API Reference > Manage data access assets > Data access control API
  

Data access control API

Use the data access control API to create, update, delete, or retrieve data access control policies and data access control rules.
Data access control policies grant groups of users read, write, or delete access to assets in a source system that you specify. Data Access Management pushes these policies into your cloud data platform. The data source enforces the data access control policy directly.
For more information on data access control rules, see Creating data access control rules in the Data Governance and Catalog help.

Retrieve data access control assets

Send a GET request to retrieve the details of data access control policies and data access control rules. The prefix, indicated by <prefix>, for each endpoint is /data360/dam/api/v1/.

Endpoints

The following table describes methods and endpoints for the data access control API:
Method
Endpoint
Description
GET
<baseApiUrl><prefix>/data-access-controls
Retrieve the list of all published data access control policies.
GET
<baseApiUrl><prefix>/data-access-controls/{ID}
Retrieve the draft or published version of a specified data access control policy.

Request parameters

The following table describes the parameters that you can specify in the endpoint of the request:
Parameter
Type
Description
offset
Integer
Optional. Specify the record number from which to begin returning assets. The default value is zero.
limit
Integer
Optional. Specify the total number of records to return. The default value is 500.
fetchDraft
Boolean
Optional. Retrieve the draft version of a specified data access control policy. When using the <baseApiUrl><prefix>/data-access-controls/{ID} endpoint, use fetchDraft=true.The default value is false.
Note:
To retrieve the draft version of all data access control policies, see Retrieve assets in the catalog.

Request body

These endpoints have no request body.

Create data access control assets

Send a POST request to create data access control policies. The prefix, indicated by <prefix>, for each endpoint is /data360/dam/api/v1/.

Endpoints

The following table describes method and endpoint for the data access control API:
Method
Endpoint
Description
POST
<baseApiUrl><prefix>/data-access-controls
Create new data access control policies.

Request parameters

The following table describes the parameters that you can specify in the endpoint of the request:
Parameter
Type
Description
name
String
Required. Specify the name of the asset.
externalId
String
Optional. Specify the external identifier of the asset.
description
String
Optional. Specify the description of the asset.
enabled
Boolean
Optional. Specify the status of the asset: true|false.
effectiveDate
String
Optional. Specify the start date of the asset in the format yyyy-mm-dd.
endDate
String
Optional. Specify the end date of the asset in the format yyyy-mm-dd.
enforcementMethod
String
Optional. Specify the data access policy enforcement method: PUSHDOWN
stakeholders
Object
Optional. Specify the following attributes to add a stakeholder to the asset.
stakeholderId: The internal ID of the stakeholder. You can find this ID by looking at the URL of the stakeholder page in Data Governance and Catalog.
roleId: The internal ID of the role for the stakeholder. You can find this ID in the role details in Administrator. Navigate to the User Roles page, open the user role, and copy the ID at the end of the URL.
stakeholderType: Specify whether the stakeholder is a USER or GROUP.
dataAccessRules
Object
Optional. Define one or more data access control rules.
ruleName: String. Name of the rule.
ruleDescription: String. Description of the rule.
enabled: Boolean. Status of the rule.
rank: Integer. Ranking of the rule within the policy.
condition: Object. Set of conditions for the rule.
accessControls: Object. Asset query and permissions that the rule grants.

Request body

In the body of the request, specify the parameters in the following format:
{

"name": "Data Access Control Policy",

"description": "General Access Restriction Policy.",

"externalId": "Data Access Control Policy",

"effectiveDate": "2000-01-01",

"enabled": false,

"dataAccessRules": [

{

"ruleName": "Data Access Control Rule",

"ruleDescription": "General access restrictions.",

"enabled": true,

"rank": 0,

"condition": {

"dialect": "structured-predicate",

"version": "1.0",

"predicate": {

"or": [

{

"isAnyOf": [

{

"path": "context::principal.groups"

},

{

"constant": {

"__type": "group_identifier",

"type": "PLAIN",

"id": "USERS"

}}]}]}},

"accessControls": [

{

"accessTypes": [

"READ"

],

"resourceLocatorQuery": {

"dialect": "knowledge-graph-search",

"query": {

"query": "tables related to business term '*Customer'",

"filter": [

"{\"bool\":{\"filter\":[{\"terms\":{\"core.classType\":[\"com.infa.odin.models.relational.Table\"]}},{\"terms\":{\"core.resourceType\":[\"Databricks Notebooks\"]}},{\"terms\":{\"core.assetLifecycle\":[\"Published\"]}}]}}"

]

},

"version": "1.0"

}}]}]

}

Modify data access control assets

Send a PUT request to replace a data access control policy. Send a PATCH request to modify the details of a data access control policy. The prefix, indicated by <prefix>, for each endpoint is /data360/dam/api/v1/.

Endpoints

The following table describes methods and endpoints for the data access control API:
Method
Endpoint
Description
PUT
<baseApiUrl><prefix>/data-access-controls/{ID}
Replace a specified data access control policy.
PATCH
<baseApiUrl><prefix>/data-access-controls/{ID}
Modify the details of a specified data access control policy.

Request parameters

The following table describes the parameters that you can specify in the endpoint of the request:
Parameter
Type
Description
name
String
Required. Specify the name of the asset.
externalId
String
Optional. Specify the external identifier of the asset.
description
String
Optional. Specify the description of the asset.
enabled
Boolean
Optional. Specify the status of the asset: true|false.
effectiveDate
String
Optional. Specify the start date of the asset in the format yyyy-mm-dd.
endDate
String
Optional. Specify the end date of the asset in the format yyyy-mm-dd.
stakeholders
Object
Optional. Specify the following attributes to add a stakeholder to the asset.
stakeholderId: The internal ID of the stakeholder. You can find this ID by looking at the URL of the stakeholder page in Data Governance and Catalog.
roleId: The internal ID of the role for the stakeholder. You can find this ID in the role details in Administrator. Navigate to the User Roles page, open the user role, and copy the ID at the end of the URL.
stakeholderType: Specify whether the stakeholder is a USER or GROUP.
dataAccessRules
Object
Optional. Define one or more data access control rules.
ruleName: String. Name of the rule.
ruleDescription: String. Description of the rule.
rank: Integer. Ranking of the rule within the policy.
condition: Object. Set of conditions for the rule.
accessControls: Object. Asset query and permissions that the rule grants.

Request body

In the body of the request, specify the parameters in the following format:
{

"description": "General Access Restriction, updated."

}
This example request body uses the PATCH method to modify only the policy's description.

Delete data access control assets

Send a DELETE request to delete a specific data access control policy. The prefix, indicated by <prefix>, for each endpoint is /data360/dam/api/v1/.

Endpoints

The following table describes method and endpoint for the data access control API:
Method
Endpoint
Description
DELETE
<baseApiUrl><prefix>/data-access-controls/{ID}
Delete a specified data access control policy.

Request body

This endpoint has no request body.