Is there a way to limit returned variables on a process level when instance created via API?

Camunda 8 Topics
1

Hello,

Usually BPMN models are long running, but it is possible to design some lightweight integration to expect that it may work in synchronous mode. For that it’s enough to set “awaitCompletion”: true when do a REST call to create new process instance. Then, if process is not reaching timeout limit, it will return process variables created during execution. The thing is that it returns all variables. It is possible to limit list of variables by specifying them in fetchVariables in request, but this is not a guarantee that sensitive process data will not be returned to the client which should not have this data.

As an example attached: there is a call to external system generating fake test person data. There are also login an password fields and its needed that only person_data_id to be returned in the response. But it returns everything plus person_data_id. Tried to do it with a sub-process as they should have different variable scope, but result is the same, it just creates new output variables. Is there a way to explicitly limit return variables or override fetchVariables in the process?

ReduceVariables.bpmn (11.8 KB)

Oleg L.

2

Hello,

If I understand correctly, the variables you retrieve at the end of the instance execution are variables fetched from external services via connectors, and their return is directly saved into the instance variables.

Among the best practices in BPM projects generally, instance variables should only include data useful for routing/execution within an instance. Therefore, I suggest you filter the response retrieved by your connectors using FEEL (see example) to inject only the necessary data for execution, such as person_data_id.

Let me know if this helps!

1 Like
3

Hi Tarek!

Yes, you are absolutely right about scenario. But even data used for execution routing may be sensitive, and limiting returned variables would be a valid feature. And it appears to be that there is no such mechanism in Camunda at the moment.

Oleg L.