Dataset Level Access (DLA)

Dataset Level Access provides the user/tags with access to all the datasets registered (and also datasets created in future) under a specific domain.

The access type will be same as the access providing for the domain:

• Full access tag/user -> owner access
• Editor access tag/user -> editor access
• Read-only access tag/user -> read-only access

Note

Only a user with owner/editor permissions on a domain can provide DLA on the domain to other users/tags.

Different scenarios considering DLA

• If user/tags domain access is provided then
  • Provides the regular domain access and ALSO provides the DLA (if requested) for the specific domain.
• If DLA is provided for user/tags then
  • Access to all datasets in the domain will be provided.
• If DLA is revoked for user/tags then
  • Revokes ONLY the DLA but not the regular domain access.
  • Datasets access state will be reset to the state earlier to the DLA provision.
• If user/tags domain access is revoked then
  • Revokes the regular domain access and ALSO revokes the DLA (if provided) for the specific domain.
  • Datasets access state will be reset to the state earlier to the DLA provision.

Note

• For LF datasets, Dataset Level Access will be only given to existing datasets and no future datasets.

Dataset Level Access can be provided through different ways:

• Specific domain (Authorized Users)
• Specific domain (Authorized Tags)

DLA for user through specific domain (Resource Sharing)

User can provide DLA through Resource Sharing of a specific domain. If DLA is provided for any specific user then it'll be provided based on the selected access type.

UI Process

1. Navigate to Domain details page for the specific domain.
2. Click on share options for the domain.
3. Click on 'Provide Access' button and select the User and the Access Type to provide.
4. Toggle ON the 'Add Dataset level access' option.
5. Click on the checkmark icon

The following image shows the provision of DLA for a user through the specific domain's details page:

To provide DLA to a user/tag that already has access to the domain, click on the 'Provide Dataset Access' option in the Share domain panel.

To revoke DLA from a user/tag without removing the domain permissions, click on the 'Revoke Dataset Access' option in the Share domain panel.

API Process

API → domains/{domain_name}/grants & POST method

Adding a user with DLA

    {
        "TagKey": "user",
        "TagValue": {user_id},
        "AccessType": "owner",
        "AdditionalMetadata":{"IsDatasetLevelAccessProvided":true}
    }

API → domains/{domain_name}/grants & DELETE method

• 'Remove user' from specified domain (Authorized Users) API/UI will be same but it'll revoke the DLA if provided along with the regular domain access.

Remove DLA for a specific user

    {
        "TagKey": "user",
        "TagValue": {user_id},
        "AccessType": "owner",
        "AdditionalMetadata":{"IsDatasetLevelAccessProvided":false}
    }

DLA for tags through specific domain (Resource Sharing)

User can provide DLA through the share option of a specific domain. If DLA is provided for any specific tag then it'll be applicable to all the members of the tag.

UI Process

The UI process is similar to the process followed for a user. Select the tags instead of user here.

The following image shows the provision of DLA for a tag through the specific domain's details page:

API Process

API → domains/{domain_name}/grants & POST method

APIs for sharing resources with users or tags are the same, with the only difference being in the payload. When sharing with a user, the tagKey will be user, and the tagValue will be the Amorphic UserId. Conversely, when sharing with a tag, both the tagKey and tagValue will correspond to the key and value of the tag.

Adding a tag with DLA

    {
        "TagKey": "department",
        "TagValue": "sales",
        "AccessType": "owner",
        "AdditionalMetadata":{"IsDatasetLevelAccessProvided":true}
    }