Leave Application – Relevant Nodes specifications
id name type/feature details explanation
StartEvent_1 bpmn:StartEvent
Initiator requester user name that has started the process is saved in `data.requester`
Request Request bpmn:UserTask
assignee $( Only the user that started the request can invoke it
Approve Approve bpmn:UserTask
script on start this.assignee=appServices.getSupervisor(item.userName); Only the supervisor can perform this task `approval`
timer-event bpmn:BoundaryEvent
timer Cycle:R3P2D Reminder is issued 2 days after Request completion date
Activity_1escddn Reminder bpmn:ScriptTask /* issue notification here */ Issue a reminder notification

User Identification and Authentication

BPMNServer does not provide user identification and authentication component, but relies on the calling application to authenticate the user.

Remote calls rely on apiKey to be passed along with the userId


    const user1 =new SecureUser({ userName: 'user1', userGroups: ['Owner', 'Others']});

    await api.engine.start(modelName,data,{},user1,options);  


Since WebAPP is already authenticated by **APIKey** is trusted to pass user object

    // get api-key from header
    // url/engine/start

    await api.engine.start(processName,data,user,options);  

Using BPMNClient as a service

    const client= new BPMNClient(url,apiKey);
    // userId is passed here bypassing authentication, assuming user is already authenticated

    // await server.engine.start(processName,data,startNode,userId,options);  
    let response = await server.engine.start('Buy Used Car', { caseId: 1050 },null,'user1');

    //await  server.engine.invoke(query, data, userId);

    response = await server.engine.invoke({id: , "items.elementId": 'task_Buy' },{},'user1');

Access Control Rules

Task Assignee (Camunda Extension)

Defining Process Initiator

You can define the variable name for the instance initiator

BPMN Editor Initiator

This will assign the userId of that started the process


BPMN Editor

BPMN Editor Assignee

At the start of the userTask the designer values are evaluated into the instance item.

These fields can accept the following:

  • A string value
  • JavaScript expression $(
  • JavaScript Async function call #(services.getSupervisorUser(

The last calls a services function:

class MyServices {

    async getSupervisorUser(input, context) {
        return input+'Supervisor';

For example: variable data.dueDate is copied into item.dueDate

Pool as a role

BPMNServer allows you to define pools and using the pool name as userGroup

Manual Assignment

An application can prove a UI to allow users to assign tasks to others, this can be done throught the ‘assign’ method:

    const assignment = {assignee: 'user3', candidateUsers: ['user4','user5'],dueDate: new Date()};
    const newData={var1:650};

    response = await server.engine.assign({id: , "items.elementId": 'task_Buy' },newData,userId,assignment);

Searching for Assignment Data

To search for specific items for a particular user or group:

    var res = await server.dataStore.findItems(
            "items.status": "wait", "items.elementId": "task_Buy",
            "$or": [


The above will return all items Buy Tasks in wait state assigned to ‘user5’ or ‘group1’ or ‘group2’

If you have selected to enforce Security Rules, the above will by automatically done for you.