Sigma Computing Grants API

openapi: 3.2.0
info:
  title: Sigma Computing Grants API
  version: '1.0'
  description: 'Operations tagged grants across 2 of this provider''s published API definitions: sigma-computing-public-rest-api-openapi.json, sigma-computing-rest-api-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.sigmacomputing.com
  description: Server for GCP (US) hosted organizations
- url: https://api.sa.gcp.sigmacomputing.com
  description: Server for GCP (KSA) hosted organizations
- url: https://aws-api.sigmacomputing.com
  description: Server for AWS US (West) hosted organizations
- url: https://api.us-a.aws.sigmacomputing.com
  description: Server for AWS US (East) hosted organizations
- url: https://api.ca.aws.sigmacomputing.com
  description: Server for AWS Canada hosted organizations
- url: https://api.eu.aws.sigmacomputing.com
  description: Server for AWS Europe hosted organizations
- url: https://api.au.aws.sigmacomputing.com
  description: Server for AWS Australia and APAC hosted organizations
- url: https://api.uk.aws.sigmacomputing.com
  description: Server for AWS UK hosted organizations
- url: https://api.us.azure.sigmacomputing.com
  description: Server for Azure US hosted organizations
- url: https://api.eu.azure.sigmacomputing.com
  description: Server for Azure Europe hosted organizations
- url: https://api.ca.azure.sigmacomputing.com
  description: Server for Azure Canada hosted organizations
- url: https://api.uk.azure.sigmacomputing.com
  description: Server for Azure United Kingdom hosted organizations
- url: https://api.au.azure.sigmacomputing.com
  description: Server for Azure Australia hosted organizations
tags:
- name: Grants
paths:
  /v2/grants:
    get:
      summary: List grants
      description: 'List all grants for a given object.


        ### Usage notes


        You can specify one of the following:


        - A user by userId. Retrieve the **userId** by calling the /v2/members endpoint and using the `memberId` included in the response.

        - A team by teamId. Retrieve the **teamId** by calling the /v2/teams endpoint.

        - A document (such as a workbook, report, data model, or dataset (deprecated)), folder, or workspace by inodeId.

        - Retrieve the **inodeId** by calling the /v2/files endpoint and using the `id` included in the response.

        - Retrieve the **inodeId** for a data model by calling the /v2/dataModels endpoint and using the `dataModelId` included in the response.


        ### Usage scenarios

        - **Manage inherited permissions**: Identify files and folders that have permissions directly granted to them.

        - **Review long-lived permissions**: Audit permissions granted more than a year ago and determine if they are still needed.'
      parameters:
      - name: page
        schema:
          type: string
          description: Use to specify further pages using the string returned in the nextPage portion of the response.
          title: Page
        in: query
      - name: limit
        schema:
          type: number
          description: Number of results to return per page, with a maximum of 1,000 per request. Use the `page` option in subsequent requests to retrieve the next set of results.
          title: Limit
        in: query
      - name: inodeId
        schema:
          type: string
        in: query
      - name: teamId
        schema:
          type: string
        in: query
      - name: userId
        schema:
          type: string
        in: query
      - name: directGrantsOnly
        schema:
          type: boolean
        in: query
      operationId: listGrants
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                allOf:
                - type: object
                  required:
                  - entries
                  - nextPage
                  properties:
                    entries:
                      type: array
                      items:
                        allOf:
                        - type: object
                          required:
                          - grantId
                          - inodeId
                          - organizationId
                          - memberId
                          - teamId
                          - permission
                          - createdBy
                          - updatedBy
                          - createdAt
                          - updatedAt
                          properties:
                            grantId:
                              type: string
                              description: The unique identifier of the grant
                            inodeId:
                              type: string
                              description: The unique identifier of the inode
                            organizationId:
                              type: string
                              description: The unique identifier of the organization
                            memberId:
                              type:
                              - string
                              - 'null'
                              description: The unique identifier of the member
                            teamId:
                              type:
                              - string
                              - 'null'
                              description: The unique identifier of the team
                            permission:
                              oneOf:
                              - type: string
                                enum:
                                - admin
                                - annotate
                                - update
                                - usage
                                - writeback
                                description: 'Valid inode types: table, connection database, and connection schema.'
                                title: Connection Permission
                              - type: string
                                enum:
                                - create
                                - annotate
                                - organize
                                - explore
                                - view
                                - edit
                                - apply
                                description: 'Valid inode types: folder, workspace, workbook, dataset, and data model. Can Contribute permissions are listed as **organize** and Can Manage permissions are listed as **edit**.'
                                title: Inode Permission
                              - type: string
                                enum:
                                - view
                                - edit
                                - apply
                                description: 'Valid inode types: version tag.'
                                title: Version Tag Permission
                              description: The permission granted to the member
                            createdBy:
                              type: string
                              description: The identifier of the user who created this grant
                            updatedBy:
                              type: string
                              description: The identifier of the user or process that last updated this grant
                            createdAt:
                              type: string
                              format: date-time
                              description: When the grant was created
                            updatedAt:
                              type: string
                              format: date-time
                              description: When the grant was last updated
                          title: Connection grant response
                        - type: object
                          required:
                          - inodeType
                          properties:
                            inodeType:
                              type: string
                              enum:
                              - folder
                              - customFunction
                              - symlink
                              - versionTag
                              - worksheet
                              - block
                              - dashboard
                              - report
                              - table
                              - semanticView
                              - metricView
                              - scope
                              - sql
                              - workbook
                              - template
                              - dataset
                              - datafile
                              - storedProcedure
                              - apiConnector
                              - apiConnectorAuth
                              - mcpConnector
                              - warehouseAgent
                              - agentSkill
                              - tlsProfile
                              - application
                              - appBranch
                      description: Array of results returned by the endpoint
                    nextPage:
                      type:
                      - string
                      - 'null'
                      description: Returns a string that can be used as the `page` parameter in the next request to fetch the next page of results. The last page of results returns `null`.
                - type: object
                  properties:
                    total:
                      type: number
                      description: Total number of results. Useful to determine if there is a need to paginate.
                    hasMore:
                      type: boolean
                      description: '**[Deprecated]** Indicates whether more results are available.'
        default:
          $ref: '#/components/responses/ApiError'
      externalDocs:
        url: ''
        description: 'Sigma API documentation:'
      tags:
      - Grants
      security:
      - oauth2: []
    post:
      summary: Create or update a grant
      description: 'Create a grant or update an existing grant on a document, folder, or workspace to a user or a team by ID.


        ### Usage notes

        - This endpoint can only be used to escalate the level of access that a user has to a document. To remove or reduce a user''s access to a specific document, call /v2/grants/{grantId} to delete the existing grant and re-grant the desired level of access.

        - Retrieve the **memberId** by calling the /v2/members endpoint.

        - Retrieve the **teamId** by calling the /v2/teams endpoint.

        - Retrieve the **inodeId** by calling the /v2/files endpoint and using the `id` included in the response.

        - Retrieve the **inodeId** for a data model by calling the /v2/dataModels endpoint and using the `dataModelId` included in the response.

        - Optionally specify a **tagId** to associate the permission with a specific version tag of a workbook, dataset (deprecated), or database table. Retrieve the **tagId** by calling the /v2/tags endpoint and using the `versionTagId` included in the response.'
      parameters: []
      operationId: createGrant
      requestBody:
        description: The request body.
        content:
          application/json:
            schema:
              allOf:
              - type: object
                required:
                - grantee
                - permission
                - inodeId
                properties:
                  grantee:
                    oneOf:
                    - type: object
                      required:
                      - memberId
                      properties:
                        memberId:
                          type: string
                      description: User or member ID
                      title: Member
                    - type: object
                      required:
                      - teamId
                      properties:
                        teamId:
                          type: string
                      description: Team ID
                      title: Team
                  permission:
                    oneOf:
                    - type: string
                      enum:
                      - admin
                      - annotate
                      - update
                      - usage
                      - writeback
                      description: 'Valid inode types: table, connection database, and connection schema.'
                      title: Connection Permission
                    - type: string
                      enum:
                      - create
                      - annotate
                      - organize
                      - explore
                      - view
                      - edit
                      - apply
                      description: 'Valid inode types: folder, workspace, workbook, dataset, and data model. Can Contribute permissions are listed as **organize** and Can Manage permissions are listed as **edit**.'
                      title: Inode Permission
                    - type: string
                      enum:
                      - view
                      - edit
                      - apply
                      description: 'Valid inode types: version tag.'
                      title: Version Tag Permission
                  inodeId:
                    type: string
              - type: object
                properties:
                  tagId:
                    type: string
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                allOf:
                - type: object
                  required:
                  - grantId
                  - inodeId
                  - organizationId
                  - memberId
                  - teamId
                  - permission
                  - createdBy
                  - updatedBy
                  - createdAt
                  - updatedAt
                  properties:
                    grantId:
                      type: string
                      description: The unique identifier of the grant
                    inodeId:
                      type: string
                      description: The unique identifier of the inode
                    organizationId:
                      type: string
                      description: The unique identifier of the organization
                    memberId:
                      type:
                      - string
                      - 'null'
                      description: The unique identifier of the member
                    teamId:
                      type:
                      - string
                      - 'null'
                      description: The unique identifier of the team
                    permission:
                      oneOf:
                      - type: string
                        enum:
                        - admin
                        - annotate
                        - update
                        - usage
                        - writeback
                        description: 'Valid inode types: table, connection database, and connection schema.'
                        title: Connection Permission
                      - type: string
                        enum:
                        - create
                        - annotate
                        - organize
                        - explore
                        - view
                        - edit
                        - apply
                        description: 'Valid inode types: folder, workspace, workbook, dataset, and data model. Can Contribute permissions are listed as **organize** and Can Manage permissions are listed as **edit**.'
                        title: Inode Permission
                      - type: string
                        enum:
                        - view
                        - edit
                        - apply
                        description: 'Valid inode types: version tag.'
                        title: Version Tag Permission
                      description: The permission granted to the member
                    createdBy:
                      type: string
                      description: The identifier of the user who created this grant
                    updatedBy:
                      type: string
                      description: The identifier of the user or process that last updated this grant
                    createdAt:
                      type: string
                      format: date-time
                      description: When the grant was created
                    updatedAt:
                      type: string
                      format: date-time
                      description: When the grant was last updated
                  title: Connection grant response
                - type: object
                  required:
                  - inodeType
                  properties:
                    inodeType:
                      type: string
                      enum:
                      - folder
                      - customFunction
                      - symlink
                      - versionTag
                      - worksheet
                      - block
                      - dashboard
                      - report
                      - table
                      - semanticView
                      - metricView
                      - scope
                      - sql
                      - workbook
                      - template
                      - dataset
                      - datafile
                      - storedProcedure
                      - apiConnector
                      - apiConnectorAuth
                      - mcpConnector
                      - warehouseAgent
                      - agentSkill
                      - tlsProfile
                      - application
                      - appBranch
        default:
          $ref: '#/components/responses/ApiError'
      externalDocs:
        url: ''
        description: 'Sigma API documentation:'
      tags:
      - Grants
      security:
      - oauth2: []
    servers:
    - url: https://api.sigmacomputing.com
      description: Server for GCP (US) hosted organizations
    - url: https://api.sa.gcp.sigmacomputing.com
      description: Server for GCP (KSA) hosted organizations
    - url: https://aws-api.sigmacomputing.com
      description: Server for AWS US (West) hosted organizations
    - url: https://api.us-a.aws.sigmacomputing.com
      description: Server for AWS US (East) hosted organizations
    - url: https://api.ca.aws.sigmacomputing.com
      description: Server for AWS Canada hosted organizations
    - url: https://api.eu.aws.sigmacomputing.com
      description: Server for AWS Europe hosted organizations
    - url: https://api.au.aws.sigmacomputing.com
      description: Server for AWS Australia and APAC hosted organizations
    - url: https://api.uk.aws.sigmacomputing.com
      description: Server for AWS UK hosted organizations
    - url: https://api.us.azure.sigmacomputing.com
      description: Server for Azure US hosted organizations
    - url: https://api.eu.azure.sigmacomputing.com
      description: Server for Azure Europe hosted organizations
    - url: https://api.ca.azure.sigmacomputing.com
      description: Server for Azure Canada hosted organizations
    - url: https://api.uk.azure.sigmacomputing.com
      description: Server for Azure United Kingdom hosted organizations
    - url: https://api.au.azure.sigmacomputing.com
      description: Server for Azure Australia hosted organizations
  /v2/grants/{grantId}:
    get:
      summary: Get a grant
      description: 'Return a grant object by grant ID.


        ### Usage notes


        Depending on the grant object that you want to return details about, you can retrieve the grantId in different ways:


        - For most documents, you can retrieve the **grantId** by calling the /v2/grants endpoint with the **inodeId** for the document. For example, use the **workbookId** as the **inodeId**.

        - For a dataset (deprecated), you can also retrieve the **grantId** by calling the /v2/datasets/{datasetId}/grants endpoint.

        - For a connection path, you can retrieve the **grantId** by calling the /v2/connections/paths/{connectionPathId}/grants endpoint.'
      parameters:
      - name: grantId
        schema:
          type: string
        in: path
        required: true
      operationId: getGrant
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                allOf:
                - type: object
                  required:
                  - grantId
                  - inodeId
                  - organizationId
                  - memberId
                  - teamId
                  - permission
                  - createdBy
                  - updatedBy
                  - createdAt
                  - updatedAt
                  properties:
                    grantId:
                      type: string
                      description: The unique identifier of the grant
                    inodeId:
                      type: string
                      description: The unique identifier of the inode
                    organizationId:
                      type: string
                      description: The unique identifier of the organization
                    memberId:
                      type:
                      - string
                      - 'null'
                      description: The unique identifier of the member
                    teamId:
                      type:
                      - string
                      - 'null'
                      description: The unique identifier of the team
                    permission:
                      oneOf:
                      - type: string
                        enum:
                        - admin
                        - annotate
                        - update
                        - usage
                        - writeback
                        description: 'Valid inode types: table, connection database, and connection schema.'
                        title: Connection Permission
                      - type: string
                        enum:
                        - create
                        - annotate
                        - organize
                        - explore
                        - view
                        - edit
                        - apply
                        description: 'Valid inode types: folder, workspace, workbook, dataset, and data model. Can Contribute permissions are listed as **organize** and Can Manage permissions are listed as **edit**.'
                        title: Inode Permission
                      - type: string
                        enum:
                        - view
                        - edit
                        - apply
                        description: 'Valid inode types: version tag.'
                        title: Version Tag Permission
                      description: The permission granted to the member
                    createdBy:
                      type: string
                      description: The identifier of the user who created this grant
                    updatedBy:
                      type: string
                      description: The identifier of the user or process that last updated this grant
                    createdAt:
                      type: string
                      format: date-time
                      description: When the grant was created
                    updatedAt:
                      type: string
                      format: date-time
                      description: When the grant was last updated
                  title: Connection grant response
                - type: object
                  required:
                  - inodeType
                  properties:
                    inodeType:
                      type: string
                      enum:
                      - folder
                      - customFunction
                      - symlink
                      - versionTag
                      - worksheet
                      - block
                      - dashboard
                      - report
                      - table
                      - semanticView
                      - metricView
                      - scope
                      - sql
                      - workbook
                      - template
                      - dataset
                      - datafile
                      - storedProcedure
                      - apiConnector
                      - apiConnectorAuth
                      - mcpConnector
                      - warehouseAgent
                      - agentSkill
                      - tlsProfile
                      - application
                      - appBranch
        default:
          $ref: '#/components/responses/ApiError'
      externalDocs:
        url: ''
        description: 'Sigma API documentation:'
      tags:
      - Grants
      security:
      - oauth2: []
    delete:
      summary: Delete a grant
      description: 'Delete a grant by grant ID.


        ### Usage notes

        Depending on the grant object that you want to delete, you can retrieve the grantId in different ways:


        - For most documents, you can retrieve the **grantId** by calling the /v2/grants endpoint with the **inodeId** for the document. For example, use the **workbookId** as the **inodeId**.

        - For a dataset (deprecated), you can also retrieve the **grantId** by calling the /v2/datasets/{datasetId}/grants endpoint.

        - For a connection path, you can retrieve the **grantId** by calling the /v2/connections/paths/{connectionPathId}/grants endpoint.


        ### Usage scenarios

        - **Principle of least privilege**: Revoke unnecessary privileges on a document by removing the grant.'
      parameters:
      - name: grantId
        schema:
          type: string
        in: path
        required: true
      operationId: deleteGrant
      responses:
        '200':
          description: The response body.
          content:
            application/json:
              schema:
                allOf:
                - type: object
                  required:
                  - grantId
                  - inodeId
                  - organizationId
                  - memberId
                  - teamId
                  - permission
                  - createdBy
                  - updatedBy
                  - createdAt
                  - updatedAt
                  properties:
                    grantId:
                      type: string
                      description: The unique identifier of the grant
                    inodeId:
                      type: string
                      description: The unique identifier of the inode
                    organizationId:
                      type: string
                      description: The unique identifier of the organization
                    memberId:
                      type:
                      - string
                      - 'null'
                      description: The unique identifier of the member
                    teamId:
                      type:
                      - string
                      - 'null'
                      description: The unique identifier of the team
                    permission:
                      oneOf:
                      - type: string
                        enum:
                        - admin
                        - annotate
                        - update
                        - usage
                        - writeback
                        description: 'Valid inode types: table, connection database, and connection schema.'
                        title: Connection Permission
                      - type: string
                        enum:
                        - create
                        - annotate
                        - organize
                        - explore
                        - view
                        - edit
                        - apply
                        description: 'Valid inode types: folder, workspace, workbook, dataset, and data model. Can Contribute permissions are listed as **organize** and Can Manage permissions are listed as **edit**.'
                        title: Inode Permission
                      - type: string
                        enum:
                        - view
                        - edit
                        - apply
                        description: 'Valid inode types: version tag.'
                        title: Version Tag Permission
                      description: The permission granted to the member
                    createdBy:
                      type: string
                      description: The identifier of the user who created this grant
                    updatedBy:
                      type: string
                      description: The identifier of the user or process that last updated this grant
                    createdAt:
                      type: string
                      format: date-time
                      description: When the grant was created
                    updatedAt:
                      type: string
                      format: date-time
                      description: When the grant was last updated
                  title: Connection grant response
                - type: object
                  required:
                  - inodeType
                  properties:
                    inodeType:
                      type: string
                      enum:
                      - folder
                      - customFunction
                      - symlink
                      - versionTag
                      - worksheet
                      - block
                      - dashboard
                      - report
                      - table
                      - semanticView
                      - metricView
                      - scope
                      - sql
                      - workbook
                      - template
                      - dataset
                      - datafile
                      - storedProcedure
                      - apiConnector
                      - apiConnectorAuth
                      - mcpConnector
                      - warehouseAgent
                      - agentSkill
                      - tlsProfile
                      - application
                      - appBranch
        default:
          $ref: '#/components/responses/ApiError'
      externalDocs:
        url: ''
        description: 'Sigma API documentation:'
      tags:
      - Grants
      security:
      - oauth2: []
    servers:
    - url: https://api.sigmacomputing.com
      description: Server for GCP (US) hosted organizations
    - url: https://api.sa.gcp.sigmacomputing.com
      description: Server for GCP (KSA) hosted organizations
    - url: https://aws-api.sigmacomputing.com
      description: Server for AWS US (West) hosted organizations
    - url: https://api.us-a.aws.sigmacomputing.com
      description: Server for AWS US (East) hosted organizations
    - url: https://api.ca.aws.sigmacomputing.com
      description: Server for AWS Canada hosted organizations
    - url: https://api.eu.aws.sigmacomputing.com
      description: Server for AWS Europe hosted organizations
    - url: https://api.au.aws.sigmacomputing.com
      description: Server for AWS Australia and APAC hosted organizations
    - url: https://api.uk.aws.sigmacomputing.com
      description: Server for AWS UK hosted organizations
    - url: https://api.us.azure.sigmacomputing.com
      description: Server for Azure US hosted organizations
    - url: https://api.eu.azure.sigmacomputing.com
      description: Server for Azure Europe hosted organizations
    - url: https://api.ca.azure.sigmacomputing.com
      description: Server for Azure Cana

# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/sigma-computing/refs/heads/main/openapi/sigma-computing-grants-api-openapi.yml