BMXAA9301E on Maximo MAS 9: "not authorized for Object Structure"
Updated on · VAGANET EAM
In short. On MAS 9 the system property mxe.int.enableosauth defaults to
1: an object structure without an authorization name is denied, and a
secured object structure must be granted to the user through a security group. Fix it by
securing the object structure (or using its MXAPI equivalent), then grant it to the loading user's
group.
A load that worked on Maximo 7.6 fails on MAS 9 with Bad Request and the
message BMXAA9301E - The user of the transaction is not authorized for Object Structure
MXASSET. The same file works with MXAPIASSET. The error hits MxLoader, REST scripts
and loading tools alike: it comes from object structure security, not from the tool.
The cause: mxe.int.enableosauth set to 1 on MAS 9
Maximo controls access to object structures with the mxe.int.enableosauth system
property:
| Value | Behavior |
|---|---|
0 (default before MAS 9) | Any authenticated user can call an object structure that has no authorization name |
1 (default on MAS 9) | An object structure without an authorization name is blocked; a secured one requires an explicit grant through a security group |
The MXAPI* object structures shipped by IBM are already secured and granted to standard
groups: they work. The classic ones (MXASSET, MXITEM…), custom object
structures and those created by MxLoader (MXL_*) often have no authorization name: they are
denied, even for MAXADMIN.
Diagnose in two minutes
- In the Object Structures application, open the object structure named in the error and check its security (the configure object structure security action).
- In Security Groups, object structures tab, check that it appears. If it does not, it is not secured.
- Make the same call with the
MXAPIequivalent (for exampleMXAPIASSET): if it works, the cause is confirmed.
Fix it cleanly
Option 1: use the MXAPI object structure
When it covers your columns, the MXAPI object structure is the simplest path: it is
secured and maintained by IBM. Do not change its settings: applications and Maximo Mobile rely on
it.
Option 2: secure your object structure
- In Object Structures, configure the object structure's security: either give it as
authorization name an application the user already has (for example
ASSETforMXASSET, its rights then follow the application's), or use the object structure as its own authorization name (exact label depends on the version). - In Security Groups, grant the object structure and the required actions (read, insert, save, delete) to the loading user's group.
- Sign the user out and back in, or wait for the security cache to refresh, before retrying.
For MxLoader: after creating the MXL_* object structures, apply the same
steps to each of them, otherwise the data dictionary refresh fails with the same error on
MXL_MAXATTRIBUTECFG.
Avoid
- Duplicating an object structure without checking its authorization name: the copy inherits the original's, which may not fit.
- Loading as MAXADMIN to work around it: the error persists, and a dedicated technical user with limited rights is better for audit.
Anticipate before a load
These rights are set environment by environment: an object structure granted in DEV may be missing in
UAT or PROD. List the object structures your load uses (writing, plus reading for tracking) and check
them on every target before cutover. MAS9 reports missing rights (BMXAA9301E,
BMXAA0024E) and names the object structure at fault. See also the guide
loading data with the Maximo REST API.
Frequently asked questions
Why does MXAPIASSET work but not MXASSET on MAS 9?
The MXAPI object structures shipped by IBM already have an authorization name and are granted to standard groups. MXASSET, like custom or MxLoader MXL_ object structures, often has none: with mxe.int.enableosauth set to 1, the MAS 9 default, Maximo then denies access.
Can mxe.int.enableosauth be set back to 0?
On MAS 9 the property cannot be edited from the Maximo user interface. Even where it is technically possible, disabling it opens every object structure to any authenticated user: the clean fix is to secure each object structure you use.
Should I modify the MXAPI object structures?
No. Applications and Maximo Mobile use them: changing their settings can break those uses. Duplicate the object structure for loading, or secure your own object structures.
Does this error also affect MIF and enterprise services?
Yes, whenever the call runs as a user without rights on the object structure. For a loading tool, grant its technical user the object structures it needs, including read ones (for example MXENTSRV or MXAPIMSGTRACK to track messages).
Load your Maximo data without silent errors
MAS9 checks your files against each environment's configuration, resumes an interrupted load without duplicates, then reads Maximo back to prove every row arrived.
Discover MAS9