Manage API Client Access

Grant a role-based API client access to assets in Ataccama ONE, check that the access works, and revoke it when it is no longer needed. Full-access API clients can call all REST API endpoints and have no role or permissions to configure, so this page applies to role-based clients only.

How API client access works

A role-based API client has no access to any assets when you create it. Before the client can work with assets through the REST API, you need to grant it access using role-based access control (RBAC).

Every role-based API client has a dedicated client role derived from its name: publicapi-<client_name>. For example, a client named sales-reports has the client role publicapi-sales-reports.

In ONE, the client role is listed among the identity provider roles. You grant access to the client the same way you grant it to users:

Add the client to a group by assigning its client role to one of the group’s governance roles, such as data consumer or data steward.
Share the assets the client needs with that group, or make the group their steward.

The client’s governance role determines what the client can do with the assets. The access level you choose when sharing can only narrow this access, not extend it. See How access levels work.

Before you start

Make sure role-based API clients are enabled in your environment.

Role-based clients are turned off by default. If you don’t see the Access type option in the Create API Client dialog, contact your Customer Success Manager to enable them.
Create an API client with Role-based access in the Ataccama Cloud Portal and copy its client role. See Create an API client.

The client role appears in ONE only after the client’s state in the Cloud Portal is Active, which can take a few minutes after you create the client. Roles are then synchronized to ONE in the background on a schedule.
Make sure you are an environment admin or otherwise able to manage groups in ONE. See Environment admins.
Familiarize yourself with Groups and Governance Roles.

Step 1: Add the API client to a group

Adding the client to a group lets the client use the access you grant that group. To keep API access easy to audit and revoke, consider creating a dedicated group for your API clients instead of adding them to existing user groups.

To add the client to a group, assign its client role to one of the group’s governance roles:

Go to Global settings > User management > Groups.

To access Global settings, select the Ataccama logo.
Select the group you want to add the client to, and then select Edit.

To create a new group first, see Set Up Your First Team.
In Group roles, find the governance role that matches the access the client needs.

If the group doesn’t have that governance role yet, select Assign governance roles and add it.
For that governance role, select Assign roles.
In the Assign roles dialog, select Add roles and choose the client role, for example, publicapi-sales-reports.

If the role is not listed yet, it has not been synchronized to ONE. Go to Global settings > User management > Users, select Update, and then try again.
Select Assign.
Select Save.

If the group already has access to the assets the client needs, for example, because it owns them, you can skip this step.

Otherwise, share the assets the client needs with the group and select an access level. See Share an Asset.

Assign stewardship for data observability endpoints

For the data observability and pipeline monitoring endpoints, sharing sources with the client’s group is not enough. You also need to make the group a steward of each source the client needs to monitor. See Assign Stewardship.

To learn how data observability access is managed in ONE, see Manage Data Observability Permissions.

Step 3: Verify access

Check that the client can reach the assets through the REST API:

Obtain an access token for the client. See Obtain an access token.
Call an endpoint that returns the assets the client should have access to, for example, the catalog items endpoint.

If the response lists the expected assets, the client is set up correctly. If you receive 403 Forbidden or fewer results than expected, see Troubleshooting.

Revoke access

To revoke an API client’s access, remove its role from the group:

Go to Global settings > User management > Groups.
Select the group the client belongs to, and then select Edit.
In Group roles, find the client role under its governance role and select the X icon next to it.
Select Save.

Deleting the API client in the Cloud Portal also removes its role, together with all access granted through group membership.