ABAC

With the ABAC API, you can:

• Manage attribute-based access control (ABAC) settings for rooms.

• Create, update, and delete ABAC attributes.

• Assign, sync, and evaluate access rules for users and rooms.

For details, you can refer to the ABAC user guide.

The attribute definition object

ABAC access rules are built from attribute definitions — a key and its allowed values. A trimmed example from List ABAC Attribute Definitions:

{
  "attributes": [
    {
      "_id": "69778264070f6083845051e6",
      "key": "departmentNumber",
      "values": ["department"]
    },
    {
      "_id": "697ca091070f60838450580d",
      "key": "my_department",
      "values": ["eng", "sales", "hr", "it"]
    }
  ],
  "offset": 0,
  "count": 25,
  "total": 5,
  "success": true
}

Fields you use most often:

• _id: The attribute definition ID, used when reading, updating, or deleting a definition.

• key: The attribute name matched against user attributes, such as an LDAP field.

• values: The allowed values that can be assigned to rooms for this key.

Common workflows

Restrict a room by attributes

1. Create the attribute definition with its key and allowed values, or list existing definitions.

2. Add the attribute key to a room and set the room's attribute values, or replace all of a room's attributes at once.

3. Sync user attributes from LDAP so users' access reflects the directory.

Audit and maintain ABAC

1. List rooms with ABAC attributes to see what is protected.

2. List the ABAC audit events to review access decisions, and check the PDP health status.

3. Check whether an attribute is in use before you delete a definition or remove a key from a room.

Conventions

• ABAC is a premium capability and must be enabled for the workspace before these endpoints work. See the ABAC user guide for setup.

• Room endpoints reference rooms by roomId; attribute definition endpoints reference definitions by their _id.

• Access decisions are evaluated by the policy decision point (PDP); users keep or lose room access as their attributes and the room's attributes change.

• List endpoints support count and offset query parameters.