actions: Delete a deployment space List decision services in a deployment space Monitor the decision runtime (no snapshots) List metadata in a deployment space This permission already exists, and it is created and assigned by IBM Business Automation Studio.

For more information about how to configure these permissions, see Configuring the decision runtime.

Two endpoints are unprotected, that is, they do not require any permission to be used:

/about endpoint - For more information, see the GET /about method in the Decision runtime section for the Decision runtime REST API in Reference.
/health endpoint - For more information, see the GET /health method in the Decision runtime section for the Decision runtime REST API in Reference.

Authentication modes

Two authentication modes are available for the decision runtime. They are specified with the ads_configuration.decision_runtime.authentication_mode parameter:

basic
zen

Table 2. Authentication modes
Authentication mode	Description
`basic`	Users who are authenticated through the basic authentication mode are granted permissions as they are configured.
`zen`	When `zen` mode is used, the decision runtime is accessible through the IBM Cloud® Platform proxy (Zen) gateway, and single sign-on (SSO) is managed by Identity Access Management (IAM). Basic authentication can be used as well. Users and associated permissions can be managed in the IBM Cloud Pak® Platform UI (Zen). For more information, see Managing user permissions. Client applications must use API keys. For more information about generating the API keys, see Generating API keys for authentication . For more information about invoking a decision service with an API key, see Authorizing HTTP requests by using the Zen API .