---
title: "ABAC"
slug: "abac"
status: "update"
updated: 2026-09-15T13:51:02Z
published: 2026-09-15T13:51:15Z
canonical: "developer.rocket.chat/abac"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://developer.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.

# ABAC

With the ABAC API, you can:

- Manage attribute-based access control (ABAC) settings for rooms.
- Create, update, and delete ABAC attributes.
- Assign, sync, and evaluate access rules for users and rooms.

> [!NOTE]
> For details, you can refer to the [**ABAC user guide**.](https://docs.rocket.chat/docs/attribute-based-access-control-abac)

## The attribute definition object

ABAC access rules are built from attribute definitions — a key and its allowed values. A trimmed example from [List ABAC Attribute Definitions](https://developer.rocket.chat/apidocs/list-abac-attribute-definitions):

```json
{
  "attributes": [
    {
      "_id": "69778264070f6083845051e6",
      "key": "departmentNumber",
      "values": ["department"]
    },
    {
      "_id": "697ca091070f60838450580d",
      "key": "my_department",
      "values": ["eng", "sales", "hr", "it"]
    }
  ],
  "offset": 0,
  "count": 25,
  "total": 5,
  "success": true
}
```

Fields you use most often:

- `_id`: The attribute definition ID, used when reading, updating, or deleting a definition.
- `key`: The attribute name matched against user attributes, such as an LDAP field.
- `values`: The allowed values that can be assigned to rooms for this key.

## Common workflows

**Restrict a room by attributes**

1. [Create the attribute definition](https://developer.rocket.chat/apidocs/create-abac-attribute-definition) with its key and allowed values, or [list existing definitions](https://developer.rocket.chat/apidocs/list-abac-attribute-definitions).
2. [Add the attribute key to a room](https://developer.rocket.chat/apidocs/add-abac-attribute-key-to-room) and [set the room's attribute values](https://developer.rocket.chat/apidocs/set-room-abac-attribute-values), or [replace all of a room's attributes](https://developer.rocket.chat/apidocs/replace-room-abac-attributes) at once.
3. [Sync user attributes from LDAP](https://developer.rocket.chat/apidocs/sync-users-abac-attributes-from-ldap) so users' access reflects the directory.

**Audit and maintain ABAC**

1. [List rooms with ABAC attributes](https://developer.rocket.chat/apidocs/list-rooms-with-abac-attributes) to see what is protected.
2. [List the ABAC audit events](https://developer.rocket.chat/apidocs/list-abac-audit-events) to review access decisions, and [check the PDP health status](https://developer.rocket.chat/apidocs/get-pdp-health-status).
3. [Check whether an attribute is in use](https://developer.rocket.chat/apidocs/check-if-abac-attribute-is-in-use) before you [delete a definition](https://developer.rocket.chat/apidocs/delete-abac-attribute-definition-by-id) or [remove a key from a room](https://developer.rocket.chat/apidocs/delete-room-abac-attribute-key).

## Conventions

- ABAC is a premium capability and must be enabled for the workspace before these endpoints work. See the [ABAC user guide](https://docs.rocket.chat/docs/attribute-based-access-control-abac) for setup.
- Room endpoints reference rooms by `roomId`; attribute definition endpoints reference definitions by their `_id`.
- Access decisions are evaluated by the policy decision point (PDP); users keep or lose room access as their attributes and the room's attributes change.
- List endpoints support `count` and `offset` [query parameters](https://developer.rocket.chat/apidocs/query-parameters).