eADM rule expression engine

eADM rule expression engine

Overview

The rule expression engine evaluates bracket functions and field placeholders in eADM. Expressions appear in:

How evaluation works

1. The engine scans the expression for [...] tokens.

2. [ARRAYFOREACH...] runs first — before the innermost-first pass — so template placeholders ??? and ???i bind per pipe-separated element.

3. Otherwise it resolves the innermost bracket pair first.

4. Each function returns a plain text result that replaces the bracket.

5. When no functions remain, remaining [FieldName] tokens are replaced from the current object (and optional history row in message flows).

6. Unrecognised field names stay as literal [FieldName] in the output.

Pipe-separated lists (|) are used for multi-value data — especially HR positions on a user.

Dummy data used in examples below

Unless stated otherwise, examples assume customer Eksempel kommune with:

Object type ids (for lookups): User=1, Department=2, Group=3, API user=14.

Syntax conventions

• Functions: [NAME;arg1;arg2;...] — arguments separated by semicolon (;).

• Fields: [FieldName] — value from current object (case-insensitive).

• Nested expressions: inner brackets resolved before outer.

• Dates in fields are often stored as dd.MM.yyyy HH:mm:ss; imports may use yyyy-MM-dd and other common formats.

Query mini-language

Used inside [FOREACH], [IFTHENELSE], and advanced [OBJECT...] filters.

Prefix related data with object., system., systemrole., objectpermission., etc.

Nesting

Inner field first, then outer function

Blocked if inner field missing: [SUBSTRING;0;10;[UnknownField]] stays unchanged when UnknownField is not on the object.

Typical permission chain (read inside-out):

[REFERENCE;DisplayName;UserId;1;[REFERENCE;Manager;Id;2;[OBJECTPERMISSION;ManagerOf;SystemRoleId;501]]]

1. Permission → department id 2100

2. Department → manager user id

3. User → manager display name

[ARRAYFOREACH...] is different: it expands a pipe-separated list before inner functions in the template run. Use ??? for the current element and ???i for its 0-based index. Nesting [ARRAYFOREACH...] inside another [ARRAYFOREACH...] is not supported — use [ARRAYJOIN] / [ARRAYPREFIX] or sibling calls instead.

Access levels

Automation (sync, messages, exports) evaluates expressions with server privileges. A function that works in production may still be blocked in the expression builder for your role.

Field placeholders

Not functions — replaced from the current object (or history row in event-driven message flows).

Example: Template Hello [GivenName] [Surname] on Kari Nordmann → Hello Kari Nordmann

History-only (message flows after sync): [OldValue], [NewValue], [EntryType], [AttributeName], [Comment].

Function reference with examples

Each entry lists parameters, a worked example with dummy data, and expected output.

Date and time

[NÅ] / [NOW]

Returns server date and time.

Use: Permission start display, relative deadlines in templates.

[DATEFORMAT;date;format]

Reformats a date string.

Use: Export formats, ISO dates in API payloads.

[DATEDIFF;date1;date2;unit]

Numeric difference between two dates.

Use: Tenure checks in rulesets, "days until start" in messages.

[DAYOFYEAR;date]

Use: Seasonal rules, fiscal period tricks.

String manipulation

[SUBSTRING;start;length;text]

Use: Date-only from datetime in welcome mails: [SUBSTRING;0;10;[Start]] → 01.04.2026.

[SPLIT;text;delimiter;index]

Use: Salutation from combined name field; pick last position code.

[REPLACE;text;find;replace]

Use: Normalise phone numbers, swap separators in usernames.

[REPLACELIST;text;fromChars;toChars]

Character-by-character map (both char lists must be same length).

Use: Legacy character set fixes in imports.

[RTRIM;text;chars] / [LTRIM;text;chars]

Use: Clean pipe lists after [ARRAYDIFF].

[RPAD;text;padChar;totalLength] / [LPAD;text;padChar;totalLength]

Use: Fixed-width employee numbers in file exports.

[RIGHT;length;text]

Use: Last digits of national id in test environments.

[INITIALS;text;startWord;endWord]

Use: Short codes in group names or mail aliases.

[PRETTIFY;text]

Title-cases after space or hyphen.

Use: Display names in messages when HR sends uppercase.

[LOWER;text] / [UPPER;text]

Use: Normalise before [CLEAN] in username rules.

[CLEAN;text] / [STRICTCLEAN;text] / [CNCLEAN;text]

Strip or replace characters unsafe for usernames, strict ids, or AD common names (CN).

Exact output depends on customer character rules; test in expression builder.

[GETKEYVALUE;key;delimiter;metadata]

Reads key<delimiter>value pairs inside a pipe-separated metadata string.

Use: Custom import metadata on extension attributes.

Logic and control flow

[IFTHENELSE;query;thenValue;elseValue]

Use: Single template for mixed object types.

[IFEMPTYUSE;primary;fallback;reversed]

Use: Default text for missing expiry, manager, or comment.

[EXISTS;value;resultIfNonEmpty]

Use: Gate nested lookups — only run [REFERENCE...] when [Manager] is set.

[TRANSFORM;input;mapping...]

Use: HR codes → display text in messages.

[CONTAINS;valueList;targetList;ifYes;ifNo]

Use: Ruleset-style branching inside a template.

Array (pipe-separated) operations

Lists look like A|B|C. Many HR position fields use this shape.

[COUNT;ignored;list]

Use: "How many positions does this user have?"

[ARRAYAPPEND;list1;list2]

Use: Merge role lists from two permission queries.

[ARRAYUNIQUE;list]

Use: Deduplicate department ids before export.

[ARRAYFILTER;list;allowed]

Keeps only items that appear in allowed.

Use: Whitelist position types for a message.

[ARRAYDIFF;current;previous]

Items in current not in previous.

Use: Detect new position in message flow (pair with [LASTVALUE;APositionCodeId]). Warning: unreliable if several positions change in one import.

[ARRAYJOIN;list1;list2]

Zips two lists by index.

Use: Combine parallel columns for CSV-style export lines.

[ARRAYFOREACH;array;template] / [ARRAYFOREACH;array;separator;template]

Iterates over a pipe-separated list. For each non-empty element, substitutes ??? with the element and ???i with its 0-based index in the template, evaluates nested [...] in the template, then joins results.

Empty pipe segments are skipped (same convention as [ARRAYUNIQUE] / [ARRAYPREFIX]).

Not supported: [ARRAYFOREACH...] nested inside another [ARRAYFOREACH...] — expression evaluation fails. Use two sibling calls or [ARRAYJOIN] instead.

Use: Format each position as its own line in a message; prefix each unit id for export.

[ARRAYPREFIX;list;mode;text]

Use: Namespace external ids.

[ARRAYTRIM;list;delimiter;maxCount]

Use: Only first N positions in a summary mail.

[PRUNEARRAY;list;regex;reverse]

Use: Drop temporary position codes from export.

[UNION;headers;list1;list2;...]

Merges parallel lists row-wise into spaced/pipe combined rows.

Use: Multi-column text blocks in reports.

Random, hash, uniqueness

[RND;min;max]

Use: Ticket numbers in test templates.

[STRRND;minLen;maxLen;chars]

Use: One-time codes when password rule is not used.

[PASSWORD;ruleId]

Use: Initial password in welcome message — handle securely.

[HASH;text]

Use: Opaque tokens in links (not for security-critical hashing alone).

[UNIQUE;base;fieldName;replacement]

Ensures base does not already exist in fieldName on another object; appends 2, 3, … or inserts before replacement.

Use: Customer setup username expression together with [CLEAN] / [LOWER].

Database lookup and relations

These read live eADM data for the customer. Ids must exist in your environment.

[REFERENCE;returnField;whereField;objectTypeId;searchValue;exactMatch]

Use: Department number from permission ManagerOf id:

[REFERENCE;OrgUnitnr;Id;2;2100]

[OBJECTPERMISSION;returnField;whereField;filterValue;exactMatch;aggregate]

Reads permissions on the current user.

Shorthand for role name:

[OBJECTHISTORIES;returnField;whereField;filterValue;exactMatch;aggregate]

Reads object history on current user (audit trail from sync/UI).

Use: "Who assigned this permission?" in message flows (often nested in [SPLIT] / [REFERENCE]).

[FOREACH;collection;query;returnFields;headers;format]

Example (conceptual): All users with role 501, CSV:

[FOREACH;objectpermission;SystemRoleId=501;object.DisplayName,object.Email;Name,Email;csv]

Output (dummy):

Name,Email
Kari Nordmann,kari.nordmann@eksempel.kommune.no
Ola Hansen,ola.hansen@eksempel.kommune.no

Use: Manager report embedded in email body.

[DESCENDANTS;rootId;returnField;parentKey;foreignKey]

Use: All sub-departments for scope on a manager permission.

[SYSTEM;type;id;field]

Use: System owner contact in admin notification.

[SELECTION;rulesetId;returnField]

Use: Mailing list of everyone matching "New starters" ruleset.

[AVAILABLESYSTEM;field] / [AVAILABLEROLE;systemId;field]

Returns pipe-separated values for systems or roles that pass their Available for ruleset on the current user.

Use: Dynamic pick lists in forms or messages.

[AVAILABLEDEPARTMENTS;fields;targetUserId]

Use: List departments a manager may administer (from ManagerOf, unit ids, mega.eadm.no roles).

[DATAOWNER;returnField]

Follows data-owner relation on object; returns field from owner.

[ANTECEDANTS.SYSTEMROLE;roleId;departmentId;returnField]

Managers holding roleId on ancestor departments of departmentId.

Use: Escalation mail when HR child dept has no local approver.

[COUNTEMPLOYEE] / [COUNTMEMBERS]

Evaluated on department or group object respectively.

[GETLASTSYNCID]

Use: Troubleshooting footers in admin mails.

[LASTVALUE;attributeName]

Previous value of field from last import HR history, else current field.

Pair with [ARRAYDIFF;[APositionCodeId];[LASTVALUE;APositionCodeId]] → POS-02\|.

Positions (multi-position HR)

Position fields share index across pipes: index 0 = first position, 1 = second.

[POSITION;returnField;whereField;matchValue]

[POSITIONS;returnField;whereField;matchValue]

Same as [POSITION] but returns aligned pipe string across all positions (empty slot where no match).

[GROUPPRIMARYPOSITION;returnField]

Picks primary position: highest APositionPercentage, tie-break by earliest APositionStartDate.

[ACTIVEPOSITIONCOUNT;asOfDate]

Messaging and integration

[COUNTMESSAGESENT;messageId;fromDate]

Use: "Already notified?" guard in follow-up flow.

[SYSTEMOWNER]

Requires history row from permission change (Add/Edit/Delete permission).

Use: CC system owner when automated permission is granted.

[SYNCSTEPPARAMETER;key;companySyncStepId]

Access: Company administrator in expression builder preview.

[APITOKEN;apiUsername]

Access: Company administrator in preview. Use only in secured server-side flows.

HTML helpers (message templates)

[HTMLLISTMEMBEROF;displayField]

On a group member user: lists parent groups.

[HTMLLISTARRAY;list]

Form template controls

Used in form templates, not standard rulesets.

Example pattern: [INPUTBOX;1042;Avdeling;IT-100;] renders input labelled "Avdeling" defaulting to IT-100.

Markers [NOTIFY...], [HIDDEN...], [SERVERFUNCTION...] are form behaviour hooks, not data functions.

End-to-end scenarios (dummy data)

Welcome mail — start date only

Ny ansatt [DisplayName] starter [SUBSTRING;0;10;[Start]].

Output: Ny ansatt Kari Nordmann starter 01.04.2026.

Permission expiry line

Gyldig til: [IFEMPTYUSE;[OBJECTPERMISSION;ExpiryDate;SystemRoleId;501];Permanent tilgang]

Output: Gyldig til: Permanent tilgang

Manager missing — escalate to parent dept manager

[IFEMPTYUSE;
 [EXISTS;[Manager];];
 [REFERENCE;Email;UserId;1;[REFERENCE;Manager;Id;2;[REFERENCE;ParentDepartmentNumber;DepartmentNumber;2;[DepartmentNumber]]]]]

Adjust IFEMPTYUSE/EXISTS pairing to match your template intent; test in expression builder.

New position only — message recipient

After sync adds POS-02:

[REFERENCE;Email;UserId;1;[POSITION;APositionManager;AUnitId;[RTRIM;[ARRAYDIFF;[APositionCodeId];[LASTVALUE;APositionCodeId]];|]]]

Output: Manager email for the new position's unit (dummy: ny-leder@eksempel.kommune.no).

Auto security group name (customer setup)

SG-[Department]-[CLEAN;[OrgUnitnr]]

Output: SG-IT og digitalisering-IT-100 (exact CLEAN output may vary).

Export mapping — samAccountName

[UserName]

Output: kari.nordmann

Ruleset — user has role on system

Rule attribute expression:

[OBJECTPERMISSION.SYSTEMROLE;Name;SystemRoleId;501]

Resolved value: Bruker Fagsystem X — compare with operator Er lik / membership operators.

Expression builder

Troubleshooting

Quick index

AI assistant notes

1. Prefer [DisplayName]-style fields before wrapping in functions.

2. Ask where the expression lives: ruleset vs message vs export vs customer setup.

3. Replace dummy ids (501, 2100) with the customer's real system role and department ids from system access.

4. Position filter on import excludes matches; sync step ruleset includes matches.

5. Event message flows need object history from a sync run.

6. Build nested examples inside-out — except [ARRAYFOREACH...], which binds ??? per element before template functions run.

7. Do not nest [ARRAYFOREACH...]; use sibling calls or [ARRAYJOIN].

8. Terms: ruleset (Regelsett), message flow (meldingsflyt), system access (systemtilgang), permission (tilgang), object history (objekthistorikk).

Last updated: June 19, 2026