Skip to content

added granular RBAC privileges #479

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rani2655 wants to merge 4 commits into
base: 26.7.0.cl
Choose a base branch
from
Open

added granular RBAC privileges #479

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ce9d71a
added granular RBAC privileges
rani2655 Jun 25, 2026
2473acb
added granular RBAC privileges
rani2655 Jun 25, 2026
2f7c09d
feedback edits
rani2655 Jun 25, 2026
751cf95
feedback edits
rani2655 Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions modules/ROOT/pages/data-report-v2-api.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ ThoughtSpot provides the following REST API v2 endpoints to fetch data:
* xref:#_fetch_liveboard_api[`POST /api/rest/2.0/metadata/liveboard/data`] to get data from a Liveboard.
* xref:#_fetch_answer_data_api[`POST /api/rest/2.0/metadata/answer/data`] to get data from a saved Answer.

#If Role-Based Access Control (RBAC) is enabled, the `DATADOWNLOADING` (Can download Data) privilege is required to use these APIs. Alternatively, if the granular data download RBAC privileges are enabled for your ThoughtSpot instance, the `CAN_DOWNLOAD_DETAILED_DATA` (Can download detailed data) is required.#

=== Search data API

The `/api/rest/2.0/searchdata` endpoint requires you to specify the data source object ID and a query string for a successful API call. You can also define additional parameters such as `runtime_filter`, `runtime_sort`, and `runtime_param_override` to apply runtime overrides on the data set.
Expand Down Expand Up @@ -231,6 +233,8 @@ To download a personalized view of the Liveboard, specify the view name in the `
* The downloadable file returned in API response file is extensionless. You need to rename the downloaded file by typing in the relevant extension.
* If the Liveboard includes Note tiles, ensure that you do not pass the GUID of Note tiles as `visualization_identifiers` in the API request. Attempting to do so will lead to an error, and the API will return 400 error code in response.
* Attempting to override existing filter values with runtime filters while exporting a Liveboard will result in an error.
* #If Role-Based Access Control (RBAC) is enabled, `DATADOWNLOADING` (Can download Data) privilege is required for Liveboard exports.#
* #If the granular Role-Based Access Control (RBAC) is enabled, the `CAN_DOWNLOAD_DETAILED_DATA` (Can download detailed data) privilege is required to export in the XLSX or CSV formats, and the `CAN_DOWNLOAD_VISUALS` (Can download visuals) privilege is required for PDF or PNG exports. In this case the `DATADOWNLOADING` privilege ceases to exist#
====

==== File Formats
Expand Down Expand Up @@ -461,6 +465,12 @@ In the request body, specify the GUID or name of the Answer object as `metadata_

The API supports exporting saved Answers, pinned Answers from a Liveboard, and Spotter-generated Answers. You can download Answer data in `CSV`, `XLSX`, `PNG`, and `PDF` format. The default `file_format` is `CSV`.

[IMPORTANT]
====
* #If Role-Based Access Control (RBAC) is enabled, `DATADOWNLOADING` (Can download Data) privilege is required for Answer exports.#
* #If the granular Role-Based Access Control (RBAC) is enabled, the `CAN_DOWNLOAD_DETAILED_DATA` (Can download detailed data) privilege is required to export in the PDF, XLSX or CSV formats, and the `CAN_DOWNLOAD_VISUALS` (Can download visuals) privilege is required for PNG exports. In this case the `DATADOWNLOADING` privilege ceases to exist#
====

==== Example

[source,cURL]
Expand Down
13 changes: 11 additions & 2 deletions modules/ROOT/pages/roles.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,12 +183,21 @@ The `DATADOWNLOADING` (**Can download Data**) Role privilege allows users to dow
|Role type|Privilege|Description
|Data download | API: `DATADOWNLOADING` +
UI: **Can download Data**| Allows users to download data from objects such as Liveboards and Answers.
|Download visuals |API: `CAN_DOWNLOAD_VISUALS` +
|Download visuals [earlyAccess eaBackground]#Early Access# |API: `CAN_DOWNLOAD_VISUALS` +
UI: *Can download visuals* |Allows users to download data in the PDF or PNG file format. This is an early access feature and is not enabled by default on ThoughtSpot instances.
|Data export |API: `CAN_DOWNLOAD_DETAILED_DATA` +
|Data export [earlyAccess eaBackground]#Early Access# |API: `CAN_DOWNLOAD_DETAILED_DATA` +
UI: *Can download detailed data* | Allows users to export data in XLSX/CSV format. This is an early access feature and is not enabled by default on ThoughtSpot instances.
|===

#For review#
[IMPORTANT]
====
* Contact ThoughtSpot support to enable the new `CAN_DOWNLOAD_VISUALS` and `CAN_DOWNLOAD_DETAILED_DATA` privileges.
* Once these granular privileges are enabled, the `DATADOWNLOADING` privilege will cease to exit.
* Users who previously did not have `DATADOWNLOADING` privileges will not be automatically assigned the new download privileges. Administrators can assign them manually.
* Users who previously had `DATADOWNLOADING` privileges will automatically be assigned both new privileges - `CAN_DOWNLOAD_VISUALS` and `CAN_DOWNLOAD_DETAILED_DATA`.
====

== How to create and assign Roles

You can create and assign Roles to a group on the link:https://docs.thoughtspot.com/cloud/latest/rbac[Admin page of the UI, window=_blank] or by using the REST API v1 and v2 endpoints.
Expand Down