title: WSO2 Control several APIs with the same endpoint with XACML poicies
body: <p>I have followed the tutorial for enforcing policies on API calls
  <a href="http://wso2.com/library/tutorials/2016/02/tutorial-how-to-enable-role-based-access-control-for-wso2-api-manager-using-xacml/" rel="nofollow noreferrer">http://wso2.com/library/tutorials/2016/02/tutorial-how-to-enable-role-based-access-control-for-wso2-api-manager-using-xacml/</a></p>
  
  <p>It wasn't easy but I got something up and running. I can change access to different endpoints of an API depending on the user's role.</p>
  
  <p>I have a question. Here's a fictional setup to complete the tutorial:</p>
  
  <ul>
  <li>API <code>EduCollege</code>, with endpoints <code>/student/info</code> and <code>/staff/info</code> (tutorial)</li>
  <li>API <code>Prison</code>, with endpoints <code>/prisoner/info</code> and <code>/staff/info</code> (note that it's the same endpoint)</li>
  </ul>
  
  <p>I write a policy <code>EDUCollegePolicy</code> that enables only those with role <code>college_admin</code> to access <code>/staff/info</code> (tutorial).</p>
  
  <p>But there seems to be no way to restrict these college admins from accessing staff info of the prison!
  The field <code>resource</code> only contains info about the endpoint.</p>
  
  <p>Is there any way, using this setup, to limit by API?</p>
  
  <p>Or does it maybe require a different JAR add-in, that would send a <code>resource</code> value set to <code>API/version/endpoint</code> instead of just <code>/endpoint</code>?</p>
  
  <p>Oh, by the way: I couldn't set policies according to the endpoints provided in the tutorial. It doesn't seem that it's <code>/staff/info</code>, but I got it to work with regexp <code>.*staff.*info.*</code>. Not nice. I wonder what the actual resource sent from JAR to PDP is, I couldn't find it in any logs, including IDS logs (the IDS acts as PDP)</p>