Update data source access

Updates the access policy for a data source. Requires admin access to the organization.

Connection-level access: when mode is sent, it replaces who can query the data source. Use mode “everyone” to allow all organization members to view or edit it, or mode “restricted” with groupAccess/memberAccess to limit access; an omitted groupAccess or memberAccess means none. Legacy groupIds/memberIds grant view access. Omit mode to leave connection-level access unchanged; the body must then contain only objects, and sending accessLevel, groupAccess, memberAccess, groupIds, or memberIds without mode returns 400. A body with neither mode nor objects also returns 400.

Schema, table, and column rules are optional. Omit objects to leave them unchanged. When objects is sent, even as an empty array, it replaces every object rule on the data source, including rules configured in the app. Objects are identified by their synced schema, table, and column names. Each object must set at least one of everyoneAccessLevel, groupAccess, or memberAccess, and unknown fields return 400; to remove an object’s rules, leave the object out.

Object rules are evaluated from schema to table to column; an object without a matching rule inherits from its parent. At each object a member rule beats group rules, a group with FULL beats groups with NO_ACCESS, and group rules beat the everyone rule. Rules apply to every role, including admins. To restrict tables to a group, set everyoneAccessLevel to NO_ACCESS and give the group FULL on the same object. Prefer schema-level rules for allow-lists: new tables in the schema inherit NO_ACCESS.

New object rules must reference groups, active members, and objects that exist in the synced schema; otherwise nothing is changed, including the connection-level policy, and the request returns 404. Existing rules are kept as-is even if their object has since been dropped. Sending the same object rules again is a no-op for them: unchanged rules are not rewritten and open clients are not notified.

PUT /api/public/organizations/{orgId}/data-sources/{id}/access

Update data source access

cURL

curl --request PUT \
  --url https://charts.basedash.com/api/public/organizations/{orgId}/data-sources/{id}/access \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "mode": "everyone",
  "accessLevel": "VIEW",
  "groupIds": [],
  "memberIds": [],
  "groupAccess": [],
  "memberAccess": [],
  "objects": [
    {
      "schemaName": "<string>",
      "tableName": "<string>",
      "columnName": "<string>",
      "groupAccess": [],
      "memberAccess": []
    }
  ]
}
'

200

{
  "data": {
    "dataSourceId": "<string>",
    "mode": "everyone",
    "accessLevel": "VIEW",
    "groupIds": [
      "<string>"
    ],
    "memberIds": [
      "<string>"
    ],
    "groupAccess": [
      {
        "id": "<string>",
        "accessLevel": "VIEW"
      }
    ],
    "memberAccess": [
      {
        "id": "<string>",
        "accessLevel": "VIEW"
      }
    ],
    "objects": [
      {
        "schemaName": "<string>",
        "tableName": "<string>",
        "columnName": "<string>",
        "everyoneAccessLevel": "FULL",
        "groupAccess": [
          {
            "id": "<string>",
            "accessLevel": "FULL"
          }
        ],
        "memberAccess": [
          {
            "id": "<string>",
            "accessLevel": "FULL"
          }
        ]
      }
    ]
  }
}

Authorizations

Authorization · string · header · required

API key authentication using Bearer token format: Bearer <basedash_api_key>

Path Parameters

orgId · string · required

Organization ID

id · string · required

Data source ID

Body

application/json

Option 1

Option 2

Option 3

mode · enum<string> · required

Available options: everyone

accessLevel · enum<string> · default: VIEW

Whether the principal can view or edit the data source

Available options: VIEW, EDIT

groupIds · string[]

Deprecated. Organization group IDs granted view access. Use groupAccess to set view or edit access.

memberIds · string[]

Deprecated. Organization member IDs granted view access. Use memberAccess to set view or edit access.

groupAccess · object[]

Organization groups with view or edit access

Show child attributes

memberAccess · object[]

Organization members with view or edit access

Show child attributes

objects · object[]

Schema, table, and column rules. Omit to leave existing object rules unchanged. The complete set of schema, table, and column rules for the data source (at most 5000 rules in total): objects not listed lose all of their rules, and an empty array removes every object rule.

Maximum array length: 1000

Show child attributes

Response

200

application/json

Data source access updated successfully

data · object · required

Show child attributes