ResourceOwnerIdentifier (Semantic Module)

← Back to Modules Reference

The ResourceOwnerIdentifier semantic module is used to establish direct data ownership and enforce privacy. By applying this tag to an association (relationship) between any resource (such as an Order or Document) and the User entity, the platform automatically implements row-level security and tenant isolation without requiring custom backend code.

---

Technical Specifications

Attribute	Specification
Scope	Association (Applied to relationships between entities)
Data Type	Association / Foreign Key
Indexing	Automatically builds a database index on the relationship field to guarantee high-performance queries
Write Behavior	Automatically set by the system; protected against spoofing and client edits

---

How It Works Automatically

1. Automatic Owner Assignment

When a user creates a new record (such as submitting a new order via a POST request), the Serverless Engine automatically extracts the user’s identity from their login session and assigns it to this association field. The client application does not need to submit the owner’s ID in the request body.

2. Strict Anti-Spoofing Security

To ensure data integrity, the system blocks users from manually assigning ownership:

• If a client request includes a value for this relationship (e.g. attempting to create an order for another user), the platform rejects the request immediately.
• Once a record is saved, the ownership relationship is immutable through normal edits. Users cannot transfer ownership to another account using PUT or PATCH updates.

3. Implicit Listing Filters

When an API endpoint is configured with a Match Resource Owner Access Rule, the runtime automatically intercepts listing queries. The platform silently injects a filter so that GET listings only return records owned by the authenticated user. This guarantees that users cannot view each other’s private data.

4. Detail Interception & Leakage Protection

If a user tries to access or delete a single record belonging to someone else:

• The system detects the ownership mismatch and aborts the request.
• The API returns a 404 Not Found (rather than a 403 Forbidden) to prevent “ID harvesting” — ensuring malicious actors cannot even verify whether a resource exists.

---

Transitive Ownership

For complex, multi-layered data models (for example, where a Comment belongs to a Post, and the Post belongs to a User), you do not need to link every single record directly to the user.

Instead, you can use the RelationalResourceOwner semantic module on sub-resources. The platform will automatically traverse the relationship path to find the ultimate owner.

---

API Lifecycle Examples

In this example, an entity named Post has an association named author linked to the User entity, tagged with the ResourceOwnerIdentifier semantic.

1. Creating a Record (Request)

A logged-in user creates a new post. The request body only contains the post content — it does not specify who the author is:

POST /posts
{
  "title": "My First Post",
  "content": "This is the content of my post."
}

Server Response (Auto-Assigned Owner)

The platform registers the post and automatically links the author field to the authenticated user’s ID (usr_771923):

{
  "id": "pst_128930",
  "title": "My First Post",
  "content": "This is the content of my post.",
  "author": "usr_771923",
  "created_at": "2026-06-28T13:42:00Z"
}

2. Spoofing Attempt (Rejected Request)

A client tries to explicitly assign a post to a different user ID (usr_999999):

POST /posts
{
  "title": "Malicious Post",
  "content": "Trying to impersonate someone else.",
  "author": "usr_999999"
}

Server Response (422 Validation Error)

The platform blocks the request to maintain security, returning a standard RFC 9457 Problem Details payload:

{
  "type": "https://docs.apinow.app/errors/validation",
  "title": "Validation Error",
  "status": 422,
  "code": "VALIDATION_ERROR",
  "detail": "Field validation failed",
  "instance": "/posts",
  "errors": [
    {
      "detail": "Ownership field 'author' is managed by the system and cannot be supplied manually.",
      "pointer": "/author",
      "code": "validation"
    }
  ]
}

---

Validation Rules & Errors

• Alignment Error: You must apply this semantic module to an Association relationship. Applying it to standard text or number properties results in a validation error during linting.
• Missing Access Rule Warning: While ResourceOwnerIdentifier registers the data-layer ownership metadata, it requires an API-level access rule (Match Resource Owner Access Rule) on the exposed endpoint to enforce security checks. If no rule is configured, the data remains publicly visible.