Authentication

Reeve uses a token-based authentication system to secure access to its APIs and services. This system is designed to ensure that only authorized users can access sensitive financial data and perform actions within the Reeve platform.

Currently three roles are defined:

• Admin: This role has full access to all features and functionalities of Reeve, including user management, configuration, and data access.
• Manager: This role has access to manage financial data and reports and is allowed to publish transactions and reports to the blockchain.
• Accountant: This role has access to manage financial data and reports, but unlike the manager the accountant is not allowed to publish transactions or reports.

Public access to published financial data is handled through the dedicated Indexer service, which provides a separate interface for stakeholders to access publicly available information without requiring authentication.

Token-Based Authentication

Reeve uses JSON Web Tokens (JWT) for authentication. When a user logs in, they receive a token that must be included in the Authorization header of subsequent API requests. The token contains information about the user’s role and permissions, allowing the server to authorize access to specific resources.

Reeve uses one additional field in the JWT to provide more context about the user:

• organisastions: A list of organisations the user is associated with. This allows the server to determine which organisation’s data the user can access.

In the default setup Keycloak  is used as the identity provider. Keycloak is an open-source identity and access management solution that provides features such as single sign-on, user federation, and social login. The default keycloak configuration can be found here: realm-export.json .

Role-Based Access Control

This table provides a comprehensive overview of which roles have access to specific API endpoints and operations. The primary difference between roles is that only Managers can publish transactions and reports to the blockchain.

Access Levels

• ✅ Can Access - Role can access this endpoint
• ✖️ Cannot Access - Role cannot access this endpoint

Endpoint Access Matrix

Key Permissions by Role

Admin

• Full access to all endpoints
• Can create, update, delete configurations
• Can manage users and organisations
• Can publish transactions and reports to blockchain
• Can manage all reports and templates

Manager

• Can access and manage transactions and reports
• Can approve and publish transactions to blockchain
• Can create and publish reports to blockchain
• Can trigger extractions and reconciliations
• Cannot create or modify organisational configurations

Accountant

• Can access and manage transactions and reports
• Can approve transactions (but cannot publish them)
• Can create reports (but cannot publish them)
• Can trigger extractions and reconciliations
• Cannot create or modify organisational configurations
• Cannot publish transactions or reports to blockchain