# Platform URP (insureMO Default URP )
## User Role Permission
This document provides an overview of insureMO portal's features on the aspect of user, role, and permission management system. It also describes the process flow for binding permissions through roles and then assigning roles to users.
### Concepts
**Permission**
In a system, permissions encompass a wide range of controls, including operations within functional modules, access to menus, buttons on pages, and image display. Essentially, permissions determine the extent of resources that users can access and manipulate within the system.
**Permission Type**
Equivalent to permission groups, permission types enable the classification and management of related permissions. Each individual permission belongs to a specific permission type.
**URP V2 NEW Permission Type**
* The new URPv2 supports different types of permissions, which serves as the fundamental basis for cross-tenant management.
1. Resource Type
Permissions of the Resource type start with the prefix `res_`. They can be used to manage tenants accessible to users, environments manageable by users, and may also cover data management and other types of permissions in the future.
As shown in the figure below, the current tenant "easyapp" can manage its own data as well as that of workspace tenants including "easyappsmkora", "easyappsmkmssq", "easyappsmkmysq", and "easyapp". Users granted this permission can query and operate data across these workspace tenants when accessing applications authenticated by URPv2.
2. API Type
Permissions of the API type start with the prefix `api_`. Each permission is associated with a set of APIs, and users granted this permission can call these APIs without encountering a 403 Forbidden error returned by the gateway.
3. Policy Type
Permissions of the Policy type start with the prefix `pol_`. For users requiring highly complex permissions, we can implement such permissions by defining custom rules. If the current user and input conditions meet these rules, the permission check returns true; otherwise, it returns false.
For APIs tagged `prod`, the gateway will verify the Policy-type permission also tagged `prod` when the API is called. For example, only users with the `mo_devops_release_management` role can deploy services to the production environment.
**Role**
To classify and manage many users with similar permissions, the concepts of roles such as system administrators, administrators, users and visitors are defined. A role essentially acts as the carrier of a set of certain permissions.
**User**
User is the actual operator of the application system and owns the permission information. Each user possesses a set of permissions determined by their assigned roles.
## User Scenario:
### How to check whether a user has one API access?
For example: I have one API:`/xxx/1.0/urpv2/account/query-current-account` and want to know whether the user `smkacc_1666603803671` has this API permission.
Answer:
- Click **Sign in** to log in to [insureMO portal](https://portal.insuremo.com/).
info
If you do not have a personal insureMO account, click **Sign up** to register one.
- Select **Catalog** at the top of the page.
- In the left navigation pane, navigate to **Non Insurance Services> IAM** to find the **Tenant Management** service card.
- Click **Api Permission**, input the API in the textbox and click **Search** to check which permission has this API.
- You can see this API, then click **View permission** under actions column.
* You can see which permission has this API.
* Then check which role the user has, go to **User permission**, click **View Permission** could see which permission the user has, then check whether the `api_urpv2_account_exec` permission exists in the user permission list.
### How to make one user just have limit API access, not all the API access belongs to my tenant?
* The user can have limit API access of this tenant. The processes are:
* step1: Create permission based on the limit apis, first click **Create permission**
Then add API, select the APIs you need.
* step2: Create one role based on this permission, first create role, then click **Assign permission**, then filter the permission by type and name, then select the permission you just created.
* step3: Remove the default role, which starts with `r_api_sys_` , then you can remove all the apis under this tenant, then assign the new role to this user.
## Account Management Functionality
Account Management concerns the users of the insureMO system. The users are attached to a tenant and access features. They can perform actions based on roles/types of users or the tenants above.
Click **Account Management** to jump into it. Create users and manage them from this module.
The same as tenant management, this page maintains the list of all users. On it, you can search for the users, and change or delete them by selecting each of them.
### Create New Account
Click **Create** to create a new user，you can create three types of users:
- **Platform User**: This is the default user type. It can log in normally and access the platform..
- **Machine User**: This is a user type for the API calls. It can only access authorized APIs, cannot log in.
- **App User**: This is a user type for commercial use. It cannot be created here. Please contact your tenant administrator to create an App user.
.png)
Enter all details in fields:
**Tenant Name** (mandatory): Select the tenant name from the dropdown and you will get tenant where you belong to.
**Account Name** (mandatory): Specify a user name of your choice.
**Nick Name** (mandatory): Specify a shorter name for the user to identify.
**Email** (mandatory): Provide the user's email address. This is where all the notifications will be sent to, including password setting.
**Mobile** (optional): You can provide the user's mobile number.
**Request Limit Unit** (optional): You can select the unit, which is to control the API call times per unit (second or minute or hour).
**Request Limit Value** (optional): You can set the value, such as 100. So the API control limit will be set as 100 APIs per unit (second or minute or hour) (as set in the limit unit ) in the gateway.
**Expiry Date** (optional): You can specify an expiry date, based on which the user will get inactive automatically in the platform.
**Notify via Email** (optional): You can check this box if you want to send an email to the user after creation.
note
Machine users are prohibited from logging in and can only access authorized APIs.
You can issue a personal access token for machine users to access APIs.
By issuing tokens instead of sharing users, security is higher and tenant data management issues caused by user leaks can be avoided.
After filling out all the details, click **Confirm** and your user data will be saved. A notification will be sent to the user in his/her email address with a link to create a password.
Click the link and create a password of your choice. Get ready to log in with the new user created.
### Edit an Account
Users can modify the details by clicking **Edit** in the action menu against the respective user profile.
Users can upload an avatar from **Edit** mode after creating the account. On clicking **Edit**, an overlay will appear where all the details can be modified and users can upload an image as an avatar. Only tenant Name and account name remain disabled because they are not allowed to be modified.
### Change Password
At any time, a user can change his/her password. The admin user can do the same for the user. Click **Pwd** in the middle.
An overlay will appear. The user needs to enter the old password and new password of his/her choice and confirm it. The password will be changed successfully and an email notification will be sent to the user.
Ordinary users who want to change their password can click **Change Password** in the upper right corner of the page.
### Download Account/Accounts Details:
note
For this feature, the user should have admin permission.
Just click **Download** and you will see downloaded account/accounts information in CSV file format.
### Disable/Enable Account
A user can be disabled or enabled by clicking **Disable** or **Enable** in the action menu against the respective user profile.
### Delete Account
The same as all other entities, users can also be deleted. Before deleting, you need to disable the user.
A confirmation message will appear. An admin user can delete the user only if the user is not using the application now.
### Unlock Account
If a user is locked, the admin user can unlock the user on this page.
### Upload Account
If you want to create a lot of accounts at the same time,please use the upload method, use `tenantcode.admin` to login, you will see this menu.
1.Download a sample.
2.Insert the values as bellow.
3.Select the upload tenant.
4.Upload the file you prepared.
## My User Permission
### User Permission
As the specific operator of the application system, the user can own the permission information. His/her permission set is the permission that his/her role belongs to.
**Search for a User:** Input user name and click **Search**.
**Assign a role to user:** Click **AssignRole**.
To search for and select role, click **Assign** to assign role to the user in the overlay. The pre-defined roles and custom roles are all listed. The user needs to select the specific suitable roles and assign it.
### Role Maintain
To classify and manage many users with similar permissions, the concept of roles is defined, including system administrators, administrators, users, and visitors. It can be understood as a collection of a certain number of permissions, or the carrier of permissions.
Here the tenant admin can create a new role according to his/her need for the business. To achieve it, the user needs to create a role and assign permissions to the newly created role. This is tenant-specific.
**Search for a Role:** Input role name and click **Search**.
**Create Role:** Click **Create** to create one role.
Enter **RoleName** and **Description**, and select **Tenant** from the dropdown.
note
Each role belongs to a tenant.
**Edit Role:** Click **Edit** to edit one role.
**Delete Role:** Click **Delete** to delete one role.
**Assign Permission to Role:** Click **AssignPermission** to assign permission to a role.
You will get the permission type list of all the modules in the platform and their features underneath. Expand the nodes and check whatever is required for the role that you are creating. Then assign it.
**Assign Role to a User:** Click **AssignUser** to assign a role to a user.
Search for user from **Search** and click **Assign** to assign the role to the user. All the users will be available.
**Copy Role:** Click **Copy** to copy the role from another user.
### Permission Maintain
In a system, the operation of a functional module, access to a menu, and even a button on a page, the visibility control of an image all lies within permission management system. Therefore, through the feature permissions, you can know the range of resources that the user can access and operate.
**Search for a Permission:** Input either permission key or permission. Then click **Search** to search for the desired permission.
**Create Permission:** Click **Create** and the **Create Permission** dialog will appear. The user needs to add the details of the permissions designed, name, code and permission type from the list and any API rules to be set.
note
Type is permission type. Each permission belongs to a permission type.
**Edit Permission:** Click **Edit** to edit one permission.
**Delete Permission:** Click **Delete** to delete one permission.
**Batch:** Upload batch to process all permissions and lists and to see and download all batch processes.
### Permission Type Maintain
The same as the permission group, you can classify and manage related permissions. Each permission belongs to a permission type.
**Search for a Permission Type:** Input permission type name and click **Search**.
**Create Permission Type:** Click **Create** to create one permission type.
**Edit Permission Type:** Click **Edit** to edit one permission type.
**Delete Permission Type:** Click **Delete** to delete one permission type.
### API Permission
API permissions are used to control the access to the API. You can view or assign permissions to API on this page.
**Search for a API path:** Input API path and click **Search**.
**Assign Permission:** Select APIs and click **Assign Permission** to assign permissions to API.
**View Permission:** Click **View Permission** to view the permissions that contain the API.
### Grant Access To Tenant
You can grant access to tenant from this page.
#### Key Concept
**Role of tenant:** From API point of view, the tenant can be classified as API vendor (API provider) and API consumer.
- **API vendor or API provider:** A tenant that provides APIs is an API vendor or an API provider.
- **API consumer:** A tenant that calls APIs of an API provider is the API consumer. For example, an insurance company ABC provides flight delay product quotation API. An E-commerce website which helps insurance company ABC to sell flight delay insurance will call the quotation API. Here the E-commerce website is the API consumer.
Select API consumers and API vendors and click **Submit** to grant access to tenant.
note
After granting the selected APIs to a tenant, users under the tenant can use these APIs directly.
## New User Permission (URPV2)
This document is reconstructed based on the original user permission management to achieve flexible permission control and optimize the user operation experience.
### User Permission
You can click the **"X"** after the role name to delete a user's role directly from the list.
You can also select users and click **Download** to download the user permission list.
#### **Assign Role**:
Click the **AssignRole** after the user that you want to assign role to the user.
To search for and select roles, click **Assign** to assign role to the user in the overlay. The pre-defined roles and custom roles are all listed. The user needs to select the specific suitable roles and assign it.
#### **View Permission**:
Click the **ViewPermission** after the user you want to view the permission of the user.
The overlay displays the permissions that the user has in a tree view.
### Role Maintain
In the new **Role Maintain** page, you can control whether the role is shareable. You can also filter the shareable roles at the top of the list.
#### **Search for a Role:**
Input role name and click **Search**.
#### **Create Role:**
Click **Create** to create one role.
Enter **RoleName** and **Description**. Select **Tenant** from the dropdown and determine whether the role is **Shareable**.
note
Each role belongs to a tenant.
#### **Edit Role:**
Click **Edit** to edit one role.
#### **Delete Role:**
Click **Delete** to delete one role.
#### **Assign Permission to Role:**
Click **AssignPermission** to assign permission to a role.
You will get a list of all permissions under your tenant and can search for the one you want using the search bar above. Select what you need for the role you are creating. Then click **Assign** to assign permissions to the role.
#### **Assign Role to a User:**
Click **AssignUser** to assign a role to users.
Search for user from **Search** and click **Assign** to assign the role to the user. All the users that belong to that tenant will be available.
#### **Share Role:**
Click **Share** of a shareable role to share it with other tenants.
Select the tenant you want to share this role with and enter the description, then click **Confirm**.
You can also see the list of tenants you have shared with below.
#### **Share List:**
Click **Share List** to view all the roles you have shared.
You can click **Delete** to cancel this share.
#### **Shared List:**
Click **Shared List** to view all roles shared with you by other tenants.
You can click **View Permission** to see permissions of this role and click **Assign User** to assign this role to users of your tenant.
### Permission Maintain
In the **New User Permission**, we only have three fixed permission types: **resource**, **api** and **policy**.
#### **Search for a Permission:**
Input either permission key or permission. Then click **Search** to search for the desired permission.
#### **Create Permission:**
Click **Create** and the **Create Permission** dialog will appear. The user needs to add the details of the permissions designed, tenant, name, code and permission type from the list. If the permission type is **api**, the user can also set API rules. If the permission type is **resource** or **policy**, the user can also click **Edit Policy** in the lower right corner to set the permission policy.
note
Type is permission type. Each permission belongs to a permission type.
#### **Edit Permission:**
Click **Edit** to edit one permission.
#### **Delete Permission:**
Click **Delete** to delete one permission.
#### **Advance:**
- Select permission items and click **Download** to download permissions or click **Add Tag** to add tag to permissions.
- Click **Upload** to upload more permissions. Select the tenant in the overlay and click **Upload**. After selecting the file, you can view the contents of the file you uploaded in the list below. After confirmation, click **Save** in the upper right corner to complete the upload.
note
The tenants selected for all permissions you upload must only be the tenants you selected.
### API Permission
API permissions are used to control the access to the API. You can view or assign permissions to API on this page.
#### **Search for a API path:**
Input API path and click **Search**.
#### **Assign Permission:**
Select APIs and click **Assign Permission** to assign permissions to API.
#### **View Permission:**
Click **View Permission** to view the permissions that contain the API.
## API Doc
### GET query current account
GET `https://{{gateway}}/xxx/1.0/urpv2/account/query-current-account`
#### Params
|Name|Location|Type|Required| Description |
|---|---|---|---|--------------|
|X-mo-Tenant-Id|header|string| no | tenant code |
|X-mo-User-Identity|header|string| no | account name |
> Response Examples
> 200 Response
```json
{
"code": "i_common_success",
"message": "request success",
"trace_id": "",
"date": "2025-03-03T10:28:05.129Z",
"data": {
"account_id": "616",
"account_name": "testuser",
"account_name_v2": "testuser",
"email": "testuser@insuremo.com",
"login_status": "1",
"nickname": "testuser",
"user_account_flg": "1",
"certified": 1,
"integration_status": "",
"account_status": "",
"mobile": "+231xxxx123",
"organization_id": "",
"last_login": "2025-02-28T08:53:55Z",
"first_login": "0001-01-01T00:00:00Z",
"retry_times": 0,
"password_expire_date": "0001-01-01T00:00:00Z",
"locked_time": "2024-04-01T10:09:55Z",
"create_date": "2019-02-20T00:00:00Z",
"create_user": "",
"update_date": "2025-02-28T08:53:52Z",
"update_user": "system_pwd",
"channel": "",
"last_login_ip": "10.244.20.80",
"last_login_user_agent": "mohttp_go",
"mfa": "otp",
"effective_date": "0001-01-01T00:00:00Z",
"attribute": "{\"requestLimitValue\":null,\"requestLimitUnit\":null}",
"expiry_date": "0001-01-01T00:00:00Z",
"accounts_in_same_group": null,
"user_account_list": [
{
"user_account_flg": "0",
"account_name_v2": "testuser",
"tenant_code_v2": "insuremogi",
"account_name": "testuser",
"tenant_code": "insuremogi",
"tenant_name": "insuremogi"
},
{
"user_account_flg": "1",
"account_name_v2": "testuser",
"tenant_code_v2": "insuremo",
"account_name": "testuser",
"tenant_code": "insuremo",
"tenant_name": "insureMO Foundation"
},
{
"user_account_flg": "0",
"account_name_v2": "testuser",
"tenant_code_v2": "insuremotest",
"account_name": "testuser",
"tenant_code": "insuremoTEST",
"tenant_name": "insuremoTEST"
},
{
"user_account_flg": "0",
"account_name_v2": "testuser",
"tenant_code_v2": "foundation",
"account_name": "testuser",
"tenant_code": "foundation",
"tenant_name": "foundation"
},
{
"user_account_flg": "0",
"account_name_v2": "testuser",
"tenant_code_v2": "lib",
"account_name": "testuser",
"tenant_code": "lib",
"tenant_name": "lib"
}
],
"account_attribute": {
"requestLimitUnit": null,
"requestLimitValue": null
},
"favourite": {
"countryCallingCode": "+xx",
"defaultpage": "home",
"language": "en_us",
"myinsuremosort": ""
},
"account_expire_notify_time": "",
"tenant_code": "insuremo",
"tenant_code_v2": "insuremo",
"tenant_id": "1",
"tenant_name": "insureMO Foundation",
"business_id": "",
"enabled": "1",
"tag": "",
"tenant_attribute": {
"displayName": "insuremoTECH",
"factorResolved": "{\"factor\":[{\"name\":\"Proposal Date\",\"code\":\"proposalDate\",\"lineOfBusiness\":\"ALL\",\"applyTo\":{\"type\":\"Policy\",\"code\":\"POL\",\"name\":\"Policy\"},\"valueType\":\"date\",\"valueLength\":null,\"description\":null,\"tags\":[],\"minOccurance\":null,\"maxOccurance\":null,\"factorType\":\"NON_RISK\",\"category\":\"Simple\",\"externalCode\":\"\",\"displayName\":\"proposalDate\",\"formulaId\":0,\"formulaCode\":\"\",\"formulaName\":\"\",\"required\":true,\"codeTable\":\"\",\"defaultValue\":\"\",\"usedByFormula\":true,\"stableFactor\":true,\"subColumns\":[]},{\"code\":\"productCode\",\"name\":\"Product Code\",\"description\":null,\"tags\":[],\"applyTo\":{\"type\":\"Policy\",\"code\":\"POL\",\"name\":\"Policy\"},\"category\":\"Simple\",\"externalCode\":\"\",\"displayName\":\"productCode\",\"lineOfBusiness\":\"ALL\",\"valueType\":\"string\",\"valueLength\":null,\"minOccurance\":null,\"maxOccurance\":null,\"formulaId\":0,\"formulaCode\":\"\",\"formulaName\":\"\",\"factorType\":\"RISK\",\"required\":true,\"codeTable\":\"\",\"defaultValue\":\"\",\"usedByFormula\":true,\"stableFactor\":true,\"subColumns\":[]},{\"code\":\"productVersion\",\"name\":\"Product Version\",\"description\":null,\"tags\":[],\"applyTo\":{\"type\":\"Policy\",\"code\":\"POL\",\"name\":\"Policy\"},\"category\":\"Simple\",\"externalCode\":\"\",\"displayName\":\"productVersion\",\"lineOfBusiness\":\"ALL\",\"valueType\":\"string\",\"valueLength\":null,\"minOccurance\":null,\"maxOccurance\":null,\"formulaId\":0,\"formulaCode\":\"\",\"formulaName\":\"\",\"factorType\":\"RISK\",\"required\":true,\"codeTable\":\"\",\"defaultValue\":\"\",\"usedByFormula\":true,\"stableFactor\":true,\"subColumns\":[]},{\"code\":\"tenantCode\",\"name\":\"Tenant Code\",\"description\":null,\"tags\":[],\"applyTo\":{\"type\":\"Policy\",\"code\":\"POL\",\"name\":\"Policy\"},\"category\":\"Simple\",\"externalCode\":\"\",\"displayName\":\"tenantCode\",\"lineOfBusiness\":\"ALL\",\"valueType\":\"string\",\"valueLength\":null,\"minOccurance\":null,\"maxOccurance\":null,\"formulaId\":0,\"formulaCode\":\"\",\"formulaName\":\"\",\"factorType\":\"NON_RISK\",\"required\":true,\"codeTable\":\"\",\"defaultValue\":\"\",\"usedByFormula\":true,\"stableFactor\":true,\"subColumns\":[]},{\"code\":\"planCode\",\"name\":\"planCode\",\"description\":null,\"tags\":[],\"applyTo\":{\"type\":\"Policy\",\"code\":\"POL\",\"name\":\"Policy\"},\"category\":\"Simple\",\"externalCode\":\"\",\"displayName\":\"planCode\",\"lineOfBusiness\":\"ACCIDENT\",\"valueType\":\"string\",\"valueLength\":null,\"minOccurance\":null,\"maxOccurance\":null,\"formulaId\":0,\"formulaCode\":\"\",\"formulaName\":\"\",\"factorType\":\"\",\"required\":true,\"codeTable\":\"\",\"defaultValue\":\"\",\"usedByFormula\":true,\"stableFactor\":true,\"subColumns\":[]}]}",
"productPublishUrl": "https://sit.insuremocloud.com/api/insuremoTHAI/pdengine-service/api/v1/integration/product/publication",
"productType": "GI",
"website": "www.insuremotech.com"
},
"extension": "{\n \"product_line\": \"li,gi\",\n \"mail_group\": \"insureMO-Container-ALARM@insuremo.com\",\n \"timezone\": {\n \"area\": \"Asia/Shanghai\",\n \"timeZone\": \"+08:00\",\n \"offset\": 8\n }\n}",
"password_expire_pre_notify_time": "",
"tenant_logo": ""
}
}
```
#### Responses
|HTTP Status Code |Meaning|Description|Data schema|
|---|---|---|---|
|200|[OK](https://tools.ietf.org/html/rfc7231#section-6.3.1)|none|Inline|
## FAQs
**Q: What can the user role permission management system do?**
A: The user role permission management system allows you to control what operations a user can perform in the entire application – basically their level of access and permissions.
**Q: If my application contains certain data that I want only specific users to access, how should I proceed?**
A: The newly developed URPv2 service on the insureMO platform supports this requirement.
* Steps:
1. First, create a new Resource-type permission and add a tag exclusive to this application (e.g., env, tenant). In the policy corresponding to the permission, directly return the IDs of the data that needs to be authorized to the user.
2. Assign this permission to the target user.
3. In the corresponding application, call the URPv2 service API to obtain the user's permission with the specified tag. Based on the content of the permission, the application determines whether the user has access to the current data.
**Q: If a platform offering provider wants to migrate their offering to URPv2 and use URPv2 for API authentication of their application, how should they operate?**
A:
1. First, register their own APIs with the gateway.
2. Specify the URP for API authentication (External Authentication Address) and select "Platform URP V2".
3. Please contact SiteOps to obtain the naming conventions for creating new roles and permissions on the platform.
4. Design permissions starting with the api_ prefix and include all APIs of the current service.
5. Create a new role and associate it with different permissions.
6. Assign the role to the required users.