Determine if the Current User Has Specific Permissions

Feb 21, 2026
3 minutes to read

Determine if a User Is an Administrator

Get the current user object as described in the following topic: Get the Current User in Code.
Check if this user has an administrative role in the Roles collection.

csharp

using Microsoft.AspNetCore.Mvc;
using DevExpress.ExpressApp.Security;
using DevExpress.Persistent.BaseImpl.EF.PermissionPolicy;
// ...
[Route("api/[controller]")]
[ApiController]
public class CustomEndpointController : ControllerBase {
    [HttpGet]
    public IEnumerable<string> Get(ISecurityProvider securityProvider) {
        ISecurityUserWithRoles user = (ISecurityUserWithRoles)securityProvider.GetSecurity().User;
        bool isAdministativeRole = user.Roles.Any(r => ((PermissionPolicyRole)r).IsAdministrative);
        // ...
    }

}

Determine if a User Has a Particular Role

Use the IsUserInRole Extension Method

Get the current user object as described in the following topic: Get the Current User in Code.
Call the DevExpress.ExpressApp.Security.UserWithRolesExtensions.IsUserInRole(DevExpress.Persistent.Base.Security.IUserWithRoles,System.String) method with the "Manager" parameter to check if the user has a role with this name.

csharp

using Microsoft.AspNetCore.Mvc;
using DevExpress.ExpressApp.Security;
using DevExpress.Persistent.BaseImpl.EF.PermissionPolicy;
// ...
[Route("api/[controller]")]
[ApiController]
public class CustomEndpointController : ControllerBase {
    [HttpGet]
    public IEnumerable<string> Get(ISecurityProvider securityProvider) {
        ISecurityUserWithRoles user = (ISecurityUserWithRoles)securityProvider.GetSecurity().User;
        bool isManager = user.IsUserInRole("Manager");
        // ...
    }
}

Use the Current User’s Roles Collection

Alternatively, you can inspect a user’s Roles collection to determine if the user belongs to a certain role:

csharp

using Microsoft.AspNetCore.Mvc;
using DevExpress.ExpressApp.Security;
using DevExpress.Persistent.BaseImpl.EF.PermissionPolicy;
// ...
[Route("api/[controller]")]
[ApiController]
public class CustomEndpointController : ControllerBase {
    [HttpGet]
    public IEnumerable<string> Get(ISecurityProvider securityProvider) {
        ISecurityUserWithRoles user = (ISecurityUserWithRoles)securityProvider.GetSecurity().User;
        bool isManager = user.Roles.Any(r => r.Name == "Managers");
        // ...
    }
}

Use Criteria Syntax (in Filters)

Use one of the following techniques to check for a user role in criteria syntax:

You can use the IsCurrentUserInRole criteria function in your filters. For example: IsCurrentUserInRole('Administrators').
You can use Free Joins on the current user’s Roles collection. For example: [<PermissionPolicyRole>][Name='Managers' && Users[Oid=CurrentUserId()]]

Check if a User Has Permission to Perform a Specific Operation

Permission to Edit the Application Model

Get the current user object as the following topic describes: Get the Current User in Code.
Use the CanEditModel property to check if the user has permission to edit the Application Model.

csharp

using Microsoft.AspNetCore.Mvc;
using DevExpress.ExpressApp.Security;
using DevExpress.Persistent.BaseImpl.EF.PermissionPolicy;
// ...
[Route("api/[controller]")]
[ApiController]
public class CustomEndpointController : ControllerBase {
    [HttpGet]
    public IEnumerable<string> Get(ISecurityProvider securityProvider) {
        ISecurityUserWithRoles user = (ISecurityUserWithRoles)securityProvider.GetSecurity().User;
        if (user.Roles.Any(r => r.CanEditModel)) {
            // ...
        }
        // ...
    }
}

Permission to Edit an Object of a Specific Type

Get the current user object as described in the following topic: Get the Current User in Code.
Use the IsGrantedExtensions.CanWrite method to check if the user has permission to edit the Department‘s Office property.

Note

You can also use other IsGrantedExtensions methods to check permissions for CRUD and navigate operations. You can check permissions for the current user, a specific user, or a particular role.

csharp

using Microsoft.AspNetCore.Mvc;
using DevExpress.ExpressApp.Security;
using DevExpress.Persistent.BaseImpl.EF.PermissionPolicy;
// ...
[Route("api/[controller]")]
[ApiController]
public class CustomEndpointController : ControllerBase {
    [HttpGet]
    public IEnumerable<string> Get(ISecurityProvider securityProvider) {
        ISecurityUserWithRoles user = (ISecurityUserWithRoles)securityProvider.GetSecurity().User;
        if (!securityStrategy.CanWrite<Department>(ObjectSpace, nameof(Department.Office))) {
            // ...
        }
        // ...
    }
}