# Process Engine REST API - runtime/process-instances
**URL:** https://forum.flowable.org/t/process-engine-rest-api-runtime-process-instances/6541
**Category:** Flowable Engine
**Created:** [August 16, 2020, 5:46am UTC](https://forum.flowable.org/t/process-engine-rest-api-runtime-process-instances/6541 "2020-08-16T05:46:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Robinyo](https://forum.flowable.org/u/Robinyo)
#### Post date: [August 16, 2020, 5:46am UTC](https://forum.flowable.org/t/process-engine-rest-api-runtime-process-instances/6541/1 "2020-08-16T05:46:45Z")
In my application I am using the Process Engine REST API to [start a process instance](https://flowable.com/open-source/docs/bpmn/ch15-REST/#start-a-process-instance):
I would like the process instances my application starts to be functional (e.g., show details, show form, show diagram, cancel process) in Flowable Task.
I can get the process instances to be visible in Flowable Task by setting the `initiator` variable:
```auto
const processModel = {
'name' : this.selectedItem.name,
'processDefinitionId' : this.selectedItem.id,
'variables': [
{
'name': 'initiator',
'type' : 'string',
'value': 'flowable',
'scope' : 'local'
}
]
};
```
Where ‘flowable’ is the Flowable Admin User’s user id.
[application.properties](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/server/flowable/wars/application.properties):
```auto
# Default Flowable Admin Accounts - see: flowable.ldif
flowable.idm.app.admin.user-id=flowable
flowable.idm.app.admin.password=test
flowable.idm.app.admin.first-name=
flowable.idm.app.admin.last-name=Administrator
flowable.idm.app.admin.email=admin@serendipity.org.au
flowable.common.app.idm-admin.user=flowable
flowable.common.app.idm-admin.password=test
```
[flowable.ldif](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/server/services/openldap/ldif/flowable.ldif):
```auto
# Flowable (UI Applications) Admin User
dn: sn=Admin, ou=users,dc=flowable,dc=org
changetype: add
objectclass: inetOrgPerson
cn: Flowable
sn: Admin
mail: admin@serendipity.org.au
uid: flowable
userPassword: test
```
However, the ‘Cancel process’ button isn’t visible?
It seems that Flowable Task is also setting the **startedBy** variable:
```auto
startedBy: {id: "flowable", firstName: "Flowable", lastName: "Admin", email: "admin@serendipity.org.au",…}
```
Is this supported by the Process Engine REST API?
---
### Author:  [@joram](https://forum.flowable.org/u/joram)
#### Post date: [August 21, 2020, 4:04am UTC](https://forum.flowable.org/t/process-engine-rest-api-runtime-process-instances/6541/2 "2020-08-21T04:04:53Z")
The startedBy is set by the following code:
>
So, it takes the authenticated user from that moment. Are you doing the REST call with a user, as that user should be used?
---
### Author:  [@Robinyo](https://forum.flowable.org/u/Robinyo)
#### Post date: [August 21, 2020, 5:48am UTC](https://forum.flowable.org/t/process-engine-rest-api-runtime-process-instances/6541/3 "2020-08-21T05:48:53Z")
> [@joram](#):
>
> So, it takes the authenticated user from that moment. Are you doing the REST call with a user, as that user should be used?
The [server component](https://github.com/Robinyo/serendipity-api) of my [application](https://github.com/Robinyo/serendipity) leverages Spring Security’s support for OAuth 2.0 and Jason Web Tokens (JWTs) and embeds Flowable’s BPMN engine and exposes the BPMN engine’s RESTful API (by utilising the Flowable Spring Boot Starters). As per this [post](https://robferguson.org/blog/2020/02/05/flowable-oauth2-resource-server/).
All requests must be authenticated as per the [DefaultSecurityConfig](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/server/src/main/java/org/serendipity/restapi/config/DefaultSecurityConfig.java) (extends WebSecurityConfigurerAdapter):
```auto
@EnableWebSecurity
@Profile({"dev", "test", "prod"})
@Slf4j
public class DefaultSecurityConfig extends WebSecurityConfigurerAdapter {
@Value("${spring.security.oauth2.resourceserver.jwt.jwk-set-uri}")
private String jwkSetUri;
@Override
protected void configure(HttpSecurity http) throws Exception {
log.info("DefaultSecurityConfig: configure()");
http.cors().and()
.authorizeRequests()
.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
.antMatchers("/h2-console/**").permitAll()
.antMatchers("/docs/**").permitAll()
.anyRequest().authenticated();
http.csrf().ignoringAntMatchers("/h2-console/**");
http.headers().frameOptions().sameOrigin();
http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
}
@Bean
JwtDecoder jwtDecoder() {
return NimbusJwtDecoder.withJwkSetUri(this.jwkSetUri).build();
}
@Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.applyPermitDefaultValues();
configuration.setAllowedOrigins(Collections.singletonList("*"));
configuration.setAllowedMethods(Arrays.asList("POST", "GET", "PATCH", "PUT", "DELETE"));
configuration.setAllowCredentials(true);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
}
```
The Bearer token is included in all requests from the client component of my [application](https://github.com/Robinyo/serendipity):
```auto
...
@Injectable()
export class AuthInterceptor implements HttpInterceptor {
constructor(private authService: AuthService,
private logger: LoggerService) {
}
intercept(req: HttpRequest, next: HttpHandler) {
const accessToken = this.authService.getAccessToken();
if (accessToken) {
const authReq = req.clone({ setHeaders: { Authorization: 'Bearer ' + accessToken } });
return next.handle(authReq);
}
return next.handle(req);
}
}
```
For example, [IndividualController.java](https://github.com/Robinyo/serendipity-api/blob/master/projects/spring-boot/server/src/main/java/org/serendipity/restapi/controller/IndividualController.java):
```auto
...
@GetMapping("/individuals")
@PreAuthorize("hasAuthority('SCOPE_individual:read')")
public ResponseEntity> findAll(
Pageable pageable) throws ResponseStatusException {
log.info("IndividualController GET /individuals");
try {
Page entities = repository.findAll(pageable);
PagedModel models = pagedResourcesAssembler.toModel(entities, assembler);
return ResponseEntity.ok(models);
} catch (Exception e) {
log.error("{}", e.getLocalizedMessage());
throw new ResponseStatusException(HttpStatus.BAD_REQUEST);
}
}
```