Domain Accessibility in the API

Overview

Not every domain (entity type) in Origami is accessible through the API. Whether a domain appears in the API depends on two factors: whether the domain is configured as securable, and whether the authenticated user has the appropriate permissions granted in their role. This guide explains how to determine domain availability and diagnose access issues.

What is a "Domain"?

A domain represents an entity type in Origami (e.g., Claim, Policy, Employee, Transaction). Each domain maps to a database table and has a set of fields, relationships, and security permissions.

The Two Gates

For a domain to be accessible via the API, it must pass two checks:

1. Domain-level security exists: The domain must have security permissions defined (the "Has Security" setting). Without this, the domain is completely invisible to the API.
2. User-level permission is granted: The authenticated user's role must include the appropriate permission (e.g., View) for that domain.

Discovery Endpoints

GET /api/Domains

Returns the list of all domains the current user can access. This is the primary way to determine what is available to your API token.

What it returns: An array of domain objects representing every domain where:

• The domain has security permissions defined (is securable)
• The current user's role grants at least View permission

Usage:

GET /api/Domains

If a domain you expect to see is missing from this list, either the domain lacks security configuration or your role does not include View permission for it.

GET /api/MetaData/Domains/{domain}/DataDictionary

Returns the field definitions, data types, related domains, and domain attributes for a specific domain. Use this to understand the schema of a domain before querying it.

Usage:

GET /api/MetaData/Domains/Claim/DataDictionary

What it returns:

• Field names and data types
• Which fields are required, read-only, or custom
• Related/child domains
• Domain-level attributes and configuration

This endpoint also requires the user to have Data Dictionary access permissions.

The "Has Security" Setting

The "Has Security" concept determines whether a domain participates in the security system at all. It is configured at the entity level via the [SecurityPermissions] attribute in code.

How it works

• Has Security = true: The domain is securable. It appears in the permissions configuration UI, can be assigned to roles, and is visible to the API (subject to user permissions).
• Has Security = false (or not defined): The domain is not securable. It does not appear in the permissions UI, cannot be assigned to roles, and is completely invisible to the API. No amount of role configuration will make it accessible.

Custom domains

Custom domains (entities created through the Origami UI) have a separate "Is Securable" flag that controls this behavior. When a custom domain is marked as securable, it gains the same security infrastructure as core domains.

Determining Why a Domain Is Not Accessible

Use the following diagnostic steps:

Access Flow Summary

1. Does the domain have security permissions defined?
   NO  → Domain is invisible to the API (not returned by /api/Domains, 404 on direct access)
   YES → Continue to step 2

2. Does the user's role grant the required permission (View, Create, Edit, Delete)?
   NO  → "Insufficient permissions" error on direct access; domain omitted from /api/Domains for View
   YES → Access granted; domain appears in /api/Domains and queries succeed

Practical Workflow

1. Start with /api/Domains to see everything available to your token.
2. Pick a domain from the list.
3. Call /api/MetaData/Domains/{domain}/DataDictionary to understand its fields and relationships.
4. Query data using GET /api/{domain}/Query with appropriate filters and columns.

If a domain you need is not in the list, work with your Origami administrator to:

• Confirm the domain has security enabled
• Add the appropriate permissions (View, Create, Edit, Delete) to your API user's role