Skip to content
Products
/
/
/
Permission Policy API
Last updated

Permission Policy API

The operations shown here are used to set, list, or update your permissions policies through the Treasure Data REST API. You might not see the same behavior if your administrator has not enabled granular permissions for authentication. Contact your Customer Support Engineer to upgrade to the latest version.

GET /v3/access_control/policies

Retrieves a list of policies.

HTTP VerbResourceDescription
GET/v3/access_control/policiesGets a list of policies

Request Body

Property NameValueDescription
policyobjectName of the policy

Sample Response

Status: 200 OK

    [
      {
        "id": 67,
        "account_id": 123,
        "name": "some_policy",
        "description": "written about the policy",
        "user_count": 3
      }
    ]

POST /v3/access_control/policies

Creates a policy.

HTTP VerbResourceDescription
POST/v3/access_control/policiesCreates a policy

URI Parameters

Parameter NameRequiredTypeDescription
policyYesobjectExample:{"policy": { "name": "name of policy", "description": "Description of policy" }
nameYesstringPolicy's name
descriptionstringPolicy's description

Sample Request

{
  "policy": {
    "name": "some_policy",
    "description": "written about the policy"
  }
}

Sample Response

Status: 200 OK

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

GET /v3/access_control/policies/:policy_id

Retrieve information about a policy.

HTTP VerbResourceDescription
GET/v3/access_control/policies/:policy_idGets a specific policy

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesIntegerAccessControlPolicyIdExample: 67

Sample Response

Status: 200 OK

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

PATCH /access_control/policies/:policy_id

Update information related to a policy.

HTTP VerbResourceDescription
PATCH/v3/access_control/policies/:policy_idUpdates a specific policy

URI Parameters

Parameter Name

| Required| Type| Description ---|---|---|--- policy_id| Yes| Integer| AccessControlPolicyIdExample: 67 policy| Yes| Object| TBD

Request Body

Property NameValueDescription
policyobjectName of the policy

Sample Request

{
  "policy": {
    "name": "some_policy",
    "description": "written about the policy"
  }
}

Sample Response

Status: 200 OK

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

DELETE /v3/access_control/policies/:policy_id

Delete a policy.

HTTP VerbResourceDescription
DELETE/v3/access_control/policies/:policy_idDeletes a specific policy

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesIntegerAccessControlPolicyIdExample: 67

Sample Response

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

GET /v3/access_control/users/:user_id/policies

List policies per user.

HTTP VerbResouceDescription
GET/v3/access_control/users/:user_id/policiesGets a list of policies by user

URI Parameters

Parameter NameRequiredTypeDescription
user_idYesintegerUserIdExample: 123

Sample Response

Status: 200 OK

[
  {
    "id": 67,
    "account_id": 123,
    "name": "some_policy",
    "description": "written about the policy",
    "user_count": 3
  }
]

PATCH /v3/access_control/users/:user_id/policies

Update a user’s policies.

HTTP VerbResourceDescription
PATCH/v3/access_control/users/:user_id/policiesUpdates a user’s policies

URI Parameters

Parameter NameRequiredTypeDescription
user_idYesintegerUserIdExample: 123

Request Body

Property NameValueDescription
policy_idsarray of stringList of policies

Sample Request

{
  "policy_ids": [
    "1",
    "2",
    "42"
  ]
}

Sample Response

Status: 200 OK

[
  {
    "id": 67,
    "account_id": 123,
    "name": "some_policy",
    "description": "written about the policy",
    "user_count": 3
  }
]

POST /v3/access_control/users/:user_id/policies/:policy_id

Attach a policy to a user.

HTTP VerbResourceDescription
POST/v3/access_control/users/:user_id/policies/:policy_idAttaches a policy to a user

URI Parameters

Parameter NameRequiredTypeDescription
user_idYesintegerUserIdExample: 123
policy_idYesintegerExample: 67

Sample Response

Status: 200 OK

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

DELETE /v3/access_control/users/:user_id/policies/:policy_id

Delete a user’s policies.

HTTP VerbResourceDescription
DELETE/v3/access_control/users/:user_id/policies/:policy_idDeletes a user’s policies

URI Parameters

Parameter NameRequiredTypeDescription
user_idYesintegerUserIdExample: 123
policy_idYesintegerExample: 67

Sample Response

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

POST /v3/access_control/policies/:policy_id/users/:user_id

Attach a user to a specific policy.

HTTP VerbResourceDescription
POST/v3/access_control/policies/:policy_id/users/:user_idAttaches a user to a policy.

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67
user_idYesIntegerUseridExample: 123

Sample Response

Status: 200 OK

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

DELETE /v3/access_control/policies/:policy_id/users/:user_id

Detach a user from a specific policy.

HTTP VerbResourceDescription
DELETE/v3/access_control/policies/:policy_id/users/:user_idDeletes a user from a policy

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67
user_idYesIntegerUseridExample: 123

Sample Response

Status: 200 OK

{
  "id": 67,
  "account_id": 123,
  "name": "some_policy",
  "description": "written about the policy",
  "user_count": 3
}

GET /v3/access_control/permissions

List all permissions.

HTTP VerbResourceDescription
GET/v3/access_control/permissionsLists all permissions

Sample Response

Status: 200 OK

[
  {
    "id": 0,
    "permission_set_id": 0,
    "resource_type": "string",
    "filter_expression": "string",
    "filter_operator": "string",
    "filter_value": "string",
    "can_create": true,
    "can_read": true,
    "can_update": true,
    "can_delete": true,
    "can_execute": true,
    "custom_operation": "string"
  }
]

GET /v3/access_control/policies/:policy_id/permissions

List the permissions for a specific policy.

HTTP VerbResourceDescription
GET/v3/access_control/policies/:policy_id/permissionsLists permissions for a policy
Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67

Sample Response

Status: 200 OK

{
  "WorkflowProject": [
    {
      "operation": "view"
    }
  ],
  "WorkflowProjectLevel": [
    {
      "operation": "view",
      "name": "my_wf"
    }
  ],
  "Segmentation": [
    {
      "operation": "full"
    }
  ],
  "MasterSegmentConfigs": [
    {
      "operation": "view"
    }
  ],
  "MasterSegmentConfig": [
    {
      "operation": "view",
      "id": "42"
    }
  ],
  "SegmentAllFolders": [
    {
      "operation": "view",
      "audience_id": "42"
    }
  ],
  "SegmentFolder": [
    {
      "operation": "view",
      "id": "42"
    }
  ],
  "Authentications": [
    {
      "operation": "use"
    }
  ],
  "Sources": [
    {
      "operation": "restricted"
    }
  ],
  "Destinations": [
    {
      "operation": "restricted"
    }
  ]
}

PATCH /v3/access_control/policies/:policy_id/permissions

Update the permissions for a specific policy.

HTTP VerbResourceDescription
PATCH/v3/access_control/policies/:policy_id/permissionUpdates permissions for a policy

URI Parameter

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67

Available Body Request Fields

Parameter NameValueDescriptionExample
WorkflowProjectArray of objectDesignates "view", "run", or "edit" access to all workflows.Example:operation (string)enum: "view" "run" "edit"name (string)
WorkflowProjectLevelArray of objectDesignates "view", "run", or "edit" access to a specific workflow project.Example:operation (string)enum: "view" "run" "edit"name (string)
SegmentationArray of objectGrants "full" access to all segmentations.Example:operation (string)value: "full"
MasterSegmentConfigsArray of objectGrants "view" or "edit" access to all master segment configs, or "full" access to all CDP-generated workflows.Example:operation (string)enum: "view" "edit"
MasterSegmentConfigArray of objectGrants "view" or "edit" access to specific master segment config, or "full" access to specific CDP-generated workflows.Example:operation (string)enum: "view" "edit"id (string)
MasterSegmentColumnArray of objectGrants permissions on a master segment column.Example: operations (string)enum: "view_clear" "view_non_pii" "view_pii" "blocked"
MasterSegmentAllColumnsArray of objectGrants permissions on all columns of a master segment.Example: operations (string)enum: "view_clear" "view_non_pii" "view_pii" "blocked_only_for_migration_purpose"
SegmentAllFoldersArray of objectGrants "view" or "edit" access to all segment folders.Example:operation (string)enum: "view" "edit"audience_id (string)
SegmentFolderArray of objectGrants "view" or "edit" access to a specific segment folder.Example:operation (string)enum: "view" "edit"id (string)
DatabasesArray of objectGrants “manage” access to all databases.Grants “owner_manage” access to owned databases.Grants “edit”, “query” and “import” to access specific databases with “ids”.Grants “download” to allow downloads of databases that have read permissions.Example:operation (string)enum: “manage” “owner_manage” “edit” “query” “import”ids: (string, required when operation is “edit” “query” “import”)“1,2,3”
AuthenticationsArray of objectGrants "use" or "full" access to all authentications. Where "use" designates permissions to view authentications.Example: operation (string)
enum: "use" "full" "owner_manage" "use_limited" ## Order is up to you
ids (string, required when operation is "use_limited")
"1, 2, 3"
SourcesArray of objectSets "restricted" access to all sources.Example: Describes what authority you have (only one type may be selected)Example:
operation (string)
enum: "restricted"
DestinationsArray of objectGrants "restricted" access to using destinations for result export.Example:
operation (string)
enum: "restricted"

Sample Request

{
    "Authentications": [
        {
            "operation": "full"
        }
    ],
    "Sources": [
        {
            "operation": "restricted"
        }
    ],
    "Destinations": [
        {
            "operation": "restricted"
        }
    ]
}

Sample Response

Status: 200 OK

{
    "Authentications": [
        {
            "operation": "full"
        }
    ],
    "Sources": [
        {
            "operation": "restricted"
        }
    ],
    "Destinations": [
        {
            "operation": "restricted"
        }
    ]
}

GET /v3/access_control/users

Retrieve a list of users and their permissions.

HTTP VerbResourceDescription
GET/v3/access_control/usersGets a list of users and their permissions

Sample Response

Status: 200 OK

[
  {
    "user_id": 123,
    "account_id": 123,
    "permissions": {
      "WorkflowProject": [
        {
          "operation": "view"
        }
      ],
      "WorkflowProjectLevel": [
        {
          "operation": "view",
          "name": "my_wf"
        }
      ],
      "Segmentation": [
        {
          "operation": "full"
        }
      ],
      "MasterSegmentConfigs": [
        {
          "operation": "view"
        }
      ],
      "MasterSegmentConfig": [
        {
          "operation": "view",
          "id": "42"
        }
      ],
      "SegmentAllFolders": [
        {
          "operation": "view",
          "audience_id": "42"
        }
      ],
      "SegmentFolder": [
        {
          "operation": "view",
          "id": "42"
        }
      ],
      "Authentications": [
        {
          "operation": "use"
        }
      ],
      "Sources": [
        {
          "operation": "restricted"
        }
      ],
      "Destinations": [
        {
          "operation": "restricted"
        }
      ]
    },
    "policies": [
      {
        "id": 67,
        "account_id": 123,
        "name": "some_policy",
        "description": "written about the policy",
        "user_count": 3
      }
    ]
  }
]

GET /v3/access_control/users/:user_id

Retrieve a specific user by ID.

HTTP VerbResourceDescription
GET/v3/access_control/users/:user_idGets a user

URI Parameter

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67

Sample Response

Status: 200 OK

{
  "user_id": 123,
  "account_id": 123,
  "permissions": {
    "WorkflowProject": [
      {
        "operation": "view"
      }
    ],
    "WorkflowProjectLevel": [
      {
        "operation": "view",
        "name": "my_wf"
      }
    ],
    "Segmentation": [
      {
        "operation": "full"
      }
    ],
    "MasterSegmentConfigs": [
      {
        "operation": "view"
      }
    ],
    "MasterSegmentConfig": [
      {
        "operation": "view",
        "id": "42"
      }
    ],
    "SegmentAllFolders": [
      {
        "operation": "view",
        "audience_id": "42"
      }
    ],
    "SegmentFolder": [
      {
        "operation": "view",
        "id": "42"
      }
    ],
    "Authentications": [
      {
        "operation": "use"
      }
    ],
    "Sources": [
      {
        "operation": "restricted"
      }
    ],
    "Destinations": [
      {
        "operation": "restricted"
      }
    ]
  },
  "policies": [
    {
      "id": 67,
      "account_id": 123,
      "name": "some_policy",
      "description": "written about the policy",
      "user_count": 3
    }
  ]
}

PATCH /v3/access_control/users/:user_id/permissions

Update permissions for a specific user.

HTTP VerbResourceDescription
PATCH/v3/access_control/users/:user_id/permissionsUpdates permissions

URI Parameters

Parameter NameRequiredTypeDescription
user_idYesIntegerUseridExample: 123

Request Body

Property NameValueDescription
WorkflowProjectarray of objectExample:operation (string)enum:"view" "run" "edit"property name (any)
WorkflowProjectLevelarray of objectExample:operation (string)enum:"view" "run" "edit"name (string)property name (any)

Sample Request

{
  "WorkflowProject": [
    {
      "operation": "view"
    }
  ],
  "WorkflowProjectLevel": [
    {
      "operation": "view",
      "name": "my_wf"
    }
  ]
}

Sample Response

Status: 200 OK

{
  "user_id": 123,
  "permissions": {
    "WorkflowProject": [
      {
        "operation": "view"
      }
    ],
    "WorkflowProjectLevel": [
      {
        "operation": "view",
        "name": "my_wf"
      }
    ],
    "Segmentation": [
      {
        "operation": "full"
      }
    ],
    "MasterSegmentConfigs": [
      {
        "operation": "view"
      }
    ],
    "MasterSegmentConfig": [
      {
        "operation": "view",
        "id": "42"
      }
    ],
    "SegmentAllFolders": [
      {
        "operation": "view",
        "audience_id": "42"
      }
    ],
    "SegmentFolder": [
      {
        "operation": "view",
        "id": "42"
      }
    ],
    "Authentications": [
      {
        "operation": "use"
      }
    ],
    "Sources": [
      {
        "operation": "restricted"
      }
    ],
    "Destinations": [
      {
        "operation": "restricted"
      }
    ]
  }
}

GET /v3/access_control/policies/:policy_id/users

Retrieve a list of users associated with a specific policy.

HTTP VerbResourceDescription
GET/v3/access_control/policies/:policy_id/usersGets a list of users of a policy

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67

Sample Response

Status: 200 OK

[
  {
    "user_id": 123,
    "account_id": 123,
    "email": "jake@gmail.com",
    "name": "Jake Becker"
  }
]

PATCH /v3/access_control/policies/:policy_id/users

Update a list of users associated with a specific policy.

HTTP VerbResourceDescription
PATCH/v3/access_control/policies/:policy_id/usersUpdates a list of users with a policy

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67

Request Body

Property NameValueDescription
user_idsarray of integerList of user IDs

Sample Request

{
  "user_ids": [
    123
  ]
}

Sample Response

Status: 200 OK

[
  {
    "user_id": 123,
    "account_id": 123,
    "permissions": {
      "WorkflowProject": [
        {
          "operation": "view"
        }
      ],
      "WorkflowProjectLevel": [
        {
          "operation": "view",
          "name": "my_wf"
        }
      ],
      "Segmentation": [
        {
          "operation": "full"
        }
      ],
      "MasterSegmentConfigs": [
        {
          "operation": "view"
        }
      ],
      "MasterSegmentConfig": [
        {
          "operation": "view",
          "id": "42"
        }
      ],
      "SegmentAllFolders": [
        {
          "operation": "view",
          "audience_id": "42"
        }
      ],
      "SegmentFolder": [
        {
          "operation": "view",
          "id": "42"
        }
      ],
      "Authentications": [
        {
          "operation": "use"
        }
      ],
      "Sources": [
        {
          "operation": "restricted"
        }
      ],
      "Destinations": [
        {
          "operation": "restricted"
        }
      ]
    },
    "policies": [
      {
        "id": 67,
        "account_id": 123,
        "name": "some_policy",
        "description": "written about the policy",
        "user_count": 3
      }
    ]
  }
]

GET /v3/access_control/policies/{policy_id}/column_permissions

Retrieve information related to a policy that contains column-level permissions.

HTTP VerbResourceDescription
GET/access_control/policies/{policy_id}/column_permissionsRetrieve information related to a policy that contains column-level permissions.

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerAccessControlPolicyIdExample: 67

Sample Response

{
  "tags": [
    "string"
  ],
  "except": true,
  "masking" : "hash"
}

GET /v3/access_control/policies?column_permissions_tag={tag}

Retrieve all policies that contain column tags.

HTTP VerbResourceDescription
GET/v3/access_control/policies?column_permission_tag={tag}Retrieve all policies that contain column tags.

Sample Response

[
  {
    "id": 67,
    "account_id": 123,
    "name": "some_policy",
    "description": "written about the policy",
    "user_count": 3
  }
]

PATCH /v3/access_control/policies/{policy_id}/column_permissions

Update information related to a column-level access control policy.

Control TypeDescription
AllowA policy that allows access with “xxx, yyy, zzz” tags
Allow - ExceptA policy that allows access to all columns with the exception of “aaa, bbb, ccc” tags
MaskA policy that hides specified columns using modified content.

ALLOW

HTTP VerbResourceDescription
PATCH/v3/access_control/policies/:policy_id/column_permissionsUpdates a specific policy to allow access to specific tags.

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerpolicy_idExample: 6196842

Sample Request

curl -X PATCH \
     -H "Authorization: TD1 ${TD1_KEY}" \
     -H "Content-Type: application/json" \
     -d '{"column_permissions":[ {"tags":["home-address"]} ]}'

Sample Response

[
  {
    "tags": [
      "home-address"
    ]
  }
]

ALLOW Except

HTTP VerbResourceDescription
PATCH/v3/access_control/policies/:policy_id/column_permissionsUpdates a specific policy to allow access to specific tags.

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerpolicy_idExample: 6196842

Sample Request

curl -X PATCH \
     -H "Authorization: TD1 ${TD1_KEY}" \
     -H "Content-Type: application/json" \
     -d '{"column_permissions":[ {"tags":["email-raw"], "except":true} ]}'

Sample Response

[
  {
    "tags": [
      "email-raw"
    ],
    "except": true
  }
]

MASKING

HTTP VerbResourceDescription
PATCH/v3/access_control/policies/:policy_id/column_permissionsUpdates a specific policy to allow access to specific tags.

URI Parameters

Parameter NameRequiredTypeDescription
policy_idYesintegerpolicy_idExample: 6196842

Sample Request

curl -X PATCH \
     -H "Authorization: TD1 ${TD1_KEY}" \
     -H "Content-Type: application/json" \
     -d '{"column_permissions":[ {"tags":["home-address"], "masking":"hash"} ]}'

Sample Response

[
  {
    "tags": [
      "home-address"
    ],
    "masking": "hash"
  }
]
Previous page
Next page