---
title: UmaFilter
description: This filter acts as a policy enforcement point, protecting access as a User-Managed Access (UMA) resource server. Specifically, this filter ensures that a request for protected resources includes a valid requesting party token with appropriate scopes before allowing the response to flow back to the requesting party.
component: pinggateway
version: 2026
page_id: pinggateway:reference:UmaFilter
canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/UmaFilter.html
revdate: 2025-06-02T18:01:47Z
section_ids:
  UmaFilter-usage: Usage
  UmaFilter-properties: Properties
  UmaFilter-moreinfo: More information
---

# UmaFilter

This filter acts as a policy enforcement point, protecting access as a User-Managed Access (UMA) resource server. Specifically, this filter ensures that a request for protected resources includes a valid requesting party token with appropriate scopes before allowing the response to flow back to the requesting party.

## Usage

```json
{
    "name": string,
    "type": "UmaFilter",
    "config": {
        "protectionApiHandler": Handler reference,
        "umaService": UmaService reference,
        "realm": configuration expression<string>
    }
}
```

## Properties

* `"protectionApiHandler"`: *Handler [reference](preface.html#definition-reference), required*

  The handler to use when interacting with the UMA Authorization Server for token introspection and permission requests, such as a ClientHandler capable of making an HTTPS connection to the server.

  Learn more in [PingGateway handlers](Handlers.html).

* `"umaService"`: *UmaService [reference](preface.html#definition-reference), required*

  The UmaService to use when protecting resources.

  Learn more in [UmaService](UmaService.html).

* `"realm"`: *configuration expression<[string](preface.html#definition-string)>, optional*

  The UMA realm set in the response to a request for a protected resource that doesn't include a requesting party token enabling access to the resource.

  Default: `uma`

## More information

[User-Managed Access (UMA) Profile of OAuth 2.0](https://docs.kantarainitiative.org/uma/rec-uma-core.html)

[org.forgerock.openig.uma.UmaResourceServerFilter](../_attachments/apidocs/org/forgerock/openig/uma/UmaResourceServerFilter.html)