AccessControl

Represents an access control object in the system. An access control is the abstract model representing grants, masks, filters and groups (determined by the action field).

type AccessControl {
  abacCalculationStatus: AbacCalculationStatus!
  action: AccessControlAction!
  audit(
    after: String
    filter: AccessControlAuditFilter
    limit: Int
  ): AuditDiffLogConnectionResult!
  availablePromise(entityId: ID): PromiseDetailsResult
  category: GrantCategory
  complete: Boolean
  createdAt: Time!
  dataSources: [DataSource!]
  description: String!
  entityPartOfWho(direct: Boolean, entityId: ID): Boolean
  entityPartOfWhoDetails(direct: Boolean, entityId: ID): AccessWhoItem
  external: Boolean!
  filterCriteria: DataComparisonExpression
  id: ID!
  locks: [AccessControlLockData!]!
  modifiedAt: Time!
  name: String!
  namingHint: String
  notInternalizable: Boolean!
  numberOfDataObjects: Count
  numberOfUnpackedDataObjects: Count
  numberOfWhatAccessControls(
    filter: AccessControlWhatAccessControlFilterInput
  ): Count
  numberOfWho(filter: AccessControlWhoListFilter, unpack: Boolean): Count!
  owners: [RoleAssignmentTo]
  pendingUpdates: Int!
  permissionsOnDataObject(dataObjectId: ID!): AccessPermissionsResult
  policyRule: String
  roleAssetLink: RoleAssetLink
  source: String
  state: AccessControlState!
  syncData: [SyncData!]
  syncStatus: SyncStatus!
  tags(
    after: String
    limit: Int
    order: [TagOrderByInput!]
    search: String
  ): TagConnectionResult!
  validityForAccessControl(accessControl: ID!): Time
  validityForDataObject(dataObject: ID!): Time
  validityForUser(user: ID!): Time
  volatile: Boolean
  whatAbacRules: [WhatAbacRule!]
  whatAbacScope(
    abacRule: String!
    after: String
    limit: Int
    order: [AccessWhatOrderByInput!]
    search: String
  ): DataObjectConnectionResult!
  whatAccessControls(
    after: String
    filter: AccessControlWhatAccessControlFilterInput
    limit: Int
    order: [AccessWhatOrderByInput!]
  ): AccessWhatAccessControlItemConnectionResult!
  whatDataObjects(
    after: String
    filter: AccessWhatFilterInput
    limit: Int
    order: [AccessWhatOrderByInput!]
  ): AccessWhatDataObjectItemConnectionResult!
  whatUnknown: Boolean!
  whatUnpackedDataObjects(
    after: String
    filter: AccessWhatFilterInput
    limit: Int
    order: [AccessWhatOrderByInput!]
  ): AccessWhatDataObjectItemConnectionResult!
  who(
    after: String
    filter: AccessControlWhoListFilter
    limit: Int
    order: [AccessControlWhoOrderByInput!]
    unpack: Boolean
  ): AccessWhoItemConnectionResult!
  whoAbacRules: [WhoAbacRule!]
  whoUnknown: Boolean!
}

Fields

abacCalculationStatus ● AbacCalculationStatus! non-null enum

Aggregated ABAC recalculation status across the WHO and WHAT scopes. Returns NotApplicable for external access controls or access controls without ABAC rules.

action ● AccessControlAction! non-null enum

Action of the access control to determine if it is a grant, mask, filter or group.

audit ● AuditDiffLogConnectionResult! non-null union

Retrieves the audit log entries for this access control.

after ● String scalar

filter ● AccessControlAuditFilter input

limit ● Int scalar

availablePromise ● PromiseDetailsResult union

Returns true if there is an available promise for the given entity on this access control. If entityId is not set, the current user will be used.

entityId ● ID scalar

category ● GrantCategory object

In case the access control is a grant (action), this contains the grant category (determining the behavior of the grant).

complete ● Boolean scalar

Indicates if this external access control is complete, meaning that all linked entities are knows in Collibra Data Access. If an imported access control is incomplete, information will be lost when internalizing the access control, because only the known entities will be kept.

createdAt ● Time! non-null scalar

Timestamp when the access control was created.

dataSources ● [DataSource!] list object

Retrieves the data sources that this access control will get deployed to.

description ● String! non-null scalar

Detailed description of the access control.

entityPartOfWho ● Boolean scalar

Returns true is the given entity is part of the WHO items of this access control (excluding promises). If entityId is not set, the current user will be used.

direct ● Boolean scalar

entityId ● ID scalar

entityPartOfWhoDetails ● AccessWhoItem object

Returns details about the given entity being part of the WHO items of this access control (excluding promises). If entityId is not set, the current user will be used.

direct ● Boolean scalar

entityId ● ID scalar

external ● Boolean! non-null scalar

Indicates whether the access control is managed externally (in the Data Source) or internally (in the Collibra Data Access application).

filterCriteria ● DataComparisonExpression union

For access controls with action=Filter, this contains the boolean expression determining the filter criteria.

id ● ID! non-null scalar

Unique identifier of the access control.

locks ● [AccessControlLockData!]! non-null object

The list of locks that are configured on this access control. Locks can be used to prevent editing certain parts of the access control, typically because they are managed outside of Collibra Data Access and so should be imported from instead of exported to the data source).

modifiedAt ● Time! non-null scalar

Timestamp when the access control was last modified.

name ● String! non-null scalar

Name of the access control.

namingHint ● String scalar

Naming hint for the access control, used for generating the actual names in target systems.

notInternalizable ● Boolean! non-null scalar

For externally managed access controls, indicates whether the access control cannot be internalized.

numberOfDataObjects ● Count object

Retrieves the number of WHAT data objects which are directly linked to this access control. Data Objects related through ABAC rules are excluded.

numberOfUnpackedDataObjects ● Count object

Retrieves the number of WHAT data objects which are linked to this access control either directly or through inheritance from downstream grants. Data Objects related through ABAC rules are included.

numberOfWhatAccessControls ● Count object

Retrieves the number of access controls which are in the WHAT list of this access control.

filter ● AccessControlWhatAccessControlFilterInput input

numberOfWho ● Count! non-null object

Retrieves the number of WHO items for this access control. When unpack is set to true, this will return the number of (unique) users that are part of the WHO items, including those coming through inheritance of upstream grants and groups). When unpacking, deleted/inactive access controls in the inheritance chain never propagate access and are always skipped. By default, access controls whose type is not Grant, GrantVariation or Group (i.e. Mask, Filter, FilterRule) are also skipped.

filter ● AccessControlWhoListFilter input

unpack ● Boolean scalar

owners ● [RoleAssignmentTo] list union

Retrieves the owners of this access control.

pendingUpdates ● Int! non-null scalar

For large updates to the access control, some changes may be handled asynchronously in the background. This field indicates the number of pending updates still being processed.

permissionsOnDataObject ● AccessPermissionsResult union

Retrieves the permissions this access control (grant) provides on a specific data object.

dataObjectId ● ID! non-null scalar

policyRule ● String scalar

The policy rule as a string. This is used only for certain cases, like imported row-level filters and column masks or for row-level filters that are implemented like this.

roleAssetLink ● RoleAssetLink object

The linked Collibra asset (e.g. Data Product Port, Data Set) associated with this access control.

source ● String scalar

Source defines the source of the access control, if managed by third party tool.

state ● AccessControlState! non-null enum

State of the access control.

syncData ● [SyncData!] list object

Retrieves synchronization information for each linked data source.

syncStatus ● SyncStatus! non-null enum

Retrieves the aggregated sync status for this access control across all linked data sources.

tags ● TagConnectionResult! non-null union

Retrieves the tags linked to this access control.

after ● String scalar

limit ● Int scalar

order ● [TagOrderByInput!] list input

search ● String scalar

validityForAccessControl ● Time scalar

Retrieves the validity date for a specific access control in the WHO items of this access control.

accessControl ● ID! non-null scalar

validityForDataObject ● Time scalar

Get the validity date for a specific data object in the WHAT items of this access control.. This only works for grants of category Direct Access.

dataObject ● ID! non-null scalar

validityForUser ● Time scalar

Retrieves the validity date for a specific user in the WHO items of this access control.

user ● ID! non-null scalar

volatile ● Boolean scalar

When true, the access control is eligible for automatic soft-deletion once its last static WHO-link is removed. Cannot be set on Mask or Filter actions.

whatAbacRules ● [WhatAbacRule!] list object

The list of ABAC rules for calculating the WHAT items dynamically.

whatAbacScope ● DataObjectConnectionResult! non-null union

Retrieves the scope Data Objects for a specific WHAT ABAC rule.

abacRule ● String! non-null scalar

after ● String scalar

limit ● Int scalar

order ● [AccessWhatOrderByInput!] list input

search ● String scalar

whatAccessControls ● AccessWhatAccessControlItemConnectionResult! non-null union

Retrieves the access controls which are in the WHAT list of this access control. This basically means that this access control is in the WHO list of those access controls.

after ● String scalar

filter ● AccessControlWhatAccessControlFilterInput input

limit ● Int scalar

order ● [AccessWhatOrderByInput!] list input

whatDataObjects ● AccessWhatDataObjectItemConnectionResult! non-null union

Retrieves the WHAT data objects which are directly linked to this access control.

after ● String scalar

filter ● AccessWhatFilterInput input

limit ● Int scalar

order ● [AccessWhatOrderByInput!] list input

whatUnknown ● Boolean! non-null scalar

If true, it indicates that the what of this access control couldn't be parsed on import

whatUnpackedDataObjects ● AccessWhatDataObjectItemConnectionResult! non-null union

Retrieves the WHAT data objects which are linked to this access control either directly or through inheritance from downstream grants.

after ● String scalar

filter ● AccessWhatFilterInput input

limit ● Int scalar

order ● [AccessWhatOrderByInput!] list input

who ● AccessWhoItemConnectionResult! non-null union

Retrieves the WHO items for this access control. When unpack is set to true, this will return all the users that are part of the WHO items, including those coming through inheritance (of grants or groups). When unpacking, deleted/inactive access controls in the inheritance chain never propagate access and are always skipped. By default, access controls whose type is not Grant, GrantVariation or Group (i.e. Mask, Filter, FilterRule) are also skipped.

after ● String scalar

filter ● AccessControlWhoListFilter input

limit ● Int scalar

order ● [AccessControlWhoOrderByInput!] list input

unpack ● Boolean scalar

whoAbacRules ● [WhoAbacRule!] list object

The list of ABAC rules for calculating the WHO items dynamically.

whoUnknown ● Boolean! non-null scalar

If true, it indicates that the who of this access control couldn't be parsed on import

Member Of

AccessControlEdge object ● AccessControlFilterDetail object ● AccessControlFilterGroup object ● AccessControlFromAccessRequest object ● AccessControlMaskDetail object ● AccessControlWithOptionalAccessRequests object ● AccessWhatAccessControlItem object ● Attestation object ● DataObjectAccessibilityInformation object ● GroupedDataAccessReturnItem object ● GroupedUserAccessReturnItem object ● PromiseDetails object

Implemented By

AccessControlMatchSideEffectWhoItem union ● AccessControlResult union ● AccessControlWithOptionalAccessRequestsResult union ● AccessRequestAssigneeIdentity union ● AccessRequestStepResult union ● AccessWhoItemItem union ● GraphItem union ● IssueEntity union ● NextHopToUserResult union ● RoleAssignmentOn union ● RoleAssignmentTo union ● SearchItem union