Authentication

The modeler reuses the authentication infrastructure of cibseven-webclient. Every REST endpoint validates the session token provided in the request.

Authorization

Authentication alone is not enough: a caller must also hold the application ACCESS permission for the modeler resource, the same permission that decides whether the modeler appears in the UI. Requests from an authenticated user without it are answered with 403 Forbidden. This applies to the diagram, form and element template endpoints, to the diagram history, and to the chat (Enterprise Edition), whose rooms are diagrams. Changed in 2.3.0.

Grant it under Admin → Authorizations → Application, for resource id modeler or *, with permission ACCESS or ALL. A revoke authorization for either resource id takes the access away again. When authorization is disabled in the engine, nothing is enforced and every authenticated user may use the modeler.

One exception: the plain GET {basePath}/modeler/element-templates listing requires authentication only, because the process diagram viewer loads element templates to render their icons for users who never open the modeler.

Integration with CIB seven Engine

Endpoints that interact with the CIB seven engine (deploy, start process) forward the authenticated user context to the engine. This ensures that engine audit trails reflect the actual user, not a service account.