> For the complete documentation index, see [llms.txt](https://developer.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.collibra.com/api/graphql/data-access/input-types/access-control-input.md).

# AccessControlInput

Input object for creating and updating access controls.

```graphql
input AccessControlInput {
  action: AccessControlAction
  category: String
  dataSources: [AccessControlDataSourceInput!]
  dataSourcesToAdd: [AccessControlDataSourceInput!]
  dataSourcesToRemove: [ID!]
  description: String
  external: Boolean
  filterCriteria: DataComparisonExpressionInput
  linkedAssetId: ID
  locks: [AccessControlLockDataInput!]
  name: String
  namingHint: String
  policyRule: String
  source: String
  state: AccessControlState
  volatile: Boolean
  whatAbacRules: [WhatAbacRuleInput]
  whatAbacRulesToAdd: [WhatAbacRuleInput!]
  whatAbacRulesToRemove: [ID!]
  whatAccessControls: [AccessControlWhatInputAP!]
  whatAccessControlsToAdd: [AccessControlWhatInputAP!]
  whatAccessControlsToRemove: [ID!]
  whatDataObjects: [AccessControlWhatInputDO!]
  whatDataObjectsToAdd: [AccessControlWhatInputDO!]
  whatDataObjectsToRemove: [WhatDataObjectRemoveInput!]
  whoAbacRules: [WhoAbacRuleInput]
  whoAbacRulesToAdd: [WhoAbacRuleInput!]
  whoAbacRulesToRemove: [ID!]
  whoItems: [WhoItemInput!]
  whoItemsToAdd: [WhoItemInput!]
  whoItemsToRemove: [WhoItemRemoveInput!]
}
```

### Fields

#### action ● [`AccessControlAction`](/api/graphql/data-access/enumerations/access-control-action.md) enum <a href="#action" id="action"></a>

Action of the access control to determine if it is a grant, mask, filter or group.

#### category ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#category" id="category"></a>

In case the access control is a grant (action), this contains the grant category (determining the behavior of the grant).

#### dataSources ● [`[AccessControlDataSourceInput!]`](/api/graphql/data-access/input-types/access-control-data-source-input.md) list input <a href="#data-sources" id="data-sources"></a>

The data sources that this access control will get deployed to. Cannot be used together with dataSourcesToAdd or dataSourcesToRemove.

#### dataSourcesToAdd ● [`[AccessControlDataSourceInput!]`](/api/graphql/data-access/input-types/access-control-data-source-input.md) list input <a href="#data-sources-to-add" id="data-sources-to-add"></a>

The list of data sources to add to this access control (diff-based update). Cannot be used together with dataSources.

#### dataSourcesToRemove ● [`[ID!]`](/api/graphql/data-access/scalars/id.md) list scalar <a href="#data-sources-to-remove" id="data-sources-to-remove"></a>

The list of data source IDs to remove from this access control (diff-based update). Cannot be used together with dataSources. Removing a data source also removes the WHAT data objects and WHAT access controls that reside on that data source.

#### description ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#description" id="description"></a>

Detailed description of the access control.

#### external ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#external" id="external"></a>

Indicates whether the access control is managed externally (in the Data Source) or internally (in the Collibra Data Access application).

#### filterCriteria ● [`DataComparisonExpressionInput`](/api/graphql/data-access/input-types/data-comparison-expression-input.md) input <a href="#filter-criteria" id="filter-criteria"></a>

For access controls with `action=Filter`, this contains the boolean expression determining the filter criteria.

#### linkedAssetId ● [`ID`](/api/graphql/data-access/scalars/id.md) scalar <a href="#linked-asset-id" id="linked-asset-id"></a>

When provided on creation, a role asset link to this Collibra asset is created atomically together with the access control. Only valid for Roles (action=Grant).

#### locks ● [`[AccessControlLockDataInput!]`](/api/graphql/data-access/input-types/access-control-lock-data-input.md) list input <a href="#locks" id="locks"></a>

The locks that should apply to this access control.

#### name ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#name" id="name"></a>

Name of the access control.

#### namingHint ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#naming-hint" id="naming-hint"></a>

Naming hint for the access control, used for generating the actual names in target systems.

#### policyRule ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#policy-rule" id="policy-rule"></a>

The policy rule as a string. This is used only for certain cases, like imported row-level filters and column masks or for row-level filters that are implemented like this.

#### source ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#source" id="source"></a>

Source defines the source of the access control, if managed by third party tool.

#### state ● [`AccessControlState`](/api/graphql/data-access/enumerations/access-control-state.md) enum <a href="#state" id="state"></a>

State of the access control.

#### volatile ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#volatile" id="volatile"></a>

Marks this access control as volatile. Cannot be set on Mask or Filter actions.

#### whatAbacRules ● [`[WhatAbacRuleInput]`](/api/graphql/data-access/input-types/what-abac-rule-input.md) list input <a href="#what-abac-rules" id="what-abac-rules"></a>

The list of ABAC rules for calculating the WHAT items dynamically. Cannot be used together with whatAbacRulesToAdd or whatAbacRulesToRemove.

#### whatAbacRulesToAdd ● [`[WhatAbacRuleInput!]`](/api/graphql/data-access/input-types/what-abac-rule-input.md) list input <a href="#what-abac-rules-to-add" id="what-abac-rules-to-add"></a>

The list of WHAT ABAC rules to add to this access control (diff-based update). When the id of an existing WHAT ABAC rule is given, that rule is updated in place. Cannot be used together with whatAbacRules.

#### whatAbacRulesToRemove ● [`[ID!]`](/api/graphql/data-access/scalars/id.md) list scalar <a href="#what-abac-rules-to-remove" id="what-abac-rules-to-remove"></a>

The list of WHAT ABAC rule ids to remove from this access control (diff-based update). Cannot be used together with whatAbacRules.

#### whatAccessControls ● [`[AccessControlWhatInputAP!]`](/api/graphql/data-access/input-types/access-control-what-input-ap.md) list input <a href="#what-access-controls" id="what-access-controls"></a>

The list of static WHAT access controls for this access control. Cannot be used together with whatAccessControlsToAdd or whatAccessControlsToRemove.

#### whatAccessControlsToAdd ● [`[AccessControlWhatInputAP!]`](/api/graphql/data-access/input-types/access-control-what-input-ap.md) list input <a href="#what-access-controls-to-add" id="what-access-controls-to-add"></a>

The list of static WHAT access controls to add to this access control (diff-based update). Cannot be used together with whatAccessControls.

#### whatAccessControlsToRemove ● [`[ID!]`](/api/graphql/data-access/scalars/id.md) list scalar <a href="#what-access-controls-to-remove" id="what-access-controls-to-remove"></a>

The list of static WHAT access control IDs to remove from this access control (diff-based update). Cannot be used together with whatAccessControls.

#### whatDataObjects ● [`[AccessControlWhatInputDO!]`](/api/graphql/data-access/input-types/access-control-what-input-do.md) list input <a href="#what-data-objects" id="what-data-objects"></a>

The list of static WHAT data object items for this access control. Cannot be used together with whatDataObjectsToAdd or whatDataObjectsToRemove.

#### whatDataObjectsToAdd ● [`[AccessControlWhatInputDO!]`](/api/graphql/data-access/input-types/access-control-what-input-do.md) list input <a href="#what-data-objects-to-add" id="what-data-objects-to-add"></a>

The list of static WHAT data objects to add to this access control (diff-based update). Cannot be used together with whatDataObjects.

#### whatDataObjectsToRemove ● [`[WhatDataObjectRemoveInput!]`](/api/graphql/data-access/input-types/what-data-object-remove-input.md) list input <a href="#what-data-objects-to-remove" id="what-data-objects-to-remove"></a>

The list of static WHAT data objects to remove from this access control (diff-based update). Cannot be used together with whatDataObjects. When permissions and globalPermissions are both omitted, the entire WHAT link is removed. When specific permissions are provided, only those are removed.

#### whoAbacRules ● [`[WhoAbacRuleInput]`](/api/graphql/data-access/input-types/who-abac-rule-input.md) list input <a href="#who-abac-rules" id="who-abac-rules"></a>

The list of ABAC rules for calculating the WHO items dynamically. Cannot be used together with whoAbacRulesToAdd or whoAbacRulesToRemove.

#### whoAbacRulesToAdd ● [`[WhoAbacRuleInput!]`](/api/graphql/data-access/input-types/who-abac-rule-input.md) list input <a href="#who-abac-rules-to-add" id="who-abac-rules-to-add"></a>

The list of WHO ABAC rules to add to this access control (diff-based update). When the id of an existing WHO ABAC rule is given, that rule is updated in place. Cannot be used together with whoAbacRules.

#### whoAbacRulesToRemove ● [`[ID!]`](/api/graphql/data-access/scalars/id.md) list scalar <a href="#who-abac-rules-to-remove" id="who-abac-rules-to-remove"></a>

The list of WHO ABAC rule ids to remove from this access control (diff-based update). Cannot be used together with whoAbacRules.

#### whoItems ● [`[WhoItemInput!]`](/api/graphql/data-access/input-types/who-item-input.md) list input <a href="#who-items" id="who-items"></a>

The list of static WHO items for this access control. Cannot be used together with whoItemsToAdd or whoItemsToRemove.

#### whoItemsToAdd ● [`[WhoItemInput!]`](/api/graphql/data-access/input-types/who-item-input.md) list input <a href="#who-items-to-add" id="who-items-to-add"></a>

The list of static WHO items to add to this access control (diff-based update). Cannot be used together with whoItems.

#### whoItemsToRemove ● [`[WhoItemRemoveInput!]`](/api/graphql/data-access/input-types/who-item-remove-input.md) list input <a href="#who-items-to-remove" id="who-items-to-remove"></a>

The list of static WHO items to remove from this access control (diff-based update). Cannot be used together with whoItems.

### Member Of

[`createAccessControl`](/api/graphql/data-access/mutations/create-access-control.md) mutation ● `createAccessControlFromAccessRequest` mutation ● [`updateAccessControl`](/api/graphql/data-access/mutations/update-access-control.md) mutation ● `validateAccessControlCreation` query ● `validateAccessControlUpdate` query


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://developer.collibra.com/api/graphql/data-access/input-types/access-control-input.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.