> For the complete documentation index, see [llms.txt](https://developer.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.collibra.com/api/graphql/data-access/input-types/access-control-input.md).

# AccessControlInput

Input object for creating and updating access controls.

```graphql
input AccessControlInput {
  action: AccessControlAction
  category: String
  dataSources: [AccessControlDataSourceInput!]
  description: String
  external: Boolean
  filterCriteria: DataComparisonExpressionInput
  linkedAssetId: ID
  locks: [AccessControlLockDataInput!]
  name: String
  namingHint: String
  policyRule: String
  source: String
  state: AccessControlState
  volatile: Boolean
  whatAbacRules: [WhatAbacRuleInput]
  whatAccessControls: [AccessControlWhatInputAP!]
  whatAccessControlsToAdd: [AccessControlWhatInputAP!]
  whatAccessControlsToRemove: [ID!]
  whatDataObjects: [AccessControlWhatInputDO!]
  whatDataObjectsToAdd: [AccessControlWhatInputDO!]
  whatDataObjectsToRemove: [WhatDataObjectRemoveInput!]
  whoAbacRules: [WhoAbacRuleInput]
  whoItems: [WhoItemInput!]
  whoItemsToAdd: [WhoItemInput!]
  whoItemsToRemove: [WhoItemRemoveInput!]
}
```

### Fields

#### action ● [`AccessControlAction`](/api/graphql/data-access/enumerations/access-control-action.md) enum <a href="#action" id="action"></a>

Action of the access control to determine if it is a grant, mask, filter or group.

#### category ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#category" id="category"></a>

In case the access control is a grant (action), this contains the grant category (determining the behavior of the grant).

#### dataSources ● [`[AccessControlDataSourceInput!]`](/api/graphql/data-access/input-types/access-control-data-source-input.md) list input <a href="#data-sources" id="data-sources"></a>

The data sources that this access control will get deployed to.

#### description ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#description" id="description"></a>

Detailed description of the access control.

#### external ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#external" id="external"></a>

Indicates whether the access control is managed externally (in the Data Source) or internally (in the Collibra Data Access application).

#### filterCriteria ● [`DataComparisonExpressionInput`](/api/graphql/data-access/input-types/data-comparison-expression-input.md) input <a href="#filter-criteria" id="filter-criteria"></a>

For access controls with `action=Filter`, this contains the boolean expression determining the filter criteria.

#### linkedAssetId ● [`ID`](/api/graphql/data-access/scalars/id.md) scalar <a href="#linked-asset-id" id="linked-asset-id"></a>

When provided on creation, a role asset link to this Collibra asset is created atomically together with the access control. Only valid for Roles (action=Grant).

#### locks ● [`[AccessControlLockDataInput!]`](/api/graphql/data-access/input-types/access-control-lock-data-input.md) list input <a href="#locks" id="locks"></a>

The locks that should apply to this access control.

#### name ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#name" id="name"></a>

Name of the access control.

#### namingHint ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#naming-hint" id="naming-hint"></a>

Naming hint for the access control, used for generating the actual names in target systems.

#### policyRule ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#policy-rule" id="policy-rule"></a>

The policy rule as a string. This is used only for certain cases, like imported row-level filters and column masks or for row-level filters that are implemented like this.

#### source ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#source" id="source"></a>

Source defines the source of the access control, if managed by third party tool.

#### state ● [`AccessControlState`](/api/graphql/data-access/enumerations/access-control-state.md) enum <a href="#state" id="state"></a>

State of the access control.

#### volatile ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#volatile" id="volatile"></a>

Marks this access control as volatile. Cannot be set on Mask or Filter actions.

#### whatAbacRules ● [`[WhatAbacRuleInput]`](/api/graphql/data-access/input-types/what-abac-rule-input.md) list input <a href="#what-abac-rules" id="what-abac-rules"></a>

The list of ABAC rules for calculating the WHAT items dynamically.

#### whatAccessControls ● [`[AccessControlWhatInputAP!]`](/api/graphql/data-access/input-types/access-control-what-input-ap.md) list input <a href="#what-access-controls" id="what-access-controls"></a>

The list of static WHAT access controls for this access control. Cannot be used together with whatAccessControlsToAdd or whatAccessControlsToRemove.

#### whatAccessControlsToAdd ● [`[AccessControlWhatInputAP!]`](/api/graphql/data-access/input-types/access-control-what-input-ap.md) list input <a href="#what-access-controls-to-add" id="what-access-controls-to-add"></a>

The list of static WHAT access controls to add to this access control (diff-based update). Cannot be used together with whatAccessControls.

#### whatAccessControlsToRemove ● [`[ID!]`](/api/graphql/data-access/scalars/id.md) list scalar <a href="#what-access-controls-to-remove" id="what-access-controls-to-remove"></a>

The list of static WHAT access control IDs to remove from this access control (diff-based update). Cannot be used together with whatAccessControls.

#### whatDataObjects ● [`[AccessControlWhatInputDO!]`](/api/graphql/data-access/input-types/access-control-what-input-do.md) list input <a href="#what-data-objects" id="what-data-objects"></a>

The list of static WHAT data object items for this access control. Cannot be used together with whatDataObjectsToAdd or whatDataObjectsToRemove.

#### whatDataObjectsToAdd ● [`[AccessControlWhatInputDO!]`](/api/graphql/data-access/input-types/access-control-what-input-do.md) list input <a href="#what-data-objects-to-add" id="what-data-objects-to-add"></a>

The list of static WHAT data objects to add to this access control (diff-based update). Cannot be used together with whatDataObjects.

#### whatDataObjectsToRemove ● [`[WhatDataObjectRemoveInput!]`](/api/graphql/data-access/input-types/what-data-object-remove-input.md) list input <a href="#what-data-objects-to-remove" id="what-data-objects-to-remove"></a>

The list of static WHAT data objects to remove from this access control (diff-based update). Cannot be used together with whatDataObjects. When permissions and globalPermissions are both omitted, the entire WHAT link is removed. When specific permissions are provided, only those are removed.

#### whoAbacRules ● [`[WhoAbacRuleInput]`](/api/graphql/data-access/input-types/who-abac-rule-input.md) list input <a href="#who-abac-rules" id="who-abac-rules"></a>

The list of ABAC rules for calculating the WHO items dynamically.

#### whoItems ● [`[WhoItemInput!]`](/api/graphql/data-access/input-types/who-item-input.md) list input <a href="#who-items" id="who-items"></a>

The list of static WHO items for this access control. Cannot be used together with whoItemsToAdd or whoItemsToRemove.

#### whoItemsToAdd ● [`[WhoItemInput!]`](/api/graphql/data-access/input-types/who-item-input.md) list input <a href="#who-items-to-add" id="who-items-to-add"></a>

The list of static WHO items to add to this access control (diff-based update). Cannot be used together with whoItems.

#### whoItemsToRemove ● [`[WhoItemRemoveInput!]`](/api/graphql/data-access/input-types/who-item-remove-input.md) list input <a href="#who-items-to-remove" id="who-items-to-remove"></a>

The list of static WHO items to remove from this access control (diff-based update). Cannot be used together with whoItems.

### Member Of

[`createAccessControl`](/api/graphql/data-access/mutations/create-access-control.md) mutation ● `createAccessControlFromAccessRequest` mutation ● [`updateAccessControl`](/api/graphql/data-access/mutations/update-access-control.md) mutation ● `validateAccessControlCreation` query ● `validateAccessControlUpdate` query