ABAC Attributes

Attribute definitions declare the named properties your ABAC (attribute-based access control) policies can reference on users and resources. A definition pins down the attribute's slug, data type, and default value. Separately, attribute values are the actual data attached to a specific user or resource. Policies reference attributes by slug at evaluation time.

Use this reference to manage definitions and set values over the API.

GET    /orgs/{orgId}/api/v1/abac/attributes
POST   /orgs/{orgId}/api/v1/abac/attributes
GET    /orgs/{orgId}/api/v1/abac/attributes/{attributeId}
PUT    /orgs/{orgId}/api/v1/abac/attributes/{attributeId}
DELETE /orgs/{orgId}/api/v1/abac/attributes/{attributeId}

The Attribute Object

Attribute Object

{
  "id": "01JF3KATTR...",
  "slug": "approval_limit",
  "name": "Approval Limit",
  "description": "Maximum dollar amount the user can approve",
  "dataType": "number",
  "attributeType": "user",
  "defaultValue": 0,
  "validationRules": {
    "min": 0,
    "max": 1000000
  },
  "createdAt": "2026-01-15T10:30:00Z"
}

Field	Description
name	Human-readable name (required)
slug	Unique identifier used in policy conditions
attributeType	user, resource, or environment (required)
dataType	string, number, boolean, array, date, or datetime (required)
defaultValue	Value used when the attribute is not explicitly set
validationRules	Optional constraints applied when a value is set (see below)

Validation Rules

validationRules is an optional object. Any of these keys may be present; each is enforced when a value is written for the attribute:

Rule	Applies to	Meaning
min / max	number	Value must be ≥ min and ≤ max
minLength / maxLength	string	String length bounds
pattern	string	Value must match this regular expression
enum	any	Value must be one of the listed values

List Attributes

List Attributes

curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/attributes" \
  -H "Authorization: ApiKey lmk_abc123"

Create Attribute

Create an Attribute

curl -X POST https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/attributes \
  -H "Authorization: ApiKey lmk_abc123" \
  -H "Content-Type: application/json" \
  -d '{
    "slug": "approval_limit",
    "name": "Approval Limit",
    "description": "Maximum dollar amount the user can approve",
    "dataType": "number",
    "attributeType": "user",
    "defaultValue": 0
  }'

name, attributeType, and dataType are required.

List Attribute Definitions by Type

To fetch only the definitions for one entity type, use the dedicated endpoint with the type query parameter (user, resource, or environment):

List user attribute definitions

curl "https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/attribute-definitions?type=user" \
  -H "Authorization: ApiKey lmk_abc123"

Set Attribute Value on a User

Set User Attribute

curl -X PUT \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/users/01JF3KUSER.../attributes/approval_limit" \
  -H "Authorization: ApiKey lmk_abc123" \
  -H "Content-Type: application/json" \
  -d '{"value": 25000}'

Set an Attribute Value on a Resource

Resource attributes are set one slug at a time, exactly like user attributes:

Set Resource Attribute

curl -X PUT \
  "https://app.lumoauth.dev/orgs/acme-corp/api/v1/abac/resources/invoice/INV-4821/attributes/amount" \
  -H "Authorization: ApiKey lmk_abc123" \
  -H "Content-Type: application/json" \
  -d '{"value": 45000}'

Read them back with GET /orgs/{orgId}/api/v1/abac/resources/{resourceType}/{resourceId}/attributes.

Related

• Policies — reference these attributes from policy conditions.
• ABAC overview — evaluation semantics.