> ## Documentation Index > Fetch the complete documentation index at: https://basedash.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update data source access > Updates the access policy for a data source. Requires admin access to the organization. Connection-level access: when mode is sent, it replaces who can query the data source. Use mode "everyone" to allow all organization members to view or edit it, or mode "restricted" with groupAccess/memberAccess to limit access; an omitted groupAccess or memberAccess means none. Legacy groupIds/memberIds grant view access. Omit mode to leave connection-level access unchanged; the body must then contain only objects, and sending accessLevel, groupAccess, memberAccess, groupIds, or memberIds without mode returns 400. A body with neither mode nor objects also returns 400. Schema, table, and column rules are optional. Omit objects to leave them unchanged. When objects is sent, even as an empty array, it replaces every object rule on the data source, including rules configured in the app. Objects are identified by their synced schema, table, and column names. Each object must set at least one of everyoneAccessLevel, groupAccess, or memberAccess, and unknown fields return 400; to remove an object's rules, leave the object out. Object rules are evaluated from schema to table to column; an object without a matching rule inherits from its parent. At each object a member rule beats group rules, a group with FULL beats groups with NO_ACCESS, and group rules beat the everyone rule. Rules apply to every role, including admins. To restrict tables to a group, set everyoneAccessLevel to NO_ACCESS and give the group FULL on the same object. Prefer schema-level rules for allow-lists: new tables in the schema inherit NO_ACCESS. New object rules must reference groups, active members, and objects that exist in the synced schema; otherwise nothing is changed, including the connection-level policy, and the request returns 404. Existing rules are kept as-is even if their object has since been dropped. Sending the same object rules again is a no-op for them: unchanged rules are not rewritten and open clients are not notified. ## OpenAPI ````yaml https://charts.basedash.com/api/public/openapi put /api/public/organizations/{orgId}/data-sources/{id}/access openapi: 3.1.0 info: title: Basedash Public API version: 0.0.0 description: >- API for programmatic access to Basedash features. Use API keys for authentication. contact: name: Basedash Support url: https://basedash.com email: support@basedash.com servers: - url: https://charts.basedash.com description: Production security: [] tags: - name: Organizations description: Manage organizations - name: Groups description: Manage organization groups and memberships - name: Data Sources description: Manage database connections and data sources - name: MCP servers description: Manage MCP server data sources - name: Insights description: Manage generated insights - name: Automations description: Manage automations and automation runs - name: Skills description: Manage organization skills - name: Models description: Manage reusable SQL models - name: Dashboards description: Manage dashboards and their tabs - name: Charts description: Manage charts and their SQL queries - name: Chats description: >- Chat with the Basedash AI agent about your data. Start a chat by sending a message, then continue the conversation with follow-up messages. The assistant responds asynchronously: pass the `wait` query parameter to receive the finished response in the same request, or poll the assistant message (or stream its events) after an HTTP 202. Chats created through the API are not shown in the Basedash app. paths: /api/public/organizations/{orgId}/data-sources/{id}/access: put: tags: - Data Sources summary: Update data source access description: >- Updates the access policy for a data source. Requires admin access to the organization. Connection-level access: when mode is sent, it replaces who can query the data source. Use mode "everyone" to allow all organization members to view or edit it, or mode "restricted" with groupAccess/memberAccess to limit access; an omitted groupAccess or memberAccess means none. Legacy groupIds/memberIds grant view access. Omit mode to leave connection-level access unchanged; the body must then contain only objects, and sending accessLevel, groupAccess, memberAccess, groupIds, or memberIds without mode returns 400. A body with neither mode nor objects also returns 400. Schema, table, and column rules are optional. Omit objects to leave them unchanged. When objects is sent, even as an empty array, it replaces every object rule on the data source, including rules configured in the app. Objects are identified by their synced schema, table, and column names. Each object must set at least one of everyoneAccessLevel, groupAccess, or memberAccess, and unknown fields return 400; to remove an object's rules, leave the object out. Object rules are evaluated from schema to table to column; an object without a matching rule inherits from its parent. At each object a member rule beats group rules, a group with FULL beats groups with NO_ACCESS, and group rules beat the everyone rule. Rules apply to every role, including admins. To restrict tables to a group, set everyoneAccessLevel to NO_ACCESS and give the group FULL on the same object. Prefer schema-level rules for allow-lists: new tables in the schema inherit NO_ACCESS. New object rules must reference groups, active members, and objects that exist in the synced schema; otherwise nothing is changed, including the connection-level policy, and the request returns 404. Existing rules are kept as-is even if their object has since been dropped. Sending the same object rules again is a no-op for them: unchanged rules are not rewritten and open clients are not notified. parameters: - schema: type: string description: Organization ID required: true description: Organization ID name: orgId in: path - schema: type: string description: Data source ID required: true description: Data source ID name: id in: path requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateDataSourceAccessInput' responses: '200': description: Data source access updated successfully content: application/json: schema: type: object properties: data: $ref: '#/components/schemas/DataSourceAccessResponse' required: - data '400': description: >- Bad request - Invalid JSON body, validation error, connection-level fields without mode, a body with neither mode nor objects, a duplicated object, an object with no rules or unknown fields, or conflicting levels for one principal on an object content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized - Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: >- Not found - Data source, group, member, or schema object not found, or no admin access content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit exceeded - Too many requests content: application/json: schema: $ref: '#/components/schemas/RateLimitErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: UpdateDataSourceAccessInput: oneOf: - type: object properties: mode: type: string enum: - everyone accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source groupIds: type: array items: type: string default: [] description: >- Deprecated. Organization group IDs granted view access. Use groupAccess to set view or edit access. memberIds: type: array items: type: string default: [] description: >- Deprecated. Organization member IDs granted view access. Use memberAccess to set view or edit access. groupAccess: type: array items: type: object properties: id: type: string description: Organization group or member ID accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source required: - id default: [] description: Organization groups with view or edit access memberAccess: type: array items: type: object properties: id: type: string description: Organization group or member ID accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source required: - id default: [] description: Organization members with view or edit access objects: type: array items: type: object properties: schemaName: type: string minLength: 1 description: Schema name exactly as synced from the data source tableName: type: - string - 'null' minLength: 1 description: >- Table name exactly as synced. Omit or null for a schema-level rule. columnName: type: - string - 'null' minLength: 1 description: >- Column name exactly as synced. Omit or null for a table-level rule. Requires tableName. everyoneAccessLevel: type: - string - 'null' enum: - FULL - NO_ACCESS - null description: >- Access for everyone in the organization on this object. Omit or null for no everyone rule. groupAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel maxItems: 500 default: [] description: Group rules on this object memberAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel maxItems: 500 default: [] description: Member rules on this object required: - schemaName additionalProperties: false maxItems: 1000 description: >- Schema, table, and column rules. Omit to leave existing object rules unchanged. The complete set of schema, table, and column rules for the data source (at most 5000 rules in total): objects not listed lose all of their rules, and an empty array removes every object rule. required: - mode - type: object properties: mode: type: string enum: - restricted groupIds: type: array items: type: string default: [] description: >- Deprecated. Organization group IDs granted view access. Use groupAccess to set view or edit access. memberIds: type: array items: type: string default: [] description: >- Deprecated. Organization member IDs granted view access. Use memberAccess to set view or edit access. groupAccess: type: array items: type: object properties: id: type: string description: Organization group or member ID accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source required: - id default: [] description: Organization groups with view or edit access memberAccess: type: array items: type: object properties: id: type: string description: Organization group or member ID accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source required: - id default: [] description: Organization members with view or edit access objects: type: array items: type: object properties: schemaName: type: string minLength: 1 description: Schema name exactly as synced from the data source tableName: type: - string - 'null' minLength: 1 description: >- Table name exactly as synced. Omit or null for a schema-level rule. columnName: type: - string - 'null' minLength: 1 description: >- Column name exactly as synced. Omit or null for a table-level rule. Requires tableName. everyoneAccessLevel: type: - string - 'null' enum: - FULL - NO_ACCESS - null description: >- Access for everyone in the organization on this object. Omit or null for no everyone rule. groupAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel maxItems: 500 default: [] description: Group rules on this object memberAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel maxItems: 500 default: [] description: Member rules on this object required: - schemaName additionalProperties: false maxItems: 1000 description: >- Schema, table, and column rules. Omit to leave existing object rules unchanged. The complete set of schema, table, and column rules for the data source (at most 5000 rules in total): objects not listed lose all of their rules, and an empty array removes every object rule. required: - mode - type: object properties: mode: type: string not: {} description: Leave mode out to keep connection-level access unchanged objects: type: array items: type: object properties: schemaName: type: string minLength: 1 description: Schema name exactly as synced from the data source tableName: type: - string - 'null' minLength: 1 description: >- Table name exactly as synced. Omit or null for a schema-level rule. columnName: type: - string - 'null' minLength: 1 description: >- Column name exactly as synced. Omit or null for a table-level rule. Requires tableName. everyoneAccessLevel: type: - string - 'null' enum: - FULL - NO_ACCESS - null description: >- Access for everyone in the organization on this object. Omit or null for no everyone rule. groupAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel maxItems: 500 default: [] description: Group rules on this object memberAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel maxItems: 500 default: [] description: Member rules on this object required: - schemaName additionalProperties: false maxItems: 1000 description: >- Schema, table, and column rules. The complete set of schema, table, and column rules for the data source (at most 5000 rules in total): objects not listed lose all of their rules, and an empty array removes every object rule. required: - objects additionalProperties: false DataSourceAccessResponse: type: object properties: dataSourceId: type: string description: Data source ID mode: type: string enum: - everyone - restricted description: Whether everyone or only listed principals can query accessLevel: type: - string - 'null' enum: - VIEW - EDIT - null description: Everyone access level when mode is everyone groupIds: type: array items: type: string description: >- Deprecated. Organization group IDs with view or edit access when mode is restricted. Use groupAccess for access levels. memberIds: type: array items: type: string description: >- Deprecated. Organization member IDs with view or edit access when mode is restricted. Use memberAccess for access levels. groupAccess: type: array items: type: object properties: id: type: string description: Organization group or member ID accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source required: - id description: Organization groups with view or edit access memberAccess: type: array items: type: object properties: id: type: string description: Organization group or member ID accessLevel: type: string enum: - VIEW - EDIT default: VIEW description: Whether the principal can view or edit the data source required: - id description: Organization members with view or edit access objects: type: array items: type: object properties: schemaName: type: string description: Schema name tableName: type: - string - 'null' description: Table name, or null for a schema-level rule columnName: type: - string - 'null' description: Column name, or null for a schema- or table-level rule everyoneAccessLevel: type: - string - 'null' enum: - FULL - NO_ACCESS - null description: Access for everyone in the organization, or null if unset groupAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel description: Group rules on this object memberAccess: type: array items: type: object properties: id: type: string minLength: 1 description: Organization group or member ID accessLevel: type: string enum: - FULL - NO_ACCESS description: >- FULL allows querying the object; NO_ACCESS blocks it in queries, chat, and metadata required: - id - accessLevel description: Member rules on this object required: - schemaName - tableName - columnName - everyoneAccessLevel - groupAccess - memberAccess description: >- Schema, table, and column rules: objects with at least one rule, sorted by schema, table, and column required: - dataSourceId - mode - accessLevel - groupIds - memberIds - groupAccess - memberAccess - objects ErrorResponse: type: object properties: error: $ref: '#/components/schemas/ApiError' required: - error RateLimitErrorResponse: type: object properties: error: $ref: '#/components/schemas/RateLimitError' required: - error ApiError: type: object properties: title: type: string description: Error type identifier detail: type: string description: Human-readable error description required: - title - detail RateLimitError: allOf: - $ref: '#/components/schemas/ApiError' - type: object properties: title: type: string enum: - RateLimitExceeded retryAfterMs: type: number description: Milliseconds until the rate limit window resets required: - retryAfterMs securitySchemes: bearerAuth: type: http scheme: bearer description: >- API key authentication using Bearer token format: `Bearer ` ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.