> For the complete documentation index, see [llms.txt](https://developer.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.collibra.com/api/graphql/data-access/object-types/access-control.md).

# AccessControl

Represents an access control object in the system. An access control is the abstract model representing grants, masks, filters and groups (determined by the `action` field).

```graphql
type AccessControl {
  abacCalculationStatus: AbacCalculationStatus!
  action: AccessControlAction!
  audit(
    after: String
    filter: AccessControlAuditFilter
    limit: Int
  ): AuditDiffLogConnectionResult!
  availablePromise(entityId: ID): PromiseDetailsResult
  category: GrantCategory
  complete: Boolean
  createdAt: Time!
  dataSources: [DataSource!]
  description: String!
  entityPartOfWho(direct: Boolean, entityId: ID): Boolean
  entityPartOfWhoDetails(direct: Boolean, entityId: ID): AccessWhoItem
  external: Boolean!
  filterCriteria: DataComparisonExpression
  id: ID!
  locks: [AccessControlLockData!]!
  modifiedAt: Time!
  name: String!
  namingHint: String
  notInternalizable: Boolean!
  numberOfDataObjects: Count
  numberOfUnpackedDataObjects: Count
  numberOfWhatAccessControls(
    filter: AccessControlWhatAccessControlFilterInput
  ): Count
  numberOfWho(filter: AccessControlWhoListFilter, unpack: Boolean): Count!
  owners: [RoleAssignmentTo]
  pendingUpdates: Int!
  permissionsOnDataObject(dataObjectId: ID!): AccessPermissionsResult
  policyRule: String
  roleAssetLink: RoleAssetLink
  source: String
  state: AccessControlState!
  syncData: [SyncData!]
  syncStatus: SyncStatus!
  tags(
    after: String
    limit: Int
    order: [TagOrderByInput!]
    search: String
  ): TagConnectionResult!
  validityForAccessControl(accessControl: ID!): Time
  validityForDataObject(dataObject: ID!): Time
  validityForUser(user: ID!): Time
  volatile: Boolean
  whatAbacRules: [WhatAbacRule!]
  whatAbacScope(
    abacRule: String!
    after: String
    limit: Int
    order: [AccessWhatOrderByInput!]
    search: String
  ): DataObjectConnectionResult!
  whatAccessControls(
    after: String
    filter: AccessControlWhatAccessControlFilterInput
    limit: Int
    order: [AccessWhatOrderByInput!]
  ): AccessWhatAccessControlItemConnectionResult!
  whatDataObjects(
    after: String
    filter: AccessWhatFilterInput
    limit: Int
    order: [AccessWhatOrderByInput!]
  ): AccessWhatDataObjectItemConnectionResult!
  whatUnknown: Boolean!
  whatUnpackedDataObjects(
    after: String
    filter: AccessWhatFilterInput
    limit: Int
    order: [AccessWhatOrderByInput!]
  ): AccessWhatDataObjectItemConnectionResult!
  who(
    after: String
    filter: AccessControlWhoListFilter
    limit: Int
    order: [AccessControlWhoOrderByInput!]
    unpack: Boolean
  ): AccessWhoItemConnectionResult!
  whoAbacRules: [WhoAbacRule!]
  whoUnknown: Boolean!
}
```

### Fields

#### abacCalculationStatus ● [`AbacCalculationStatus!`](/api/graphql/data-access/enumerations/abac-calculation-status.md) non-null enum <a href="#abac-calculation-status" id="abac-calculation-status"></a>

Aggregated ABAC recalculation status across the WHO and WHAT scopes. Returns NotApplicable for external access controls or access controls without ABAC rules.

#### action ● [`AccessControlAction!`](/api/graphql/data-access/enumerations/access-control-action.md) non-null enum <a href="#action" id="action"></a>

Action of the access control to determine if it is a grant, mask, filter or group.

#### audit ● `AuditDiffLogConnectionResult!` non-null union <a href="#audit" id="audit"></a>

Retrieves the audit log entries for this access control.

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**filter ● `AccessControlAuditFilter` input**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

#### availablePromise ● [`PromiseDetailsResult`](/api/graphql/data-access/unions/promise-details-result.md) union <a href="#available-promise" id="available-promise"></a>

Returns true if there is an available promise for the given entity on this access control. If entityId is not set, the current user will be used.

**entityId ●** [**`ID`**](/api/graphql/data-access/scalars/id.md) **scalar**

#### category ● [`GrantCategory`](/api/graphql/data-access/object-types/grant-category.md) object <a href="#category" id="category"></a>

In case the access control is a grant (action), this contains the grant category (determining the behavior of the grant).

#### complete ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#complete" id="complete"></a>

Indicates if this external access control is complete, meaning that all linked entities are knows in Collibra Data Access. If an imported access control is incomplete, information will be lost when internalizing the access control, because only the known entities will be kept.

#### createdAt ● [`Time!`](/api/graphql/data-access/scalars/time.md) non-null scalar <a href="#created-at" id="created-at"></a>

Timestamp when the access control was created.

#### dataSources ● [`[DataSource!]`](/api/graphql/data-access/object-types/data-source.md) list object <a href="#data-sources" id="data-sources"></a>

Retrieves the data sources that this access control will get deployed to.

#### description ● [`String!`](/api/graphql/data-access/scalars/string.md) non-null scalar <a href="#description" id="description"></a>

Detailed description of the access control.

#### entityPartOfWho ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#entity-part-of-who" id="entity-part-of-who"></a>

Returns true is the given entity is part of the WHO items of this access control (excluding promises). If entityId is not set, the current user will be used.

**direct ●** [**`Boolean`**](/api/graphql/data-access/scalars/boolean.md) **scalar**

**entityId ●** [**`ID`**](/api/graphql/data-access/scalars/id.md) **scalar**

#### entityPartOfWhoDetails ● [`AccessWhoItem`](/api/graphql/data-access/object-types/access-who-item.md) object <a href="#entity-part-of-who-details" id="entity-part-of-who-details"></a>

Returns details about the given entity being part of the WHO items of this access control (excluding promises). If entityId is not set, the current user will be used.

**direct ●** [**`Boolean`**](/api/graphql/data-access/scalars/boolean.md) **scalar**

**entityId ●** [**`ID`**](/api/graphql/data-access/scalars/id.md) **scalar**

#### external ● [`Boolean!`](/api/graphql/data-access/scalars/boolean.md) non-null scalar <a href="#external" id="external"></a>

Indicates whether the access control is managed externally (in the Data Source) or internally (in the Collibra Data Access application).

#### filterCriteria ● [`DataComparisonExpression`](/api/graphql/data-access/unions/data-comparison-expression.md) union <a href="#filter-criteria" id="filter-criteria"></a>

For access controls with `action=Filter`, this contains the boolean expression determining the filter criteria.

#### id ● [`ID!`](/api/graphql/data-access/scalars/id.md) non-null scalar <a href="#id" id="id"></a>

Unique identifier of the access control.

#### locks ● [`[AccessControlLockData!]!`](/api/graphql/data-access/object-types/access-control-lock-data.md) non-null object <a href="#locks" id="locks"></a>

The list of locks that are configured on this access control. Locks can be used to prevent editing certain parts of the access control, typically because they are managed outside of Collibra Data Access and so should be imported from instead of exported to the data source).

#### modifiedAt ● [`Time!`](/api/graphql/data-access/scalars/time.md) non-null scalar <a href="#modified-at" id="modified-at"></a>

Timestamp when the access control was last modified.

#### name ● [`String!`](/api/graphql/data-access/scalars/string.md) non-null scalar <a href="#name" id="name"></a>

Name of the access control.

#### namingHint ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#naming-hint" id="naming-hint"></a>

Naming hint for the access control, used for generating the actual names in target systems.

#### notInternalizable ● [`Boolean!`](/api/graphql/data-access/scalars/boolean.md) non-null scalar <a href="#not-internalizable" id="not-internalizable"></a>

For externally managed access controls, indicates whether the access control cannot be internalized.

#### numberOfDataObjects ● [`Count`](/api/graphql/data-access/object-types/count.md) object <a href="#number-of-data-objects" id="number-of-data-objects"></a>

Retrieves the number of WHAT data objects which are directly linked to this access control. Data Objects related through ABAC rules are excluded.

#### numberOfUnpackedDataObjects ● [`Count`](/api/graphql/data-access/object-types/count.md) object <a href="#number-of-unpacked-data-objects" id="number-of-unpacked-data-objects"></a>

Retrieves the number of WHAT data objects which are linked to this access control either directly or through inheritance from downstream grants. Data Objects related through ABAC rules are included.

#### numberOfWhatAccessControls ● [`Count`](/api/graphql/data-access/object-types/count.md) object <a href="#number-of-what-access-controls" id="number-of-what-access-controls"></a>

Retrieves the number of access controls which are in the WHAT list of this access control.

**filter ●** [**`AccessControlWhatAccessControlFilterInput`**](/api/graphql/data-access/input-types/access-control-what-access-control-filter-input.md) **input**

#### numberOfWho ● [`Count!`](/api/graphql/data-access/object-types/count.md) non-null object <a href="#number-of-who" id="number-of-who"></a>

Retrieves the number of WHO items for this access control. When `unpack` is set to true, this will return the number of (unique) users that are part of the WHO items, including those coming through inheritance of upstream grants and groups). When unpacking, deleted/inactive access controls in the inheritance chain never propagate access and are always skipped. By default, access controls whose type is not Grant, GrantVariation or Group (i.e. Mask, Filter, FilterRule) are also skipped.

**filter ●** [**`AccessControlWhoListFilter`**](/api/graphql/data-access/input-types/access-control-who-list-filter.md) **input**

**unpack ●** [**`Boolean`**](/api/graphql/data-access/scalars/boolean.md) **scalar**

#### owners ● [`[RoleAssignmentTo]`](/api/graphql/data-access/unions/role-assignment-to.md) list union <a href="#owners" id="owners"></a>

Retrieves the owners of this access control.

#### pendingUpdates ● [`Int!`](/api/graphql/data-access/scalars/int.md) non-null scalar <a href="#pending-updates" id="pending-updates"></a>

For large updates to the access control, some changes may be handled asynchronously in the background. This field indicates the number of pending updates still being processed.

#### permissionsOnDataObject ● [`AccessPermissionsResult`](/api/graphql/data-access/unions/access-permissions-result.md) union <a href="#permissions-on-data-object" id="permissions-on-data-object"></a>

Retrieves the permissions this access control (grant) provides on a specific data object.

**dataObjectId ●** [**`ID!`**](/api/graphql/data-access/scalars/id.md) **non-null scalar**

#### policyRule ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#policy-rule" id="policy-rule"></a>

The policy rule as a string. This is used only for certain cases, like imported row-level filters and column masks or for row-level filters that are implemented like this.

#### roleAssetLink ● [`RoleAssetLink`](/api/graphql/data-access/object-types/role-asset-link.md) object <a href="#role-asset-link" id="role-asset-link"></a>

The linked Collibra asset (e.g. Data Product Port, Data Set) associated with this access control.

#### source ● [`String`](/api/graphql/data-access/scalars/string.md) scalar <a href="#source" id="source"></a>

Source defines the source of the access control, if managed by third party tool.

#### state ● [`AccessControlState!`](/api/graphql/data-access/enumerations/access-control-state.md) non-null enum <a href="#state" id="state"></a>

State of the access control.

#### syncData ● [`[SyncData!]`](/api/graphql/data-access/object-types/sync-data.md) list object <a href="#sync-data" id="sync-data"></a>

Retrieves synchronization information for each linked data source.

#### syncStatus ● [`SyncStatus!`](/api/graphql/data-access/enumerations/sync-status.md) non-null enum <a href="#sync-status" id="sync-status"></a>

Retrieves the aggregated sync status for this access control across all linked data sources.

#### tags ● [`TagConnectionResult!`](/api/graphql/data-access/unions/tag-connection-result.md) non-null union <a href="#tags" id="tags"></a>

Retrieves the tags linked to this access control.

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

**order ●** [**`[TagOrderByInput!]`**](/api/graphql/data-access/input-types/tag-order-by-input.md) **list input**

**search ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

#### validityForAccessControl ● [`Time`](/api/graphql/data-access/scalars/time.md) scalar <a href="#validity-for-access-control" id="validity-for-access-control"></a>

Retrieves the validity date for a specific access control in the WHO items of this access control.

**accessControl ●** [**`ID!`**](/api/graphql/data-access/scalars/id.md) **non-null scalar**

#### validityForDataObject ● [`Time`](/api/graphql/data-access/scalars/time.md) scalar <a href="#validity-for-data-object" id="validity-for-data-object"></a>

Get the validity date for a specific data object in the WHAT items of this access control.. This only works for grants of category Direct Access.

**dataObject ●** [**`ID!`**](/api/graphql/data-access/scalars/id.md) **non-null scalar**

#### validityForUser ● [`Time`](/api/graphql/data-access/scalars/time.md) scalar <a href="#validity-for-user" id="validity-for-user"></a>

Retrieves the validity date for a specific user in the WHO items of this access control.

**user ●** [**`ID!`**](/api/graphql/data-access/scalars/id.md) **non-null scalar**

#### volatile ● [`Boolean`](/api/graphql/data-access/scalars/boolean.md) scalar <a href="#volatile" id="volatile"></a>

When true, the access control is eligible for automatic soft-deletion once its last static WHO-link is removed. Cannot be set on Mask or Filter actions.

#### whatAbacRules ● [`[WhatAbacRule!]`](/api/graphql/data-access/object-types/what-abac-rule.md) list object <a href="#what-abac-rules" id="what-abac-rules"></a>

The list of ABAC rules for calculating the WHAT items dynamically.

#### whatAbacScope ● [`DataObjectConnectionResult!`](/api/graphql/data-access/unions/data-object-connection-result.md) non-null union <a href="#what-abac-scope" id="what-abac-scope"></a>

Retrieves the scope Data Objects for a specific WHAT ABAC rule.

**abacRule ●** [**`String!`**](/api/graphql/data-access/scalars/string.md) **non-null scalar**

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

**order ●** [**`[AccessWhatOrderByInput!]`**](/api/graphql/data-access/input-types/access-what-order-by-input.md) **list input**

**search ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

#### whatAccessControls ● [`AccessWhatAccessControlItemConnectionResult!`](/api/graphql/data-access/unions/access-what-access-control-item-connection-result.md) non-null union <a href="#what-access-controls" id="what-access-controls"></a>

Retrieves the access controls which are in the WHAT list of this access control. This basically means that this access control is in the WHO list of those access controls.

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**filter ●** [**`AccessControlWhatAccessControlFilterInput`**](/api/graphql/data-access/input-types/access-control-what-access-control-filter-input.md) **input**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

**order ●** [**`[AccessWhatOrderByInput!]`**](/api/graphql/data-access/input-types/access-what-order-by-input.md) **list input**

#### whatDataObjects ● [`AccessWhatDataObjectItemConnectionResult!`](/api/graphql/data-access/unions/access-what-data-object-item-connection-result.md) non-null union <a href="#what-data-objects" id="what-data-objects"></a>

Retrieves the WHAT data objects which are directly linked to this access control.

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**filter ●** [**`AccessWhatFilterInput`**](/api/graphql/data-access/input-types/access-what-filter-input.md) **input**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

**order ●** [**`[AccessWhatOrderByInput!]`**](/api/graphql/data-access/input-types/access-what-order-by-input.md) **list input**

#### whatUnknown ● [`Boolean!`](/api/graphql/data-access/scalars/boolean.md) non-null scalar <a href="#what-unknown" id="what-unknown"></a>

If true, it indicates that the what of this access control couldn't be parsed on import

#### whatUnpackedDataObjects ● [`AccessWhatDataObjectItemConnectionResult!`](/api/graphql/data-access/unions/access-what-data-object-item-connection-result.md) non-null union <a href="#what-unpacked-data-objects" id="what-unpacked-data-objects"></a>

Retrieves the WHAT data objects which are linked to this access control either directly or through inheritance from downstream grants.

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**filter ●** [**`AccessWhatFilterInput`**](/api/graphql/data-access/input-types/access-what-filter-input.md) **input**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

**order ●** [**`[AccessWhatOrderByInput!]`**](/api/graphql/data-access/input-types/access-what-order-by-input.md) **list input**

#### who ● [`AccessWhoItemConnectionResult!`](/api/graphql/data-access/unions/access-who-item-connection-result.md) non-null union <a href="#who" id="who"></a>

Retrieves the WHO items for this access control. When `unpack` is set to true, this will return all the users that are part of the WHO items, including those coming through inheritance (of grants or groups). When unpacking, deleted/inactive access controls in the inheritance chain never propagate access and are always skipped. By default, access controls whose type is not Grant, GrantVariation or Group (i.e. Mask, Filter, FilterRule) are also skipped.

**after ●** [**`String`**](/api/graphql/data-access/scalars/string.md) **scalar**

**filter ●** [**`AccessControlWhoListFilter`**](/api/graphql/data-access/input-types/access-control-who-list-filter.md) **input**

**limit ●** [**`Int`**](/api/graphql/data-access/scalars/int.md) **scalar**

**order ●** [**`[AccessControlWhoOrderByInput!]`**](/api/graphql/data-access/input-types/access-control-who-order-by-input.md) **list input**

**unpack ●** [**`Boolean`**](/api/graphql/data-access/scalars/boolean.md) **scalar**

#### whoAbacRules ● [`[WhoAbacRule!]`](/api/graphql/data-access/object-types/who-abac-rule.md) list object <a href="#who-abac-rules" id="who-abac-rules"></a>

The list of ABAC rules for calculating the WHO items dynamically.

#### whoUnknown ● [`Boolean!`](/api/graphql/data-access/scalars/boolean.md) non-null scalar <a href="#who-unknown" id="who-unknown"></a>

If true, it indicates that the who of this access control couldn't be parsed on import

### Member Of

[`AccessControlEdge`](/api/graphql/data-access/object-types/access-control-edge.md) object ● `AccessControlFilterDetail` object ● `AccessControlFilterGroup` object ● [`AccessControlFromAccessRequest`](/api/graphql/data-access/object-types/access-control-from-access-request.md) object ● `AccessControlMaskDetail` object ● [`AccessControlWithOptionalAccessRequests`](/api/graphql/data-access/object-types/access-control-with-optional-access-requests.md) object ● [`AccessWhatAccessControlItem`](/api/graphql/data-access/object-types/access-what-access-control-item.md) object ● `Attestation` object ● `DataObjectAccessibilityInformation` object ● [`GroupedDataAccessReturnItem`](/api/graphql/data-access/object-types/grouped-data-access-return-item.md) object ● [`GroupedUserAccessReturnItem`](/api/graphql/data-access/object-types/grouped-user-access-return-item.md) object ● `PromiseDetails` object

### Implemented By

[`AccessControlMatchSideEffectWhoItem`](/api/graphql/data-access/unions/access-control-match-side-effect-who-item.md) union ● [`AccessControlResult`](/api/graphql/data-access/unions/access-control-result.md) union ● [`AccessControlWithOptionalAccessRequestsResult`](/api/graphql/data-access/unions/access-control-with-optional-access-requests-result.md) union ● [`AccessRequestAssigneeIdentity`](/api/graphql/data-access/unions/access-request-assignee-identity.md) union ● [`AccessRequestStepResult`](/api/graphql/data-access/unions/access-request-step-result.md) union ● [`AccessWhoItemItem`](/api/graphql/data-access/unions/access-who-item-item.md) union ● `GraphItem` union ● [`IssueEntity`](/api/graphql/data-access/unions/issue-entity.md) union ● [`NextHopToUserResult`](/api/graphql/data-access/unions/next-hop-to-user-result.md) union ● [`RoleAssignmentOn`](/api/graphql/data-access/unions/role-assignment-on.md) union ● [`RoleAssignmentTo`](/api/graphql/data-access/unions/role-assignment-to.md) union ● [`SearchItem`](/api/graphql/data-access/unions/search-item.md) union