I have a property with encrypted attribute but cannot get the value from my custom UI, access is allowed to the service I'm trying to get it from:

"access": {
  "owner": true,
  "admin": true,
  "referrer": true


Since POA 5.5.2 it is not possible to get value of an encrypted property from custom UI: secure information should not be sent in plain text since it can be easily extracted using a debugger.

Encrypted properties are signified by:


tag in PHP runtime code. Some built-in types (like service users) have encrypted properties as well (passwords).


Application back-end can still get values of all properties when authenticating with application certificate. Using a certificate is crucial to get these properties decrypted. In essence, it is not a problem of owner, admin or referrer access, but a problem of type of authorization.


Your application's resources are provided to POA service users (your resource has a relation to service user in other words) and you need to know the password of a service user. If your application uses the PHP runtime library:

// imagine your resource has a link to service user called 'user'
     * @link("")
     * @required
    public $user;

// from backend, we can fetch encrypted properties of the user object, including password
public function provision() {
    $apsc = \APS\Request::getController();
    $user = $apsc->getResource($this->user->aps->id); // here the $user variable contains full representation of user object, including encrypted fields like passwords
    $password = $user->password // now I can access the user's password
    $password = $this->user->password // or without fetching with getResource

Note: For testing purposes, you can query APS bus with application instance token (pem.APS.getApplicationInstanceToken OA API method) and it will be effectively the same as authorizing via certificate. You will be able to see encrypted properties in this case.

Internal content