This session creates, updates, and deletes Authorizations in bulk. The data for create and update is provided by the consumer via the form object. OsidForms are requested for each create or update and may not be reused.

Create and update operations differ in their usage. To create an Authorization, an AuthorizationForm is requested using getAuthorizationFormsForCreate() specifying the desired qualifier, resource, and record Types or none if no record Types are needed. Each of the returned AuthorizationForms will indicate that it is to be used with a create operation and can be used to examine metdata or validate data prior to creation. Once an AuthorizationForm is submiited to a create operation, it cannot be reused with another create operation unless the first operation was unsuccessful. Each AuthorizationForm corresponds to an attempted transaction.

The AuthorizationForms returned from getAuthorizationFormsForCreate() may be linked to the originating request through the peer Ids of the AuthorizationForm. In the case where there may be duplicates, any AuthorizationForm of the same peer Ids may be used for a create operation.

Once a batch of AuthorizationForms are submitted for create, a CreateResponse is returned for each AuthorizationForm, although the ordering is not defined. Only errors that pertain to the entire create operation are returned from createAuthorizations(), errors specific to an individual AuthorizationForm are indicated in the corresponding CreateResponse. CreateResponses may be linked to the originating AuthorizationForm through the AuthorizationForm Id.

For updates, AuthorizationForms are requested to the Authorization Id that is to be updated using getAuthorizationFormsForUpdate() where the reference Id in the AuthorizationForm may be used to link the request. Similarly, the AuthorizationForm has metadata about the data that can be updated and it can perform validation before submitting the update. The AuthorizationForm can only be used once for a successful update and cannot be reused.

Once a batch of AuthorizationForms are submitted for update, an UpdateResponse is returned for each AuthorizationForm, although the ordering is not defined. Only errors that pertain to the entire update operation are returned from updateAuthorizations(), errors specific to an individual AuthorizationForm are indicated in the corresponding UpdateResponse. UpdateResponses may be linked to the originating AuthorizationForm through the AuthorizationForm Id.

The delete operations delete Authorizations in bulk. To unmap an Authorization from the current Vault, the AuthorizationVaultAssignmentSession should be used. These delete operations attempt to remove the Authorization itself thus removing it from all known Vault catalogs. Bulk delete operations return the results in DeleteResponses.