Access Management

View as Markdown

Manage users, service principals, groups and their permissions in Accounts and Workspaces

List Workspace Permission AssignmentsGET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignmentsList Workspace PermissionsGET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/permissionsGet Rule Set ProxyGET /api/2.0/preview/accounts/access-control/rule-setsList Assignable Roles For ResourceGET /api/2.0/preview/accounts/{account_id}/access-control/assignable-rolesList Assignable Roles For Resource ProxyGET /api/2.0/preview/accounts/access-control/assignable-rolesUpdate Rule Set ProxyPUT /api/2.0/preview/accounts/access-control/rule-sets

List Workspace Permission Assignments

GET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments

Get the permission assignments for the specified <Account> and <Workspace>.

API scopes: access-management

Parameters

account_idstringpath

The account ID.

workspace_idint64path

The workspace ID for the account.

Response

permission_assignmentsarray of object

Array of permissions assignments defined for a workspace.

Show child attributesHide child attributes

principalobject

Information about the principal assigned to the workspace.

Show child attributesHide child attributes

user_namestringRequired

The username of the user. Present only if the principal is a user.

group_namestringRequired

The group name of the group. Present only if the principal is a group.

service_principal_namestringRequired

The name of the service principal. Present only if the principal is a service principal.

principal_idint64

The unique, opaque id of the principal.

display_namestring

The display name of the principal.

permissionsarray of string

The permissions level of the principal.

Values: UNKNOWN, USER, ADMIN

errorstring

Error response associated with a workspace permission assignment, if any.

View as Markdown

Response

{
  "permission_assignments": [
    {
      "principal": {},
      "permissions": [
        "string"
      ],
      "error": "string"
    }
  ]
}

List Workspace Permissions

GET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/permissions

Get an array of workspace permissions for the specified account and workspace.

API scopes: access-management

Parameters

account_idstringpath

The account ID.

workspace_idint64path

The workspace ID.

Response

permissionsarray of object

Array of permissions defined for a workspace.

Show child attributesHide child attributes

permission_levelstring

Values: UNKNOWN, USER, ADMIN

descriptionstring

The results of a permissions query.

View as Markdown

Response

{
  "permissions": [
    {
      "permission_level": "string",
      "description": "string"
    }
  ]
}

Get Rule Set Proxy

GET /api/2.0/preview/accounts/access-control/rule-sets

Get a rule set by its name. A rule set is always attached to a resource and contains a list of access rules on the said resource. Currently only a default rule set for each resource is supported.

API scopes: access-management

Parameters

account_idstringquery

<Databricks> account ID.

namestringquery

The ruleset name associated with the request.

Examples	Summary
name=accounts/<ACCOUNT_ID>/ruleSets/default	A name for a rule set on the account.
name=accounts/<ACCOUNT_ID>/groups/<GROUP_ID>/ruleSets/default	A name for a rule set on the group.
name=accounts/<ACCOUNT_ID>/servicePrincipals/<SERVICE_PRINCIPAL_APPLICATION_ID>/ruleSets/default	A name for a rule set on the service principal.
name=accounts/<ACCOUNT_ID>/tagPolicies/<TAG_POLICY_ID>/ruleSets/default	A name for a rule set on the tag policy.

etagstringquery

Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is strongly suggested that systems make use of the etag in the read -> modify -> write pattern to perform rule set updates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the PUT update request to identify the rule set version you are updating.

Examples	Summary
etag=	An empty etag can only be used in GET to indicate no freshness requirements.
etag=RENUAAABhSweA4NvVmmUYdiU717H3Tgy0UJdor3gE4a+mq/oj9NjAf8ZsQ==	An etag encoded a specific version of the rule set to get or to be updated.

Response

namestring

Name of the rule set.

etagstring

Identifies the version of the rule set returned. Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is strongly suggested that systems make use of the etag in the read -> modify -> write pattern to perform rule set updates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the PUT update request to identify the rule set version you are updating.

grant_rulesarray of object

Show child attributesHide child attributes

principalsarray of string

Principals this grant rule applies to. A principal can be a user (for end users), a service principal (for applications and compute workloads), or an account group. Each principal has its own identifier format:

• users/<USERNAME>
• groups/<GROUP_NAME>
• servicePrincipals/<SERVICE_PRINCIPAL_APPLICATION_ID>

rolestring

Role that is assigned to the list of principals.

View as Markdown

Response

{
  "name": "string",
  "etag": "string",
  "grant_rules": [
    {
      "principals": [
        "string"
      ],
      "role": "string"
    }
  ]
}

List Assignable Roles For Resource

GET /api/2.0/preview/accounts/{account_id}/access-control/assignable-roles

Gets all the roles that can be granted on an account level resource. A role is grantable if the rule set on the resource can contain an access rule of the role.

API scopes: access-management

Parameters

account_idstringpath

<Databricks> account ID.

resourcestringquery

The resource name for which assignable roles will be listed.

Examples	Summary
resource=accounts/<ACCOUNT_ID>	A resource name for the account.
resource=accounts/<ACCOUNT_ID>/groups/<GROUP_ID>	A resource name for the group.
resource=accounts/<ACCOUNT_ID>/servicePrincipals/<SP_ID>	A resource name for the service principal.
resource=accounts/<ACCOUNT_ID>/tagPolicies/<TAG_POLICY_ID>	A resource name for the tag policy.

Response

rolesarray of object

Show child attributesHide child attributes

namestring

Role to assign to a principal or a list of principals on a resource.

View as Markdown

Response

A role that will grant the permissions of a marketplace admin.Roles that can grant permissions on groups.Roles that can grant permissions on service principals.

{
  "roles": [
    {
      "name": "roles/marketplace.admin"
    }
  ]
}

List Assignable Roles For Resource Proxy

GET /api/2.0/preview/accounts/access-control/assignable-roles

Gets all the roles that can be granted on an account level resource. A role is grantable if the rule set on the resource can contain an access rule of the role.

API scopes: access-management

Parameters

account_idstringquery

<Databricks> account ID.

resourcestringquery

The resource name for which assignable roles will be listed.

Examples	Summary
resource=accounts/<ACCOUNT_ID>	A resource name for the account.
resource=accounts/<ACCOUNT_ID>/groups/<GROUP_ID>	A resource name for the group.
resource=accounts/<ACCOUNT_ID>/servicePrincipals/<SP_ID>	A resource name for the service principal.
resource=accounts/<ACCOUNT_ID>/tagPolicies/<TAG_POLICY_ID>	A resource name for the tag policy.

Response

rolesarray of object

Show child attributesHide child attributes

namestring

Role to assign to a principal or a list of principals on a resource.

View as Markdown

Response

A role that will grant the permissions of a marketplace admin.Roles that can grant permissions on groups.Roles that can grant permissions on service principals.

{
  "roles": [
    {
      "name": "roles/marketplace.admin"
    }
  ]
}

Update Rule Set Proxy

PUT /api/2.0/preview/accounts/access-control/rule-sets

Replace the rules of a rule set. First, use get to read the current version of the rule set before modifying it. This pattern helps prevent conflicts between concurrent updates.

API scopes: access-management

Request body

account_idstring

<Databricks> account ID.

namestring

Name of the rule set.

rule_setobject

Show child attributesHide child attributes

namestring

Name of the rule set.

etagstring

Identifies the version of the rule set returned. Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is strongly suggested that systems make use of the etag in the read -> modify -> write pattern to perform rule set updates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the PUT update request to identify the rule set version you are updating.

grant_rulesarray of object

Show child attributesHide child attributes

principalsarray of string

Principals this grant rule applies to. A principal can be a user (for end users), a service principal (for applications and compute workloads), or an account group. Each principal has its own identifier format:

• users/<USERNAME>
• groups/<GROUP_NAME>
• servicePrincipals/<SERVICE_PRINCIPAL_APPLICATION_ID>

rolestring

Role that is assigned to the list of principals.

Response

namestring

Name of the rule set.

etagstring

Identifies the version of the rule set returned. Etag used for versioning. The response is at least as fresh as the eTag provided. Etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a rule set from overwriting each other. It is strongly suggested that systems make use of the etag in the read -> modify -> write pattern to perform rule set updates in order to avoid race conditions that is get an etag from a GET rule set request, and pass it with the PUT update request to identify the rule set version you are updating.

grant_rulesarray of object

Show child attributesHide child attributes

principalsarray of string

Principals this grant rule applies to. A principal can be a user (for end users), a service principal (for applications and compute workloads), or an account group. Each principal has its own identifier format:

• users/<USERNAME>
• groups/<GROUP_NAME>
• servicePrincipals/<SERVICE_PRINCIPAL_APPLICATION_ID>

rolestring

Role that is assigned to the list of principals.

View as Markdown

Request

{
  "account_id": "string",
  "name": "string",
  "rule_set": {
    "name": "string",
    "etag": "string",
    "grant_rules": [
      {}
    ]
  }
}

Response

{
  "etag": "ENCODED_VERSION_TOKEN",
  "grant_rules": [
    {
      "principals": [
        "users/some-user@company.com",
        "groups/researchers"
      ],
      "role": "roles/servicePrincipal.user"
    }
  ],
  "name": "accounts/<ACCOUNT_ID>/servicePrincipals/<SERVICE_PRINCIPAL_APPLICATION_ID>/ruleSets/default"
}