---
title: "User Claim Scripts"
slug: "user-claim-scripts-v6-5"
description: "Learn how User Claim Scripts enhance user claims for Policy assignments, Entitlements, and Conditions in your system. "
updated: 2025-12-04T16:47:39Z
published: 2025-12-04T16:47:39Z
canonical: "support.appgate.com/user-claim-scripts-v6-5"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Claim Scripts

Used to generate additional user Claims which can be used later on in Policy assignment, Entitlements and Conditions.

User Claim Scripts are so called because they create additional user claims. User claim scripts are run AFTER both user sign-in and running the device claim scripts but BEFORE the Policy assignment. Scripts can include existing user, device and system claims, and the additional user claims it generates can be used elsewhere in the system. Within the Controller the new claims can be used as assignment criteria within Policies. These new claims are also added to the claims Token; so within the Gateway, they can be used as access criteria in Conditions and used in Entitlement scripts to define protected hosts.

## Requirements/Considerations

- The script runs on the Controller whenever a user is authenticated and at claims token renewal.
- The script runs in a sandboxed JavaScript engine which supports external httpGet/Post/Put/Delete calls.
- Multiple user claim results (dictionary) are merged. There is no clear strategy to handle these conflicts - one will override the other.
- The final claims are not encrypted.

## Before you start

- Get a better understanding of [user claims](/v1/docs/user-claims) including details relating to [user claim scripts](/v1/docs/user-claims#user-claim-script)
- General background on the [use of scripts](/v1/docs/use-of-scripts)
- Refer to [claims in detail](/v1/docs/claims-in-detail) for information about all the claims used in the system.

Use the User Claim Scripts form to:

- [Add a new user](/v1/docs/configure-device-claim-scripts) claim script
- [Edit](/v1/docs/configure-device-claim-scripts) an existing user claim script

Key-value pairs related to the identity and content of the user or device and are specific to each session.

A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements.

The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration.

A digital key used to authenticate and authorize users or devices, enabling secure access to resources.

An appliance that acts as an enforcement point, controlling user access to protected resources.

A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system.