Access Management

View as Markdown

Manage users, service principals, groups and their permissions in Accounts and Workspaces

Get permission assignmentsGET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignmentsList workspace permissionsGET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/permissionsGet assignable roles for a resourceGET /api/2.0/preview/accounts/{account_id}/access-control/assignable-rolesGet assignable roles for a resourceGET /api/2.0/preview/accounts/access-control/assignable-roles

Get permission assignments GA

GET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments

Get the permission assignments for the specified <Account> and <Workspace>.

API scopes: access-management

Parameters

account_idstringRequiredpath

The account ID.

workspace_idint64Requiredpath

The workspace ID for the account.

Response

permission_assignmentsarray of object

Array of permissions assignments defined for a workspace.

Show child attributesHide child attributes

principalobject

Information about the principal assigned to the workspace.

Show child attributesHide child attributes

user_namestring

The username of the user. Present only if the principal is a user.

group_namestring

The group name of the group. Present only if the principal is a group.

service_principal_namestring

The name of the service principal. Present only if the principal is a service principal.

principal_idint64

The unique, opaque id of the principal.

display_namestring

The display name of the principal.

permissionsarray of string

The permissions level of the principal.

Values:

• UNKNOWN
• USER
• ADMIN

errorstring

Error response associated with a workspace permission assignment, if any.

View as Markdown

Response

{
  "permission_assignments": [
    {
      "principal": {},
      "permissions": [
        "string"
      ],
      "error": "string"
    }
  ]
}

List workspace permissions GA

GET /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/permissions

Get an array of workspace permissions for the specified account and workspace.

API scopes: access-management

Parameters

account_idstringRequiredpath

The account ID.

workspace_idint64Requiredpath

The workspace ID.

Response

permissionsarray of object

Array of permissions defined for a workspace.

Show child attributesHide child attributes

permission_levelstring

Values:

• UNKNOWN
• USER
• ADMIN

descriptionstring

The results of a permissions query.

View as Markdown

Response

{
  "permissions": [
    {
      "permission_level": "string",
      "description": "string"
    }
  ]
}

Get assignable roles for a resource Public Preview

GET /api/2.0/preview/accounts/{account_id}/access-control/assignable-roles

Gets all the roles that can be granted on an account level resource. A role is grantable if the rule set on the resource can contain an access rule of the role.

API scopes: access-management

Parameters

account_idstringRequiredpath

<Databricks> account ID.

resourcestringRequiredquery

The resource name for which assignable roles will be listed.

Examples	Summary
resource=accounts/<ACCOUNT_ID>	A resource name for the account.
resource=accounts/<ACCOUNT_ID>/groups/<GROUP_ID>	A resource name for the group.
resource=accounts/<ACCOUNT_ID>/servicePrincipals/<SP_ID>	A resource name for the service principal.
resource=accounts/<ACCOUNT_ID>/tagPolicies/<TAG_POLICY_ID>	A resource name for the tag policy.

Response

rolesarray of object

Show child attributesHide child attributes

namestringRequired

Role to assign to a principal or a list of principals on a resource.

View as Markdown

Response

A role that will grant the permissions of a marketplace admin.Roles that can grant permissions on groups.Roles that can grant permissions on service principals.

{
  "roles": [
    {
      "name": "roles/marketplace.admin"
    }
  ]
}

Get assignable roles for a resource Public Preview

GET /api/2.0/preview/accounts/access-control/assignable-roles

Gets all the roles that can be granted on an account level resource. A role is grantable if the rule set on the resource can contain an access rule of the role.

API scopes: access-management

Parameters

account_idstringquery

<Databricks> account ID.

resourcestringRequiredquery

The resource name for which assignable roles will be listed.

Examples	Summary
resource=accounts/<ACCOUNT_ID>	A resource name for the account.
resource=accounts/<ACCOUNT_ID>/groups/<GROUP_ID>	A resource name for the group.
resource=accounts/<ACCOUNT_ID>/servicePrincipals/<SP_ID>	A resource name for the service principal.
resource=accounts/<ACCOUNT_ID>/tagPolicies/<TAG_POLICY_ID>	A resource name for the tag policy.

Response

rolesarray of object

Show child attributesHide child attributes

namestringRequired

Role to assign to a principal or a list of principals on a resource.

View as Markdown

Response

A role that will grant the permissions of a marketplace admin.Roles that can grant permissions on groups.Roles that can grant permissions on service principals.

{
  "roles": [
    {
      "name": "roles/marketplace.admin"
    }
  ]
}