UMA

User-Managed Access (UMA 2.0) is a Kantara Initiative profile of OAuth 2.0 that shifts control of authorization from the application to the resource owner. Where plain OAuth is about a user granting an app access to their own data, UMA is about a user setting policy for other parties — people or services — to reach resources they own, asynchronously and without being present. It introduces an authorization server that mediates every access request against the owner’s stated terms.

• Resource owner policy control - The owner defines who can access what, in advance, rather than approving each request in the moment.
• Centralized authorization server - A single UMA authorization server can protect resources spread across many resource servers.
• Party-to-party sharing - It is built for one person granting another person or system access, not just first-party app authorization.
• OAuth 2.0 foundation - It reuses OAuth’s tokens and flows, so it slots into existing identity infrastructure.

In real API operations UMA shows up where fine-grained, owner-driven sharing matters — health records, financial data, and other consent-heavy domains where the individual, not the platform, should decide who sees what. It sits a layer above OAuth 2.0 and complements token formats like JWT by governing the policy behind them. As agentic access grows and software acts on a person’s behalf across many services, UMA’s model of centralized, owner-defined authorization becomes a useful pattern for keeping consent explicit and auditable.