{
	"info": {
		"_postman_id": "68791cc4-dd97-40c2-ad2d-666c9efbf792",
		"name": "Delegated Administration",
		"description": "#### This collection is meant to facilitate using the OpenIDM API to create roles that can be delegated to users and provide examples of how to use those role as a delegated administrator to perform operations on objects.\n\n###### This collection is designed to provide pre-configured requests for development work or demo purposes, while also providing a better understanding of how the OpenIDM API is used for Delegated Administration.\n  \n**Note:** Each request has the `X-OpenIDM-NoSession` header set as `true` to avoid cookie sharing between the administrator user and the delegated administrator user.",
		"schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
	},
	"item": [
		{
			"name": "1. Create a managed role",
			"event": [
				{
					"listen": "prerequest",
					"script": {
						"id": "1de8065c-666b-4cca-a78d-d4767c9c7bfc",
						"exec": [
							""
						],
						"type": "text/javascript"
					}
				}
			],
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n    \"name\":\"testManagedRole\",\n    \"description\":\"a managed role for test\"\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/role/testManagedRole",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"role",
						"testManagedRole"
					]
				},
				"description": "As admin, create a managed role.  \nThis will ensure there is content when including 'roles' in requests as a delegated administrator."
			},
			"response": []
		},
		{
			"name": "2. Create a managed user that will be a manager",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "If-None-Match",
						"type": "text",
						"value": "*"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n   \"userName\":\"psmith\",\n   \"sn\":\"Smith\",\n   \"givenName\":\"Patricia\",\n   \"mail\": \"psmith.mail@example.com\",\n   \"telephoneNumber\": \"082082082\",\n   \"password\":\"Passw0rd\"\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith"
					]
				},
				"description": "As admin, Create a managed user that will be a manager.  \nThis will ensure there is content when including 'manager' or 'reports' in requests as a delegated administrator."
			},
			"response": []
		},
		{
			"name": "3. Create a managed user with singleton and collection relationships",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "If-None-Match",
						"type": "text",
						"value": "*"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n    \"userName\":\"scarter\",\n    \"sn\":\"Carter\",\n    \"givenName\":\"Steven\",\n    \"mail\": \"scarter.mail@example.com\",\n    \"telephoneNumber\": \"082082082\",\n    \"password\":\"Passw0rd\",\n    \"preferences\": {\n        \"updates\": true,\n        \"marketing\": false\n    },\n    \"manager\": {\"_ref\" : \"managed/user/psmith\"},\n    \"roles\": [{\"_ref\" : \"managed/role/testManagedRole\"}]\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/scarter",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"scarter"
					]
				},
				"description": "As admin, create a user with 'manager' referencing the manager created in step 2, and 'roles' referencing the managed role from step 1."
			},
			"response": []
		},
		{
			"name": "4. Create another managed user with singleton and collection relationships",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "If-None-Match",
						"type": "text",
						"value": "*"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n    \"userName\":\"jdoe\",\n    \"sn\":\"Doe\",\n    \"givenName\":\"John\",\n    \"mail\": \"jdoe@example.com\",\n    \"telephoneNumber\": \"082082082\",\n    \"password\":\"Passw0rd\",\n    \"preferences\": {\n        \"updates\": true,\n        \"marketing\": false\n    },\n    \"manager\": {\"_ref\" : \"managed/user/psmith\"},\n    \"roles\": [{\"_ref\" : \"managed/role/testManagedRole\"}]\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/jdoe",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"jdoe"
					]
				},
				"description": "As admin, create a user with 'manager' referencing the manager created in step 2, and 'roles' referencing the managed role from step 1."
			},
			"response": []
		},
		{
			"name": "5. Create a managed user that will be delegated an internal role with privileges",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"value": "application/json",
						"type": "text"
					},
					{
						"key": "If-None-Match",
						"value": "*",
						"type": "text"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n    \"userName\":\"bjensen\",\n    \"sn\":\"Jensen\",\n    \"givenName\":\"Barbara\",\n    \"mail\": \"mail@example.com\",\n    \"telephoneNumber\": \"082082082\",\n    \"password\":\"Passw0rd\"\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/bjensen",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"bjensen"
					]
				},
				"description": "As admin, create a managed user that will act as the delegated administrator in future requests."
			},
			"response": []
		},
		{
			"name": "6. Create an internal role that will be delegated to the user created in step 5",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "If-None-Match",
						"type": "text",
						"value": "*"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n    \"name\": \"internal_role_with_object_array_and_relationship_privileges\",\n    \"description\": \"an internal role that has privileges for object & array types and relationships\",\n    \"privileges\": [\n        {\n            \"name\": \"managed_user_privilege\",\n            \"path\": \"managed/user\",\n            \"permissions\": [\n                \"VIEW\",\n                \"CREATE\",\n                \"UPDATE\",\n                \"DELETE\"\n            ],\n            \"actions\": [],\n            \"accessFlags\": [\n                {\n                    \"attribute\": \"userName\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"password\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"givenName\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"sn\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"mail\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"description\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"accountStatus\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"telephoneNumber\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"postalAddress\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"city\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"postalCode\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"country\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"stateProvince\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"preferences\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"roles\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"manager\",\n                    \"readOnly\": false\n                },\n                {\n                    \"attribute\": \"reports\",\n                    \"readOnly\": false\n                }\n            ]\n        },\n        {\n            \"name\": \"managed_role_privilege\",\n            \"path\": \"managed/role\",\n            \"permissions\": [\n                \"VIEW\"\n            ],\n            \"actions\": [],\n            \"accessFlags\": [\n                {\n                    \"attribute\": \"name\",\n                    \"readOnly\": true\n                },\n                {\n                    \"attribute\": \"description\",\n                    \"readOnly\": true\n                },\n                {\n                    \"attribute\": \"members\",\n                    \"readOnly\": true\n                }\n            ]\n        }\n    ]\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/internal/role/testInternalRole",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"internal",
						"role",
						"testInternalRole"
					]
				},
				"description": "As admin, create an internal role that will be delegated to the user created in step 4.\n\nThis role will have the following types of privileges:\n\n*  A `managed/user` privilege with accessFlags attributes that are of types \"String\", \"boolean\", and \"number\" but also for:\n    *  an object type that is not a relationship (preferences)\n    *  an object type that is a relationship (manager)\n    *  array types that are relationships (roles, authzRoles, reports)\n*  A `managed/role` privilege for viewing details of the 'roles' property of a managed user\n*  An `internal/role` privilege for viewing the details of the 'authzRoles' property of a managed user\n\n*You can populate the privilege 'filter' field to apply a finer level of permissions to what a Delegated Administrator can see or do with certain objects. It is omitted here to allow all.*\n\n*Keep in mind that for object properties that are not relationships, like 'preferences', you are not able to specify permissions for finer grain details of the property like preferences/marketing.*"
			},
			"response": []
		},
		{
			"name": "7. Delegated administration to a user",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "POST",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"value": "application/json",
						"type": "text"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n   \"_ref\":\"managed/user/bjensen\",\n   \"_refProperties\":{}\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/internal/role/testInternalRole/authzMembers?_action=create",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"internal",
						"role",
						"testInternalRole",
						"authzMembers"
					],
					"query": [
						{
							"key": "_action",
							"value": "create"
						}
					]
				},
				"description": "Assign the role in step 6 to the user you created in step 5, bjensen, by creating their relationship."
			},
			"response": []
		},
		{
			"name": "Query all users and their relationships",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user?_queryFilter=true&_pageSize=100&_fields=*,*_ref/*",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user"
					],
					"query": [
						{
							"key": "_queryFilter",
							"value": "true"
						},
						{
							"key": "_pageSize",
							"value": "100"
						},
						{
							"key": "_fields",
							"value": "*,*_ref/*"
						}
					]
				},
				"description": "As the delegated administrator, query all users and their relationships.  \nResults will show all of the users' properties that are allowed through privileges."
			},
			"response": []
		},
		{
			"name": "Read a certain user's preferences",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/jdoe?_fields=preferences",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"jdoe"
					],
					"query": [
						{
							"key": "_fields",
							"value": "preferences"
						}
					]
				},
				"description": "As the delegated administrator, read a certain user's preferences object."
			},
			"response": []
		},
		{
			"name": "Query a certain user's roles through request fields",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/scarter?_fields=roles/*",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"scarter"
					],
					"query": [
						{
							"key": "_fields",
							"value": "roles/*"
						}
					]
				},
				"description": "As the delegated admnistrator, query a certain user's roles through request fields."
			},
			"response": []
		},
		{
			"name": "Query a certain user's roles directly",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/scarter/roles?_queryFilter=true",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"scarter",
						"roles"
					],
					"query": [
						{
							"key": "_queryFilter",
							"value": "true"
						}
					]
				},
				"description": "As the delegated administrator, query a certain user's roles directly."
			},
			"response": []
		},
		{
			"name": "Query a certain user's roles with the roles' members",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/jdoe/roles?_queryFilter=true&_fields=*,members/*",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"jdoe",
						"roles"
					],
					"query": [
						{
							"key": "_queryFilter",
							"value": "true"
						},
						{
							"key": "_fields",
							"value": "*,members/*"
						}
					]
				},
				"description": "As the delegated administrator, query a certain user's roles which also includes the roles' expanded members."
			},
			"response": []
		},
		{
			"name": "Read a certain user's manager through request fields",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/scarter?_fields=manager/*",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"scarter"
					],
					"query": [
						{
							"key": "_fields",
							"value": "manager/*"
						}
					]
				},
				"description": "As the delegated administrator, read a certain user's manager through request fields."
			},
			"response": []
		},
		{
			"name": "Read a certain user's manager directly",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/scarter/manager",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"scarter",
						"manager"
					]
				},
				"description": "As the delegated administrator, read a certain user's manager directly."
			},
			"response": []
		},
		{
			"name": "Query a certain user's reports through request fields",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith?_fields=reports/*",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith"
					],
					"query": [
						{
							"key": "_fields",
							"value": "reports/*"
						}
					]
				},
				"description": "As the delegated administrator, query a certain user's reports through request fields."
			},
			"response": []
		},
		{
			"name": "Query a certain user's reports directly",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith/reports?_queryFilter=true",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith",
						"reports"
					],
					"query": [
						{
							"key": "_queryFilter",
							"value": "true"
						}
					]
				},
				"description": "As the delegated administrator, query a certain user's reports directly."
			},
			"response": []
		},
		{
			"name": "Remove a report from a  certain user's `reports`",
			"event": [
				{
					"listen": "prerequest",
					"script": {
						"id": "f581da07-4396-4a02-8ca7-9c24bd6c8eb1",
						"exec": [
							"// Reset patch \"value\" content for remove",
							"pm.variables.set(\"patch_remove_value\", \"\");",
							"// Prepare request to retrieve reports for this user",
							"const getRequest = {",
							"    auth: {",
							"      \"type\": \"basic\",",
							"      \"basic\": [",
							"        { \"key\": \"username\", \"value\":  pm.variables.get(\"delegated_username\")},",
							"        { \"key\": \"password\", \"value\":  pm.variables.get(\"delegated_password\")}",
							"      ]",
							"    },",
							"    url: \"http://\" + pm.variables.get(\"host\") + \":\" + pm.variables.get(\"port\") + \"/openidm/managed/user/\"",
							"    + pm.variables.get(\"patch_user_id\") + \"?_fields=reports\",",
							"    method: 'GET',",
							"    header: 'X-OpenIDM-NoSession:true'",
							"};",
							"// Use the reponse to prepare the \"value\" for the patch remove",
							"pm.sendRequest(getRequest, function (err, response) {",
							"    console.log(JSON.stringify(response.json()));",
							"    response.json().reports.forEach(function (report) {",
							"        if (report._ref === 'managed/user/' + pm.variables.get(\"patch_remove_user_id\")) {",
							"            // Set patch \"value\" content for remove",
							"            pm.variables.set(\"patch_remove_value\", JSON.stringify(report));",
							"        }",
							"    });",
							"});"
						],
						"type": "text/javascript"
					}
				}
			],
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"type": "text",
						"value": "true"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"remove\",\n\t   \"field\" : \"/reports\",\n\t   \"value\" : {{patch_remove_value}}\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/{{patch_user_id}}",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"{{patch_user_id}}"
					]
				},
				"description": "As the delegated administrator, remove a report from a certain user's `reports`.  \nThis request uses a Pre-request Script to prepare the value for the patch remove operation.  \nThe value needs to match the body of the report content as if it were requested like `managed/user/_id?fields=reports`"
			},
			"response": []
		},
		{
			"name": "Add to a certain user's reports",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"value": "application/json",
						"type": "text"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"type": "text"
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"add\",\n\t   \"field\" : \"/reports/-\",\n\t   \"value\" : {\"_ref\" : \"managed/user/scarter\"}\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith"
					]
				},
				"description": "As the delegated administrator, add an additional report a certain user's `reports`."
			},
			"response": []
		},
		{
			"name": "Replace a  certain user's reports",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"replace\",\n\t   \"field\" : \"/reports\",\n\t   \"value\" : [{\"_ref\" : \"managed/user/scarter\"}]\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith"
					]
				},
				"description": "As the delegated administrator, replace the entirety of a certain user's `reports`."
			},
			"response": []
		},
		{
			"name": "Add a certain user's manager",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t    \"operation\" : \"add\",\n\t    \"field\" : \"/manager\",\n\t    \"value\" : {\"_ref\" : \"managed/user/psmith\"}\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/jdoe",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"jdoe"
					]
				},
				"description": "As the delegated administrator, add a certain user's `manager`."
			},
			"response": []
		},
		{
			"name": "Remove a certain user's manager",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"value": "application/json",
						"type": "text"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"remove\",\n\t   \"field\" : \"/manager\"\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/jdoe",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"jdoe"
					]
				},
				"description": "As the delegated administrator, remove a certain user's `manager`."
			},
			"response": []
		},
		{
			"name": "Replace a certain user's manager",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"replace\",\n\t   \"field\" : \"manager\",\n\t   \"value\" : {\"_ref\" : \"managed/user/jdoe\"}\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/scarter",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"scarter"
					]
				},
				"description": "As the delegated administrator, replace a certain user's `manager`."
			},
			"response": []
		},
		{
			"name": "Delete a certain user",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "DELETE",
				"header": [
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith"
					]
				},
				"description": "As the delegated administrator, delete a certain user"
			},
			"response": []
		},
		{
			"name": "Create a user through POST",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "POST",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"value": "application/json",
						"type": "text"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n   \"userName\":\"psmith\",\n   \"sn\":\"Smith\",\n   \"givenName\":\"Patricia\",\n   \"mail\": \"psmith.mail@example.com\",\n   \"telephoneNumber\": \"082082082\",\n   \"password\":\"Passw0rd\"\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user"
					]
				},
				"description": "As the delegated administrator, create a user through a POST request."
			},
			"response": []
		},
		{
			"name": "Create a user through PUT with a certain \"_id\"",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "PUT",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "If-None-Match",
						"type": "text",
						"value": "*"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "{\n   \"userName\":\"psmith\",\n   \"sn\":\"Smith\",\n   \"givenName\":\"Patricia\",\n   \"mail\": \"psmith.mail@example.com\",\n   \"telephoneNumber\": \"082082082\",\n   \"password\":\"Passw0rd\"\n}"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user/psmith",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user",
						"psmith"
					]
				},
				"description": "As the delegated admnistrator, create a new user with a certain \"_id\" through a PUT request."
			},
			"response": []
		},
		{
			"name": "Add a filter to internal role privilege",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"replace\",\n\t   \"field\" : \"privileges\",\n\t   \"value\" : [\n\t       {\n\t           \"name\": \"managed_user_privilege\",\n\t           \"path\": \"managed/user\",\n\t           \"permissions\": [\n\t               \"VIEW\",\n\t               \"CREATE\",\n\t               \"UPDATE\",\n\t               \"DELETE\"\n\t           ],\n\t           \"actions\": [],\n\t           \"filter\": \"{{privilege_filter}}\",\n\t           \"accessFlags\": [\n\t               {\n\t                   \"attribute\": \"userName\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"password\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"givenName\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"sn\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"mail\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"description\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"accountStatus\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"telephoneNumber\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"postalAddress\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"city\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"postalCode\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"country\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"stateProvince\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"preferences\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"roles\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"manager\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"reports\",\n\t                   \"readOnly\": false\n\t               }\n\t           ]\n\t       },\n\t       {\n\t           \"name\": \"managed_role_privilege\",\n\t           \"path\": \"managed/role\",\n\t           \"permissions\": [\n\t               \"VIEW\"\n\t           ],\n\t           \"actions\": [],\n\t           \"accessFlags\": [\n\t               {\n\t                   \"attribute\": \"name\",\n\t                   \"readOnly\": true\n\t               },\n\t               {\n\t                   \"attribute\": \"description\",\n\t                   \"readOnly\": true\n\t               },\n\t\t\t\t   {\n\t                   \"attribute\": \"members\",\n\t                   \"readOnly\": true\n\t               }\n\t           ]\n\t       }\n\t   ]\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/internal/role/testInternalRole",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"internal",
						"role",
						"testInternalRole"
					]
				},
				"description": "As admin, Patch the role being used for delegated administration to include a filter on `managed/user` objects."
			},
			"response": []
		},
		{
			"name": "Query all `managed/user` objects after a filter update",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"equals": true,
						"key": "X-OpenIDM-NoSession",
						"value": "true"
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user?_queryFilter=true&_pageSize=100",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user"
					],
					"query": [
						{
							"key": "_queryFilter",
							"value": "true"
						},
						{
							"key": "_pageSize",
							"value": "100"
						}
					]
				},
				"description": "As the delegated administrator, query all `managed/user` objects once the privilege filter has been added to observe only the matching results are returned in the response."
			},
			"response": []
		},
		{
			"name": "Add a dynamic filter to internal role privilege",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{admin_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{admin_username}}",
							"type": "string"
						}
					]
				},
				"method": "PATCH",
				"header": [
					{
						"key": "Content-Type",
						"name": "Content-Type",
						"type": "text",
						"value": "application/json"
					},
					{
						"key": "X-OpenIDM-NoSession",
						"value": "true",
						"equals": true
					}
				],
				"body": {
					"mode": "raw",
					"raw": "[\n\t{\n\t   \"operation\" : \"replace\",\n\t   \"field\" : \"privileges\",\n\t   \"value\" : [\n\t       {\n\t           \"name\": \"managed_user_privilege\",\n\t           \"path\": \"managed/user\",\n\t           \"permissions\": [\n\t               \"VIEW\",\n\t               \"CREATE\",\n\t               \"UPDATE\",\n\t               \"DELETE\"\n\t           ],\n\t           \"actions\": [],\n\t           \"filter\": \"{{dynamic_privilege_filter}}\",\n\t           \"accessFlags\": [\n\t               {\n\t                   \"attribute\": \"userName\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"password\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"givenName\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"sn\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"mail\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"description\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"accountStatus\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"telephoneNumber\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"postalAddress\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"city\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"postalCode\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"country\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"stateProvince\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"preferences\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"roles\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"manager\",\n\t                   \"readOnly\": false\n\t               },\n\t               {\n\t                   \"attribute\": \"reports\",\n\t                   \"readOnly\": false\n\t               }\n\t           ]\n\t       },\n\t       {\n\t           \"name\": \"managed_role_privilege\",\n\t           \"path\": \"managed/role\",\n\t           \"permissions\": [\n\t               \"VIEW\"\n\t           ],\n\t           \"actions\": [],\n\t           \"filter\": \"/name sw 'test'\",\n\t           \"accessFlags\": [\n\t               {\n\t                   \"attribute\": \"name\",\n\t                   \"readOnly\": true\n\t               },\n\t               {\n\t                   \"attribute\": \"description\",\n\t                   \"readOnly\": true\n\t               },\n\t               {\n\t                   \"attribute\": \"members\",\n\t                   \"readOnly\": true\n\t               }\n\t           ]\n\t       }\n\t   ]\n\t}\n]"
				},
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/internal/role/testInternalRole",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"internal",
						"role",
						"testInternalRole"
					]
				},
				"description": "As admin, Patch the role being used for delegated administration to include a dynamic filter for `managed/user` objects.  \nThis type of filter is interpreted based on the requester's property data.  \nFor example, if the filter is `\"/mail co \\\"{{mail}}\\\"\"` then the results are filtered where the \"mail\" property of the requested objects contains the value for the \"mail\" property of the requester."
			},
			"response": []
		},
		{
			"name": "Query all `managed/user` objects after second filter update",
			"request": {
				"auth": {
					"type": "basic",
					"basic": [
						{
							"key": "password",
							"value": "{{delegated_password}}",
							"type": "string"
						},
						{
							"key": "username",
							"value": "{{delegated_username}}",
							"type": "string"
						}
					]
				},
				"method": "GET",
				"header": [
					{
						"equals": true,
						"key": "X-OpenIDM-NoSession",
						"value": "true"
					}
				],
				"url": {
					"raw": "http://{{host}}:{{port}}/openidm/managed/user?_queryFilter=true&_pageSize=100",
					"protocol": "http",
					"host": [
						"{{host}}"
					],
					"port": "{{port}}",
					"path": [
						"openidm",
						"managed",
						"user"
					],
					"query": [
						{
							"key": "_queryFilter",
							"value": "true"
						},
						{
							"key": "_pageSize",
							"value": "100"
						}
					]
				},
				"description": "As the delegated administrator, all `managed/user` objects once the privilege filter has been updated to be dynamic and observe only the results matching \"{{dynamic-privilege-filter}}\" are returned in the response."
			},
			"response": []
		}
	],
	"event": [
		{
			"listen": "prerequest",
			"script": {
				"id": "812d7b57-4e52-48e7-8ac0-18e3a790494b",
				"type": "text/javascript",
				"exec": [
					""
				]
			}
		},
		{
			"listen": "test",
			"script": {
				"id": "fc0e6d9a-ed15-42f9-881b-5e0cd2b28206",
				"type": "text/javascript",
				"exec": [
					""
				]
			}
		}
	],
	"variable": [
		{
			"id": "b36caaf9-76db-4953-86a7-81dc7499e48f",
			"key": "host",
			"value": "localhost",
			"type": "string"
		},
		{
			"id": "bfa32566-84bc-4596-b701-0f5394ff5964",
			"key": "port",
			"value": "8080",
			"type": "string"
		},
		{
			"id": "450c2ac6-7a73-4e30-bd91-ecf037e10a92",
			"key": "admin_username",
			"value": "openidm-admin",
			"type": "string"
		},
		{
			"id": "ea9a3371-6c08-42d3-b8d3-d3d1a2a7d241",
			"key": "admin_password",
			"value": "openidm-admin",
			"type": "string"
		},
		{
			"id": "b281cf43-954b-4407-935f-cc1dc0d46e11",
			"key": "delegated_username",
			"value": "bjensen",
			"type": "string"
		},
		{
			"id": "9b4a7e09-f3ee-4413-bf12-01d89cc76eee",
			"key": "delegated_password",
			"value": "Passw0rd",
			"type": "string"
		},
		{
			"id": "8cc43c6c-4897-4171-8d73-eeee13433b08",
			"key": "privilege_filter",
			"value": "/userName eq \\\"scarter\\\"",
			"type": "string"
		},
		{
			"id": "437b5b92-59e3-4296-b4f9-365632f2dcc4",
			"key": "dynamic_privilege_filter",
			"value": "/mail co \\\"{{mail}}\\\"",
			"type": "string"
		},
		{
			"id": "4d8bf8a7-f92c-4732-8168-3b193ee9d298",
			"key": "patch_remove_value",
			"value": "",
			"type": "string"
		},
		{
			"id": "60af5521-2bc1-496d-baab-cc6acc172aca",
			"key": "patch_remove_user_id",
			"value": "scarter",
			"type": "string"
		},
		{
			"id": "fba8bef1-4863-4ac1-a127-97edac5450d7",
			"key": "patch_user_id",
			"value": "psmith",
			"type": "string"
		}
	],
	"protocolProfileBehavior": {}
}