AccessControlInput

Input object for creating and updating access controls.

input AccessControlInput {
  action: AccessControlAction
  category: String
  dataSources: [AccessControlDataSourceInput!]
  description: String
  external: Boolean
  filterCriteria: DataComparisonExpressionInput
  linkedAssetId: ID
  locks: [AccessControlLockDataInput!]
  name: String
  namingHint: String
  policyRule: String
  source: String
  state: AccessControlState
  volatile: Boolean
  whatAbacRules: [WhatAbacRuleInput]
  whatAccessControls: [AccessControlWhatInputAP!]
  whatAccessControlsToAdd: [AccessControlWhatInputAP!]
  whatAccessControlsToRemove: [ID!]
  whatDataObjects: [AccessControlWhatInputDO!]
  whatDataObjectsToAdd: [AccessControlWhatInputDO!]
  whatDataObjectsToRemove: [WhatDataObjectRemoveInput!]
  whoAbacRules: [WhoAbacRuleInput]
  whoItems: [WhoItemInput!]
  whoItemsToAdd: [WhoItemInput!]
  whoItemsToRemove: [WhoItemRemoveInput!]
}

Fields

action ● AccessControlAction enum

Action of the access control to determine if it is a grant, mask, filter or group.

category ● String scalar

In case the access control is a grant (action), this contains the grant category (determining the behavior of the grant).

dataSources ● [AccessControlDataSourceInput!] list input

The data sources that this access control will get deployed to.

description ● String scalar

Detailed description of the access control.

external ● Boolean scalar

Indicates whether the access control is managed externally (in the Data Source) or internally (in the Collibra Data Access application).

filterCriteria ● DataComparisonExpressionInput input

For access controls with action=Filter, this contains the boolean expression determining the filter criteria.

linkedAssetId ● ID scalar

When provided on creation, a role asset link to this Collibra asset is created atomically together with the access control. Only valid for Roles (action=Grant).

locks ● [AccessControlLockDataInput!] list input

The locks that should apply to this access control.

name ● String scalar

Name of the access control.

namingHint ● String scalar

Naming hint for the access control, used for generating the actual names in target systems.

policyRule ● String scalar

The policy rule as a string. This is used only for certain cases, like imported row-level filters and column masks or for row-level filters that are implemented like this.

source ● String scalar

Source defines the source of the access control, if managed by third party tool.

state ● AccessControlState enum

State of the access control.

volatile ● Boolean scalar

Marks this access control as volatile. Cannot be set on Mask or Filter actions.

whatAbacRules ● [WhatAbacRuleInput] list input

The list of ABAC rules for calculating the WHAT items dynamically.

whatAccessControls ● [AccessControlWhatInputAP!] list input

The list of static WHAT access controls for this access control. Cannot be used together with whatAccessControlsToAdd or whatAccessControlsToRemove.

whatAccessControlsToAdd ● [AccessControlWhatInputAP!] list input

The list of static WHAT access controls to add to this access control (diff-based update). Cannot be used together with whatAccessControls.

whatAccessControlsToRemove ● [ID!] list scalar

The list of static WHAT access control IDs to remove from this access control (diff-based update). Cannot be used together with whatAccessControls.

whatDataObjects ● [AccessControlWhatInputDO!] list input

The list of static WHAT data object items for this access control. Cannot be used together with whatDataObjectsToAdd or whatDataObjectsToRemove.

whatDataObjectsToAdd ● [AccessControlWhatInputDO!] list input

The list of static WHAT data objects to add to this access control (diff-based update). Cannot be used together with whatDataObjects.

whatDataObjectsToRemove ● [WhatDataObjectRemoveInput!] list input

The list of static WHAT data objects to remove from this access control (diff-based update). Cannot be used together with whatDataObjects. When permissions and globalPermissions are both omitted, the entire WHAT link is removed. When specific permissions are provided, only those are removed.

whoAbacRules ● [WhoAbacRuleInput] list input

The list of ABAC rules for calculating the WHO items dynamically.

whoItems ● [WhoItemInput!] list input

The list of static WHO items for this access control. Cannot be used together with whoItemsToAdd or whoItemsToRemove.

whoItemsToAdd ● [WhoItemInput!] list input

The list of static WHO items to add to this access control (diff-based update). Cannot be used together with whoItems.

whoItemsToRemove ● [WhoItemRemoveInput!] list input

The list of static WHO items to remove from this access control (diff-based update). Cannot be used together with whoItems.

Member Of

createAccessControl mutation ● createAccessControlFromAccessRequest mutation ● updateAccessControl mutation ● validateAccessControlCreation query ● validateAccessControlUpdate query