I have a map service with Features Access capabilities enabled on ArcGIS Server 10.3. This map service is protected using ArcGIS Server tokens.

I would like to have two categories of users with different permissions:

  • Users Category 1: Users that can create/delete/edit/query data using Features Access REST API. For this I use the Editor Tracking

  • Users Category 2: Users that can only query specific data

For Instance:

  • User_A_Editor (Category 1)
  • User_A_Viewer (Category 2)

User_A_Viewer would be able to only query data created by User_A_Editor. User_A_Viewer won't be able to create any data.

I know there is a possibility with Features Access coupled with Editor Tracking to restrict editing/deleting/query to features created by the user, but it seems I can't prevent a user of the Category 2 to create new feature or to query data created by any other users of the Category 1.

I was thinking to create a Geoprocessing Service that will be used as a kind of proxy for any REST queries made to this map service. So in the client application, all queries would be made to the GP service instead. This GP will verify if the user is allowed to do such REST query, and if yes, the GP will call the REST API and return the result to the client. But in reality, that won't prevent a wise user to use the REST API in a way not wanted as it will always be accessible.

Is there any solution?

  • Publish a map service with the Feature Access for the User_A_Editor and a map service with layer definition for the User_A_Viewer.
    – lele3p
    Commented Jul 13, 2016 at 14:18
  • Good idea, but it means to publish a map service with layer definition for every category 2 users. In fact, there would be many users of both categories. Commented Jul 13, 2016 at 14:21

1 Answer 1


You could try to use Server Object Interceptors, SOIs. They allow arcgis server to manipulate requests as they are received from a client. From the help:

Operation-level access control for map services—ArcGIS Server only supports enabling service operations for all users of the service or disabling access completely. A series of SOIs can filter incoming requests based on the user's role in order to implement operation-level access to the service.

I have used them to manipulate edits at the database level before they are processed by arcgis server and they work well, with a few limitations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.