Defines the RBAC (Role-Based Access Control) and CBAC (Context-Based Access Control) rules for every API group and endpoint in the UDAI system.
For the full explanation of every role see enums.md:
org_membership_roleandorg_type.
Global Security & Context Middleware
UDAI API access is secured and contextualized via three mandatory global middleware layers. These execute before any endpoint-specific RBAC/CBAC logic.
| Middleware Layer | Header | Enforcement Logic | Exclusions |
|---|---|---|---|
| Partner Gateway | partner-api-key | Rejects requests with 401/403 if the platform API key is missing or invalid. A platform-admin partner key is provisioned at first deployment for bootstrap. | Auth endpoints only (/auth/*), Hangfire (/hangfire), WebSocket endpoints |
| User Authentication | Authorization | Validates JWT (Bearer \<token\>), checks expiration/signature, and authenticates the user_uuid. | Public endpoints (e.g., /auth/register, /auth/login-password, /auth/verify/send-otp) |
| Delegated Context | X-Organisation-ID | Enforces CBAC by parsing the org UUID and validating that the active user_uuid holds a valid memberships (Owner, Admin, or Member) within that specific organisation. Rejects with 403 Forbidden if the user attempts to act on behalf of an org they do not belong to. | Public endpoints and operations that resolve context implicitly (e.g., /auth/*, /users/me) |
Key Dimensions
RBAC: Role-Based
| Dimension | Values |
|---|---|
org_membership_role | 1 = Member · 2 = Admin · 3 = Owner (higher number = higher privilege) |
org_type | 1 = Asset Manufacturer · 2 = Asset Owner · 3 = Airspace Manager · 4 = Airspace Monitor · 5 = RPTO · 6 = Type Certification Body · 7 = DGCA |
Rule shorthand used in tables below:
- Any: any authenticated user with a valid org memberships
- Member+:
org_membership_role≥ 1 (Member, Admin, or Owner) - Admin+:
org_membership_role≥ 2 (Admin or Owner) - Owner:
org_membership_role= 3 only
CBAC: Context-Based
CBAC rules restrict access based on runtime context: what the requesting org or user owns or is linked to, not just their static role.
Access Control Matrix
1. Authentication APIs
Group Logic: Authentication endpoints are generally Public (requiring only a Partner API Key). Organisation creation is allowed for authenticated Active users without org context; org management mutations require org membership context (CBAC).
| Endpoint | Method | RBAC | CBAC |
|---|---|---|---|
/auth/login-password | POST | Public | - |
/auth/login-otp | POST | Public | - |
/auth/send-otp | POST | Public | - |
/auth/refresh | POST | Any | - |
/auth/logout | POST | Any | - |
GET /users | GET | Admin+ | Only within own org |
GET /users/\{user_uuid\} | GET | Admin+ | Only within own org |
PUT /users/\{user_uuid\}/role | PUT | Admin+ (Owner only to promote to Admin) | Only within own org |
GET /users/me | GET | Any | Own profile only |
PUT /users/me | PUT | Any | Own profile only |
POST /organisations | POST | Any (Active user) | Own user context only |
GET /organisations/\{org_uuid\} | GET | Member+ | Own org only |
PUT /organisations/\{org_uuid\} | PUT | Admin+ | Own org only |
POST /resource-invitations | POST | Admin+ | Own org only |
POST /resource-invitations/accept | POST | Any | Must be the invitee |
GET /resource-invitations | GET | Admin+ | Own org only |
DELETE /resource-invitations/\{invite_uuid\} | DELETE | Admin+ | Own org only |
GET /resource-memberships | GET | Member+ | Own org only |
DELETE /resource-memberships/\{uuid\} | DELETE | Admin+ | Own org; cannot remove Owner |
2. Fleet APIs
Group Logic: Fleet mutations are restricted to Admin+ roles. Asset Manufacturer (Type 1) can register Asset Models, Assets, Payload Models, and initiate ownership transfers of assets. Asset Owner (Type 2) can transfer ownership of assets and add their own assets.
| Endpoint | Method | RBAC | CBAC |
|---|---|---|---|
POST /asset-models | POST | Admin+ | org_type = Asset Manufacturer |
POST /asset-models/bulk | POST | Admin+ | org_type = Asset Manufacturer |
GET /asset-models | GET | Any | - |
GET /asset-models/\{uuid\} | GET | Any | - |
GET /asset-models/\{uuid\}/payloads | GET | Any | - (payloads not scoped to caller’s org) |
PUT /asset-models/\{uuid\} | PUT | Admin+ | org_type = Asset Manufacturer; own model only |
DELETE /asset-models/\{uuid\} | DELETE | Admin+ | org_type = Asset Manufacturer; own model only |
/payload-models | POST | Admin+ | org_type = Asset Manufacturer or Asset Owner |
/payload-models | GET | Member+ | Own org’s payload models only |
/payload-models/\{uuid\} | GET | Member+ | Must own the payload model |
/payload-models/\{uuid\} | PUT | Admin+ | Must own the payload model |
/payload-models/\{uuid\} | DELETE | Admin+ | Must own the payload model |
POST /assets | POST | Admin+ | Own org only |
POST /assets/bulk | POST | Admin+ | Own org only |
GET /assets | GET | Member+ | Own org’s assets only |
GET /assets/\{uuid\} | GET | Member+ | Must have active memberships (Owner) of asset |
PUT /assets/\{uuid\} | PUT | Admin+ | Must have active memberships (Owner) of asset |
DELETE /assets/\{uuid\} | DELETE | Admin+ | Must have active memberships (Owner) of asset |
POST /resource-invitations | POST | Admin+ | org_type = Asset Owner; for asset transfers (resource_type=2) |
POST /assets/\{uuid\}/transfers | POST | Admin+ | Current asset-owning org; X-Organisation-ID required; destination supplied via org_udai_id |
GET /assets/\{uuid\}/transfers | GET | Member+ | Current asset-owning org; X-Organisation-ID required |
POST /assets/\{uuid\}/transfers/accept | POST | Authenticated | Must be Admin/Owner of destination org; X-Organisation-ID required for destination org |
GET /resource-memberships | GET | Member+ | Own org’s memberships only |
DELETE /resource-memberships/\{uuid\} | DELETE | Admin+ | Must be the owning org; membership must be Active |
3. Mission APIs
Group Logic: Missions and Flight Plans are primarily managed by Asset Owner (Type 2). Creating plans requires Member+ roles. Airspace access requests are submitted by the owner and reviewed by Airspace Manager (Type 3).
| Endpoint | Method | RBAC | CBAC |
|---|---|---|---|
POST /missions | POST | Admin+ | org_type = Asset Owner |
GET /missions | GET | Member+ | Asset Owner: own org only. Airspace Manager: missions whose airspace_restrictions_covered intersects a zone the org owns or holds a Manager/Monitor membership for |
GET /missions/\{uuid\} | GET | Member+ | Asset Owner: own org only. Airspace Manager: mission must fall under a zone the org owns or holds a Manager/Monitor membership for |
PUT /missions/\{uuid\} | PUT | Admin+ | Own org; created by same org |
DELETE /missions/\{uuid\} | DELETE | Admin+ | Own org only |
POST .../missions/\{uuid\}/permissions | POST | Admin+ | Own org only |
PUT .../permissions/\{perm_uuid\} | PUT | Admin+ | org_type = Airspace Manager; must have Manager memberships for the zone |
POST .../plans | POST | Member+ | Asset and pilot must be listed in parent mission |
GET .../plans | GET | Member+ | Own org’s plans only |
GET .../plans/\{uuid\} | GET | Member+ | Own org only |
PUT .../plans/\{uuid\} | PUT | Member+ | Must be the plan creator |
POST .../plans/\{uuid\}/permissions | POST | Admin+ | Own org only |
4. 📊 Telemetry APIs
Group Logic: Live telemetry ingestion is restricted to the Pilot or Admin of the owning organisation. Monitoring access is restricted to Airspace Managers (Type 3) and Airspace Monitors (Type 4) for zones where they have authorised memberships.
| Endpoint | Method | RBAC | CBAC |
|---|---|---|---|
POST .../flight-sessions | POST | Member+ | Must own the asset and have access to flight plan if provided |
GET .../flight-sessions | GET | Member+ | Own org’s sessions only |
GET .../flight-sessions/\{uuid\} | GET | Member+ | Must be the pilot or org admin, or have access to the flight plan |
POST .../flight-sessions/\{uuid\}/telemetry | POST | Member+ | Must be the pilot or org admin |
GET .../airspace/active-flights | GET | Member+ | org_type = Airspace Manager or Airspace Monitor; org must hold zone Manager or Monitor membership |
GET .../airspace/assets/\{asset_uuid\} | GET | Member+ | org_type = Airspace Manager or Airspace Monitor; org must hold zone Manager or Monitor membership |
GET .../airspace/assets/\{asset_uuid\}/plans | GET | Member+ | org_type = Airspace Manager or Airspace Monitor; org must hold zone Manager or Monitor membership |
POST .../airspace/assets/\{asset_uuid\}/alert | POST | Admin+ | org_type = Airspace Manager; org must hold zone Manager membership |
5. Airspace APIs
Group Logic: Airspace Zones and Constraints are managed by Airspace Manager (Type 3). While everyone (Any) can view zones, only authorised managers can modify geometry or memberships. The Constraint Engine acts as the geospatial backbone for all shapes.
| Endpoint | Method | RBAC | CBAC |
|---|---|---|---|
POST /airspaces | POST | Admin+ | org_type = Airspace Manager |
POST /airspaces/bulk | POST | Admin+ | org_type = Airspace Manager |
GET /airspaces | GET | Member+ | All authenticated orgs; returns all active zones with zone_envelope geometry |
GET /airspaces/\{uuid\} | GET | Member+ | All authenticated orgs; returns full zone detail with memberships |
PUT /airspaces/\{zone_uuid\} | PUT | Admin+ | org_type = Airspace Manager; zone Manager memberships required |
POST /resource-invitations | POST | Admin+ | org_type = Airspace Manager; zone Manager memberships required |
GET /airspace-memberships | GET | Member+ | Own org only |
DELETE /airspaces/\{zone_uuid\}/memberships/\{uuid\} | DELETE | Admin+ | org_type = Airspace Manager; zone Manager memberships required |
POST /constraints | POST | Admin+ | JWT and organisation policy |
GET /constraints/\{uuid\} | GET | Any | Authenticated |
6. Partner and Platform Admin APIs
Group Logic: Platform management endpoints for partner key administration and platform admin operations. Requires Platform Admin privilege (config-based, not org-based). These endpoints require the platform admin partner API key for access.
| Endpoint | Method | RBAC | CBAC |
|---|---|---|---|
/partner-keys | POST | Platform Admin | - |
/partner-keys | GET | Platform Admin | - |
/partner-keys/\{key_uuid\} | DELETE | Platform Admin | - |
Platform Admin Authorisation:
- Platform admins are defined via email whitelist in
appsettings.jsonunderPlatformAdmins:Emails - Users whose email appears in the whitelist can perform platform-level operations
- Changes to platform admin status require config file updates
- All platform admin operations are audit-logged with actor tracking
Bootstrap Process:
- A platform admin partner key is provisioned at first deployment for bootstrap
- Partner name:
platform-admin - The seeded API key must be rotated immediately after initial setup in production environments
- This key is required in the
partner-api-keyheader for all partner key management operations
Security Layers:
- ✅ Partner Gateway: REQUIRED (uses pre-seeded platform-admin partner key)
- ✅ JWT Authentication: REQUIRED (must be authenticated user)
- ❌ Delegated Context (
X-Organisation-ID): NOT REQUIRED (platform-level, not org-scoped) - ✅ Platform Admin Check: REQUIRED (email must be in config whitelist)