user can only get access to the obligations which belongs to him, for example, user with userId 3, can only get access to the obligations which have the same userId