Skip to main content
Version: 4.0.2

Create group verification request

POST 
/groups-srv/verifications/requests

This API call creates a reusable group verification request that can be used later to verify user access via GET /groups-srv/verifications/{verificationId}?sub=.

Purpose:

  • Create reusable access control rules referenced by a unique id
  • Define verification criteria once and reuse across multiple verification calls
  • Centralize access control logic for easier management and updates

Authentication Requirements:

  • Requires cidaas:groups_write scope
  • Caller must be a member of CIDAAS_ADMINS with role ADMIN, SECONDARY_ADMIN, GROUPFILTER_MANAGER, GROUP_MANAGER, or GROUPSETUP_MANAGER

Request Structure:

  • id: Required, unique identifier (alphanumeric, underscores, hyphens; stored lowercase)
  • matchCondition: Required, determines how multiple filters are combined ("and" or "or")
  • filters: Required array, must contain at least one filter
  • hints: Optional, controls response fields when verifying via GET

Filter Rules:

  • Each filter must specify exactly one of groupId or groupType (not both, not neither)
  • roleFilter is optional and can be used with either groupId or groupType

Validation Rules:

  • id: Required, must match pattern ^[a-zA-Z0-9_-]+$
  • matchCondition: Required, must be either "and" or "or"
  • filters: Required, must be a non-empty array
  • If groupId is specified, the group must exist
  • If groupType is specified, the group type must exist
  • If roleFilter is provided, it must have valid matchCondition and roles array

Business Rules:

  • Verification requests are stored and referenced by their id
  • Duplicate id returns 409 Conflict — use PUT to update an existing request
  • Use GET /groups-srv/verifications/{verificationId}?sub= to verify user access
  • Changes via PUT or DELETE affect all future verifications using that request ID

Request​

Responses​

Created - New verification request created successfully