We have an Angular frontend that talks to Pega entirely through DX API.
Case summary is loaded via the standard case view GET API.
New requirement: different user roles must see different parts of the same case summary —
Role 1 sees the full summary
Role 2 sees only a subset of tabs
Role 3 sees some tabs, but specific field values must be masked
Roles aren’t static, they’re both case-level and requestor-level, so the same user can have a different role on Case A vs. Case B.
To resolve the role, we need a call an external Security API that takes the case ID + request context and returns the applicable role for that case/client combination.
Case view is a GET, so we can’t pass this context into it directly.
Questions for the group:
- Is there a supported DX API pattern for enriching case view GET response with computed, non-case-model data (like a resolved role) so we avoid a second round trip?
- Is field-level masking meant to happen server-side (via access control / field-level auth on Pega) or is it acceptable to mask client-side in Angular after the full value is already in the payload?
- Any precedent for a lightweight custom REST service purpose-built for role resolution that runs parallel to case view GET, keyed on case ID + client ID?