Account Workspace Assignment

View as Markdown

The direct assignment of a provisioned account-level principal (user, service principal, or group) to a workspace, together with the entitlements that assignment grants in the workspace.

This resource covers only principals assigned directly to the workspace. Principals that inherit workspace access through a group are not represented here. See WorkspaceAccessDetail and WorkspaceIdentityDetail for the effective, direct-or-indirect view. Creating the resource assigns the principal to the workspace, and deleting it removes the assignment.

entitlements is the only client-settable field. It holds the entitlements granted directly on this assignment, including any the principal also holds through a group. effective_entitlements is the read-only union of those and any granted through group membership.

A direct assignment always carries at least one directly-assigned entitlement, because the assignment is what grants it. Create and update both reject an empty entitlements set. To remove a principal's assignment entirely, delete the resource.

This resource replaces workspace assignment previously managed through the workspace SCIM and permission-assignment APIs, and is intended for account and workspace admins.

WorkspaceAssignment object

The direct assignment of a provisioned account-level principal (user, service principal, or group) to a workspace, together with the entitlements that assignment grants in the workspace.

This resource replaces workspace assignment previously managed through the workspace SCIM and permission-assignment APIs, and is intended for account and workspace admins.

principal_typestringBeta: The type of the principal (user/service principal/group) that is assigned.
Values: PRINCIPAL_TYPE_UNSPECIFIED, USER, SERVICE_PRINCIPAL, GROUP

principal_idint64Beta: The internal ID of the principal (user/sp/group) in <Databricks>.

workspace_idint64Beta: The workspace ID where the principal is assigned.

account_idstringBeta: The account ID parent of the workspace where the principal is assigned

entitlementsarray of stringBeta: Entitlements granted directly to the principal on this workspace. This is the only client-settable field. Create and update manage exactly this set, including entitlements the principal also holds through a group. List responses leave this field empty. Get a single principal to read its entitlements.
Values: ENTITLEMENT_UNSPECIFIED, WORKSPACE_ACCESS, WORKSPACE_CONSUME, DATABRICKS_SQL_ACCESS, WORKSPACE_ADMIN, ALLOW_CLUSTER_CREATE, ALLOW_INSTANCE_POOL_CREATE

effective_entitlementsarray of stringBeta: Every entitlement the principal holds in this workspace, whether granted directly or through group membership. Get responses populate this field. List responses leave it empty.
Values: ENTITLEMENT_UNSPECIFIED, WORKSPACE_ACCESS, WORKSPACE_CONSUME, DATABRICKS_SQL_ACCESS, WORKSPACE_ADMIN, ALLOW_CLUSTER_CREATE, ALLOW_INSTANCE_POOL_CREATE

View as Markdown

The WorkspaceAssignment object

{
  "principal_type": "string",
  "principal_id": 0,
  "workspace_id": 0,
  "account_id": "string",
  "entitlements": [
    "string"
  ],
  "effective_entitlements": [
    "string"
  ]
}

Get Beta

GET /api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments/{principal_id}

Returns the assignment for a principal in a workspace.

API scopes: identity

Parameters

account_idstringpath: Required. The parent account ID for which the workspace assignment is being requested.

workspace_idint64path: Required. The workspace ID for which the assignment is being requested.

principal_idint64path: Required. The internal ID of the principal (user/sp/group) for which the assignment is being requested.

Response

Returns the WorkspaceAssignment object.

View as Markdown

Response

{
  "principal_type": "string",
  "principal_id": 0,
  "workspace_id": 0,
  "account_id": "string",
  "entitlements": [
    "string"
  ],
  "effective_entitlements": [
    "string"
  ]
}

List Beta

GET /api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments

Lists workspace assignments for a workspace. The response omits the per-principal entitlement fields (entitlements and effective_entitlements). To read the entitlements for a single principal, get that principal's assignment.

API scopes: identity

Parameters

account_idstringpath: Required. The account ID for which the workspace assignments are being fetched.

workspace_idint64path: Required. The workspace ID for which the workspace assignments are being fetched.

page_sizeint32query: The maximum number of workspace assignments to return. The service may return fewer than this value.

page_tokenstringquery: A page token, received from a previous ListWorkspaceAssignments call. Provide this to retrieve the subsequent page.

Response

Returns a list of WorkspaceAssignment objects.

View as Markdown

Response

{
  "workspace_assignments": [
    {
      "principal_type": "string",
      "principal_id": 0,
      "workspace_id": 0,
      "account_id": "string",
      "entitlements": [
        "string"
      ],
      "effective_entitlements": [
        "string"
      ]
    }
  ],
  "next_page_token": "string"
}

Create Beta

POST /api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments

Creates a workspace assignment for a principal. Entitlements are granted one at a time rather than atomically. If the request fails partway through, the principal stays assigned to the workspace with only some of the requested entitlements. Get the assignment afterwards to confirm which entitlements were granted.

API scopes: identity

Parameters

account_idstringpath: Required. The account ID for which the workspace assignment is being created.

workspace_idint64path: Required. The workspace ID for which the workspace assignment is being created.

Request body

workspace_assignmentobject

Required. Workspace assignment to be created in <Databricks>.

Show child attributesHide child attributes

principal_typestring: The type of the principal (user/service principal/group) that is assigned.
Values: PRINCIPAL_TYPE_UNSPECIFIED, USER, SERVICE_PRINCIPAL, GROUP

principal_idint64: The internal ID of the principal (user/sp/group) in <Databricks>.

workspace_idint64: The workspace ID where the principal is assigned.

account_idstring: The account ID parent of the workspace where the principal is assigned

entitlementsarray of string: Entitlements granted directly to the principal on this workspace. This is the only client-settable field. Create and update manage exactly this set, including entitlements the principal also holds through a group. List responses leave this field empty. Get a single principal to read its entitlements.
Values: ENTITLEMENT_UNSPECIFIED, WORKSPACE_ACCESS, WORKSPACE_CONSUME, DATABRICKS_SQL_ACCESS, WORKSPACE_ADMIN, ALLOW_CLUSTER_CREATE, ALLOW_INSTANCE_POOL_CREATE

effective_entitlementsarray of string: Every entitlement the principal holds in this workspace, whether granted directly or through group membership. Get responses populate this field. List responses leave it empty.
Values: ENTITLEMENT_UNSPECIFIED, WORKSPACE_ACCESS, WORKSPACE_CONSUME, DATABRICKS_SQL_ACCESS, WORKSPACE_ADMIN, ALLOW_CLUSTER_CREATE, ALLOW_INSTANCE_POOL_CREATE

Response

Returns the WorkspaceAssignment object.

View as Markdown

Request

{
  "workspace_assignment": {
    "principal_type": "string",
    "principal_id": 0,
    "workspace_id": 0,
    "account_id": "string",
    "entitlements": [
      "string"
    ],
    "effective_entitlements": [
      "string"
    ]
  }
}

Response

{
  "principal_type": "string",
  "principal_id": 0,
  "workspace_id": 0,
  "account_id": "string",
  "entitlements": [
    "string"
  ],
  "effective_entitlements": [
    "string"
  ]
}

Update Beta

PATCH /api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments/{principal_id}

Updates the entitlements of a directly assigned principal in a workspace. Changes are applied one at a time rather than atomically. If the request fails partway through, only some of the requested changes take effect. Get the assignment afterwards to confirm the final state.

API scopes: identity

Parameters

account_idstringpath: Required. The account ID for which the workspace assignment is being updated.

workspace_idint64path: Required. The workspace ID for which the workspace assignment is being updated.

principal_idint64path: Required. ID of the principal in <Databricks>.

update_maskstringquery: Required. The list of fields to update.

Request body

workspace_assignmentobject

Required. Workspace assignment to be updated in <Databricks>.

Show child attributesHide child attributes

principal_typestring: The type of the principal (user/service principal/group) that is assigned.
Values: PRINCIPAL_TYPE_UNSPECIFIED, USER, SERVICE_PRINCIPAL, GROUP

principal_idint64: The internal ID of the principal (user/sp/group) in <Databricks>.

workspace_idint64: The workspace ID where the principal is assigned.

account_idstring: The account ID parent of the workspace where the principal is assigned

entitlementsarray of string: Entitlements granted directly to the principal on this workspace. This is the only client-settable field. Create and update manage exactly this set, including entitlements the principal also holds through a group. List responses leave this field empty. Get a single principal to read its entitlements.
Values: ENTITLEMENT_UNSPECIFIED, WORKSPACE_ACCESS, WORKSPACE_CONSUME, DATABRICKS_SQL_ACCESS, WORKSPACE_ADMIN, ALLOW_CLUSTER_CREATE, ALLOW_INSTANCE_POOL_CREATE

effective_entitlementsarray of string: Every entitlement the principal holds in this workspace, whether granted directly or through group membership. Get responses populate this field. List responses leave it empty.
Values: ENTITLEMENT_UNSPECIFIED, WORKSPACE_ACCESS, WORKSPACE_CONSUME, DATABRICKS_SQL_ACCESS, WORKSPACE_ADMIN, ALLOW_CLUSTER_CREATE, ALLOW_INSTANCE_POOL_CREATE

Response

Returns the WorkspaceAssignment object.

View as Markdown

Request

{
  "workspace_assignment": {
    "principal_type": "string",
    "principal_id": 0,
    "workspace_id": 0,
    "account_id": "string",
    "entitlements": [
      "string"
    ],
    "effective_entitlements": [
      "string"
    ]
  }
}

Response

{
  "principal_type": "string",
  "principal_id": 0,
  "workspace_id": 0,
  "account_id": "string",
  "entitlements": [
    "string"
  ],
  "effective_entitlements": [
    "string"
  ]
}

Delete Beta

DELETE /api/2.0/identity/accounts/{account_id}/workspaces/{workspace_id}/workspace-assignments/{principal_id}

Deletes a workspace assignment for a principal, revoking all of its entitlements. Entitlements are revoked one at a time rather than atomically. If the request fails partway through, the principal stays assigned with some of its original entitlements. Retrying is safe.

API scopes: identity

Parameters

account_idstringpath: Required. The account ID for which the workspace assignment is being deleted.

workspace_idint64path: The workspace ID where the principal has access.

principal_idint64path: Required. ID of the principal in <Databricks> to delete workspace assignment for.

WorkspaceAssignment object​

Get Beta​

Parameters​

Response​

List Beta​

Parameters​

Response​

Create Beta​

Parameters​

Request body​

Response​

Update Beta​

Parameters​

Request body​

Response​

Delete Beta​

Parameters​

WorkspaceAssignment object

Get Beta

Parameters

Response

List Beta

Parameters

Response

Create Beta

Parameters

Request body

Response

Update Beta

Parameters

Request body

Response

Delete Beta

Parameters