eADM rule expression engine

Overview

The rule expression engine evaluates bracket functions and field placeholders in eADM. Expressions appear in:

How evaluation works

1. The engine scans the expression for [...] tokens.

2. [ARRAYFOREACH...] runs first — before the innermost-first pass — so template placeholders ??? and ???i bind per pipe-separated element.

3. Otherwise it resolves the innermost bracket pair first.

4. Each function returns a plain text result that replaces the bracket.

5. When no functions remain, remaining [FieldName] tokens are replaced from the current object (and optional history row in message flows).

6. Unrecognised field names stay as literal [FieldName] in the output.

Pipe-separated lists (|) are used for multi-value data — especially HR positions on a user.

Dummy data used in examples below

Unless stated otherwise, examples assume customer Eksempel kommune with:

Object type ids (for lookups): User=1, Department=2, Group=3, API user=14.

Syntax conventions

• Functions: [NAME;arg1;arg2;...] — arguments separated by semicolon (;).

• Fields: [FieldName] — value from current object (case-insensitive).

• Nested expressions: inner brackets resolved before outer.

• List separator: pipe character | (vertical bar) between values — e.g. POS-01|POS-02. Never type a backslash; | appears only as markdown escaping in source files, not in expressions.

• Dates in fields are often stored as dd.MM.yyyy HH:mm:ss; imports may use yyyy-MM-dd and other common formats.

Query mini-language

Used inside [FOREACH], [IFTHENELSE], and advanced [OBJECT...] filters.

Prefix related data with object., system., systemrole., objectpermission., etc.

Nesting

Inner field first, then outer function

Blocked if inner field missing: [SUBSTRING;0;10;[UnknownField]] stays unchanged when UnknownField is not on the object.

Typical permission chain (read inside-out):

[REFERENCE;DisplayName;UserId;1;[REFERENCE;Manager;Id;2;[OBJECTPERMISSION;ManagerOf;SystemRoleId;501]]]

1. Permission → department id 2100

2. Department → manager user id

3. User → manager display name

[ARRAYFOREACH...] is different: it expands a pipe-separated list before inner functions in the template run. Use ??? for the current element and ???i for its 0-based index. Nesting [ARRAYFOREACH...] inside another [ARRAYFOREACH...] is not supported — use [ARRAYJOIN] / [ARRAYPREFIX] or sibling calls instead.

Access levels

Automation (sync, messages, exports) evaluates expressions with server privileges. A function that works in production may still be blocked in the expression builder for your role.

Field placeholders

Not functions — replaced from the current object (or history row in event-driven message flows).

Example: Template Hello [GivenName] [Surname] on Kari Nordmann → Hello Kari Nordmann

History-only (message flows after sync): [OldValue], [NewValue], [EntryType], [AttributeName], [Comment].

Function reference with examples

Each entry lists parameters, a worked example with dummy data, and expected output.

Date and time

[NÅ] / [NOW]

Returns server date and time.

Use: Permission start display, relative deadlines in templates.

[DATEFORMAT;date;format]

Reformats a date string.

Use: Export formats, ISO dates in API payloads.

[DATEDIFF;date1;date2;unit]

Numeric difference between two dates.

Use: Tenure checks in rulesets, "days until start" in messages.

[DAYOFYEAR;date]

Use: Seasonal rules, fiscal period tricks.

String manipulation

[SUBSTRING;start;length;text]

Use: Date-only from datetime in welcome mails: [SUBSTRING;0;10;[Start]] → 01.04.2026.

[SPLIT;text;delimiter;index]

Use: Salutation from combined name field; pick last position code.

[REPLACE;text;find;replace]

Use: Normalise phone numbers, swap separators in usernames.

[REPLACELIST;text;fromChars;toChars]

Character-by-character map (both char lists must be same length).

Use: Legacy character set fixes in imports.

[RTRIM;text;chars] / [LTRIM;text;chars]

Use: Clean pipe lists after [ARRAYDIFF].

[RPAD;text;padChar;totalLength] / [LPAD;text;padChar;totalLength]

Use: Fixed-width employee numbers in file exports.

[RIGHT;length;text]

Use: Last digits of national id in test environments.

[INITIALS;text;startWord;endWord]

Use: Short codes in group names or mail aliases.

[PRETTIFY;text]

Title-cases after space or hyphen.

Use: Display names in messages when HR sends uppercase.

[LOWER;text] / [UPPER;text]

Use: Normalise before [CLEAN] in username rules.

[CLEAN;text] / [STRICTCLEAN;text] / [CNCLEAN;text]

Strip or replace characters unsafe for usernames, strict ids, or AD common names (CN).

Exact output depends on customer character rules; test in expression builder.

[GETKEYVALUE;key;delimiter;metadata]

Reads key<delimiter>value pairs inside a pipe-separated metadata string.

Use: Custom import metadata on extension attributes.

Logic and control flow

[IFTHENELSE;query;thenValue;elseValue]

Use: Single template for mixed object types.

[IFEMPTYUSE;primary;fallback;reversed]

Use: Default text for missing expiry, manager, or comment.

[EXISTS;value;resultIfNonEmpty]

Use: Gate nested lookups — only run [REFERENCE...] when [Manager] is set.

[TRANSFORM;input;mapping...]

Use: HR codes → display text in messages.

[CONTAINS;valueList;targetList;ifYes;ifNo]

Use: Ruleset-style branching inside a template.

Array (pipe-separated) operations

Lists look like A|B|C. Many HR position fields use this shape.

[COUNT;ignored;list]

Use: "How many positions does this user have?"

[ARRAYAPPEND;list1;list2]

Use: Merge role lists from two permission queries.

[ARRAYUNIQUE;list]

Use: Deduplicate department ids before export.

[ARRAYFILTER;list;allowed]

Keeps only items that appear in allowed.

Use: Whitelist position types for a message.

[ARRAYDIFF;current;previous]

Items in current not in previous.

Use: Detect new position in message flow (pair with [LASTVALUE;APositionCodeId]). Warning: unreliable if several positions change in one import.

[ARRAYJOIN;list1;list2]

Zips two lists by index.

Use: Combine parallel columns for CSV-style export lines.

[ARRAYFOREACH;array;template] / [ARRAYFOREACH;array;separator;template]

Iterates over a pipe-separated list. For each non-empty element, substitutes ??? with the element and ???i with its 0-based index in the template, evaluates nested [...] in the template, then joins results.

Empty pipe segments are skipped (same convention as [ARRAYUNIQUE] / [ARRAYPREFIX]).

Not supported: [ARRAYFOREACH...] nested inside another [ARRAYFOREACH...] — expression evaluation fails. Use two sibling calls or [ARRAYJOIN] instead.

Use: Format each position as its own line in a message; prefix each unit id for export.

[ARRAYPREFIX;list;mode;text]

Use: Namespace external ids.

[ARRAYTRIM;list;delimiter;maxCount]

Use: Only first N positions in a summary mail.

[PRUNEARRAY;list;regex;reverse]

Use: Drop temporary position codes from export.

[UNION;headers;list1;list2;...]

Merges parallel lists row-wise into spaced/pipe combined rows.

Use: Multi-column text blocks in reports.

Random, hash, uniqueness

[RND;min;max]

Use: Ticket numbers in test templates.

[STRRND;minLen;maxLen;chars]

Use: One-time codes when password rule is not used.

[PASSWORD;ruleId]

Use: Initial password in welcome message — handle securely.

[HASH;text]

Use: Opaque tokens in links (not for security-critical hashing alone).

[UNIQUE;base;fieldName;replacement]

Ensures base does not already exist in fieldName on another object; appends 2, 3, … or inserts before replacement.

Use: Customer setup username expression together with [CLEAN] / [LOWER].

Database lookup and relations

These read live eADM data for the customer. Ids must exist in your environment.

[REFERENCE;returnField;whereField;objectTypeId;searchValue;exactMatch]

Use: Department number from permission ManagerOf id:

[REFERENCE;OrgUnitnr;Id;2;2100]

[OBJECTPERMISSION;returnField;whereField;filterValue;exactMatch;aggregate]

Reads permissions on the current user.

Shorthand for role name:

[OBJECTHISTORIES;returnField;whereField;filterValue;exactMatch;aggregate]

Reads object history on current user (audit trail from sync/UI).

Use: "Who assigned this permission?" in message flows (often nested in [SPLIT] / [REFERENCE]).

[FOREACH;collection;query;returnFields;headers;format]

Example (conceptual): All users with role 501, CSV:

[FOREACH;objectpermission;SystemRoleId=501;object.DisplayName,object.Email;Name,Email;csv]

Output (dummy):

Name,Email
Kari Nordmann,kari.nordmann@eksempel.kommune.no
Ola Hansen,ola.hansen@eksempel.kommune.no

Use: Manager report embedded in email body.

[DESCENDANTS;rootId;returnField;parentKey;foreignKey]

Use: All sub-departments for scope on a manager permission.

[SYSTEM;type;id;field]

Use: System owner contact in admin notification.

[SELECTION;rulesetId;returnField]

Use: Mailing list of everyone matching "New starters" ruleset.

[AVAILABLESYSTEM;field] / [AVAILABLEROLE;systemId;field]

Returns pipe-separated values for systems or roles that pass their Available for ruleset on the current user.

Use: Dynamic pick lists in forms or messages.

[AVAILABLEDEPARTMENTS;fields;targetUserId]

Use: List departments a manager may administer (from ManagerOf, unit ids, mega.eadm.no roles).

[DATAOWNER;returnField]

Follows data-owner relation on object; returns field from owner.

[ANTECEDANTS.SYSTEMROLE;roleId;departmentId;returnField]

Managers holding roleId on ancestor departments of departmentId.

Use: Escalation mail when HR child dept has no local approver.

[COUNTEMPLOYEE] / [COUNTMEMBERS]

Evaluated on department or group object respectively.

[GETLASTSYNCID]

Use: Troubleshooting footers in admin mails.

[LASTVALUE;attributeName]

Previous value of field from last import HR history, else current field.

Pair with [ARRAYDIFF;[APositionCodeId];[LASTVALUE;APositionCodeId]] → POS-02|.

Positions (multi-position HR)

Position fields share index across pipes: index 0 = first position, 1 = second.

[POSITION;returnField;whereField;matchValue]

[POSITIONS;returnField;whereField;matchValue]

Same as [POSITION] but returns aligned pipe string across all positions (empty slot where no match).

[GROUPPRIMARYPOSITION;returnField]

Picks primary position: highest APositionPercentage, tie-break by earliest APositionStartDate.

[ACTIVEPOSITIONCOUNT;asOfDate]

Messaging and integration

[COUNTMESSAGESENT;messageId;fromDate]

Omitted messageId: If the message template id is not given ([COUNTMESSAGESENT;] is equal to 0), the expression evaluates in the context of the message template whose sending triggered the rule set. In other words it resolves to "has the message currently being sent already gone out to this recipient", not to any single fixed template id. Because of this, the same rule set can be reused as the duplicate-send guard for several different message templates, instead of building a separate rule set per template.

Use: "Already notified?" guard in follow-up flow; shared duplicate-send guard across multiple message templates.

[SYSTEMOWNER]

Requires history row from permission change (Add/Edit/Delete permission).

Use: CC system owner when automated permission is granted.

[SYNCSTEPPARAMETER;key;companySyncStepId]

Access: Company administrator in expression builder preview.

[APITOKEN;apiUsername]

Access: Company administrator in preview. Use only in secured server-side flows.

HTML helpers (message templates)

[HTMLLISTMEMBEROF;displayField]

On a group member user: lists parent groups.

[HTMLLISTARRAY;list]

Form template controls

Used in form templates, not standard rulesets.

Example pattern: [INPUTBOX;1042;Avdeling;IT-100;] renders input labelled "Avdeling" defaulting to IT-100.

Markers [NOTIFY...], [HIDDEN...], [SERVERFUNCTION...] are form behaviour hooks, not data functions.

End-to-end scenarios (dummy data)

Welcome mail — start date only

Ny ansatt [DisplayName] starter [SUBSTRING;0;10;[Start]].

Output: Ny ansatt Kari Nordmann starter 01.04.2026.

Permission expiry line

Gyldig til: [IFEMPTYUSE;[OBJECTPERMISSION;ExpiryDate;SystemRoleId;501];Permanent tilgang]

Output: Gyldig til: Permanent tilgang

Manager missing — escalate to parent dept manager

[IFEMPTYUSE;
 [EXISTS;[Manager];];
 [REFERENCE;Email;UserId;1;[REFERENCE;Manager;Id;2;[REFERENCE;ParentDepartmentNumber;DepartmentNumber;2;[DepartmentNumber]]]]]

Adjust IFEMPTYUSE/EXISTS pairing to match your template intent; test in expression builder.

New position only — message recipient

After sync adds POS-02:

[REFERENCE;Email;UserId;1;[POSITION;APositionManager;AUnitId;[RTRIM;[ARRAYDIFF;[APositionCodeId];[LASTVALUE;APositionCodeId]];|]]]

Output: Manager email for the new position's unit (dummy: ny-leder@eksempel.kommune.no).

Auto security group name (customer setup)

SG-[Department]-[CLEAN;[OrgUnitnr]]

Output: SG-IT og digitalisering-IT-100 (exact CLEAN output may vary).

Export mapping — samAccountName

[UserName]

Output: kari.nordmann

Ruleset — user has role on system

Rule attribute expression:

[OBJECTPERMISSION.SYSTEMROLE;Name;SystemRoleId;501]

Resolved value: Bruker Fagsystem X — compare with operator Er lik / membership operators.

Expression builder

Two entry modes for a rule condition value

Each condition row in a ruleset's Rules tab has an Attribute (or Argument) field with two small icons that toggle its entry mode:

• Dropdown mode (up/down arrows icon) — the default. Presents a searchable dropdown of the object's attribute values, grouped by type (user, group, department, or form attributes, depending on what the ruleset is used with).

• Free-text mode (keyboard icon) — switches the field to a plain text box. Use this to type hardcoded text, or a function expression using the bracket syntax described earlier in this article, e.g. [COUNTMESSAGESENT;7166].

Free-text mode still offers autocomplete: typing a partial function or field name (e.g. [count) surfaces matching attributes and functions, such as [COUNTEMPLOYEE], [COUNTMEMBERS], and [COUNTMESSAGESENT;message id].

Testing an expression with Edit expression

When a condition field is in free-text mode, an additional icon next to it opens the Edit expression dialog. Use it to test a function expression against a real object before saving the rule.

The dialog shows:

• Object type — the ruleset's primary object type (e.g. User) and which secondary contexts are available (Function, Function alias, Event, History).

• Context — a test object to evaluate against. Use Search to pick a specific object, or Choose randomly to let eADM select one.

• Expression — an editable text area, pre-filled with the condition's current expression.

• Result — the evaluated output, shown after clicking Execute.

While editing, hovering over a function inside the expression shows a help tooltip with that function's full syntax, a short description, and the meaning of each parameter. The tooltip highlights the whole expression in green and shows the part corresponding to the current cursor position in bold, which makes it considerably easier to navigate long or deeply nested expressions.

Troubleshooting

Quick index

AI assistant notes

1. Prefer [DisplayName]-style fields before wrapping in functions.

2. Ask where the expression lives: ruleset vs message vs export vs customer setup.

3. Replace dummy ids (501, 2100) with the customer's real system role and department ids from system access.

4. Position filter on import excludes matches; sync step ruleset includes matches.

5. Event message flows need object history from a sync run.

6. Build nested examples inside-out — except [ARRAYFOREACH...], which binds ??? per element before template functions run.

7. Do not nest [ARRAYFOREACH...]; use sibling calls or [ARRAYJOIN].

8. [COUNTMESSAGESENT;] with the messageId omitted evaluates against the message template currently sending, so one rule set can gate several message templates — but its preview will not work outside a real send.

9. Two ways to set a rule condition's value: dropdown (attribute picker) or free text (keyboard icon, hardcoded text or expressions), with Edit expression available in free-text mode to test against a sample object.

10. Terms: ruleset (Regelsett), message flow (meldingsflyt), system access (systemtilgang), permission (tilgang), object history (objekthistorikk).

Last updated: July 29, 2026