openapi: 3.0.0
info:
title: ThoughtSpot Public REST 10.1.0.cl 26.3.0.cl API
version: '2.0'
servers:
- url: '{base-url}'
variables:
base-url:
default: https://localhost:443
security:
- bearerAuth: []
tags:
- name: 26.3.0.cl
paths:
/api/rest/2.0/security/metadata/fetch-object-privileges:
post:
operationId: fetchObjectPrivileges
description: "\n <span class=\"since-beta-tag\">Version: 26.3.0.cl or later</span>\n\nThis API fetches the object privileges present for the given list of principals (user or group), on the given set of objects. It supports pagination, which can be enabled and configured using the request parameters. It provides users access to certain features based on privilege based access control.\n\n#### Usage guidelines\n\n- Specify the `type` (`USER` or `USER_GROUP`) and `identifier` (either GUID or name) of the principals for which you want to retrieve object privilege information in the `principals` array.\n- Specify the `type` (`LOGICAL_TABLE`) and `identifier` (either GUID or name) of the metadata objects for which you want to retrieve object privilege information in the `metadata` array. Only `LOGICAL_TABLE` metadata type is supported for now. It may be extended for other metadata types in future.\n- To control the offset from where principals have to be fetched, use `record_offset`. When `record_offset` is 0, information is fetched from the beginning.\n- To control the number of principals to be fetched, use `record_size`. Default `record_size` is 20.\n- Ensure `record_offset` for a subsequent request is one more than the value of `record_size` of the previous request.\n- Ensure using correct Authorization Bearer Token corresponding to specific user & org. \n\n#### Example request\n\n```json\n{\n \"principals\": [\n {\n \"type\": \"type-1\",\n \"identifier\": \"principal-guid-or-name-1\"\n },\n {\n \"type\": \"type-2\",\n \"identifier\": \"principal-guid-or-name-2\"\n }\n ],\n \"metadata\": [\n {\n \"type\": \"metadata-type-1\",\n \"identifier\": \"metadata-guid-or-name-1\"\n },\n {\n \"type\": \"metadata-type-2\",\n \"identifier\": \"metadata-guid-or-name-2\"\n }\n ],\n \"record_offset\": 0,\n \"record_size\": 20\n}\n```\n\n\n#### Response format\n\nThe API returns an array of `metadata_object_privileges` objects wrapped in JSON. Each `metadata_object_privileges` object contains:\n- Metadata information (GUID, name and type)\n- Array of `principal_object_privilege_info`.\n- Each `principal_object_privilege_info` contains:\n - Principal type. All principals of this type are listed as described below.\n - Array of `principal_object_privileges`.\n - Each `principal_object_privileges` contains:\n - Principal information (GUID, name, subtype)\n - List of applied object level privileges.\n\n#### Example response\n\n```json\n{\n \"metadata_object_privileges\": [\n {\n \"metadata_id\": \"metadata-guid-1\",\n \"metadata_name\": \"metadata-name-1\",\n \"metadata_type\": \"metadata-type-1\",\n \"principal_object_privilege_info\": [\n {\n \"principal_type\": \"principal-type-1\",\n \"principal_object_privileges\": [\n {\n \"principal_id\": \"principal-guid-1\",\n \"principal_name\": \"principal-name-1\",\n \"principal_sub_type\": \"principal-sub-type-1\",\n \"object_privileges\": \"[object-privilege-1, object-privilege-2]\"\n },\n {\n \"principal_id\": \"principal-guid-2\",\n \"principal_name\": \"principal-name-2\",\n \"principal_sub_type\": \"principal-sub-type-2\",\n \"object_privileges\": \"[object-privilege-1, object-privilege-2]\"\n }\n ]\n },\n {\n \"principal_type\": \"principal-type-2\",\n \"principal_object_privileges\": [\n {\n \"principal_id\": \"principal-guid-3\",\n \"principal_name\": \"principal-guid-4\",\n \"principal_sub_type\": \"principal-sub-type-4\",\n \"object_privileges\": \"[object-privilege-1]\"\n }\n ]\n }\n ]\n },\n {\n \"metadata_id\": \"metadata-guid-2\",\n \"metadata_name\": \"metadata-name-2\",\n \"metadata_type\": \"metadata-type-2\",\n \"principal_object_privilege_info\": [\n {\n \"principal_type\": \"principal-type-1\",\n \"principal_object_privileges\": [\n {\n \"principal_id\": \"principal-guid-1\",\n \"principal_name\": \"principal-name-1\",\n \"principal_sub_type\": \"principal-sub-type-1\",\n \"object_privileges\": \"[object-privilege-3, object-privilege-4]\"\n },\n {\n \"principal_id\": \"principal-guid-2\",\n \"principal_name\": \"principal-name-2\",\n \"principal_sub_type\": \"principal-sub-type-2\",\n \"object_privileges\": \"[object-privilege-4]\"\n }\n ]\n }\n ]\n }\n ]\n}\n```\n\n\n\n#### Endpoint URL\n"
tags:
- 26.3.0.cl
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/FetchObjectPrivilegesRequest'
required: true
parameters: []
responses:
'200':
description: Fetching defined object privileges of metadata objects is successful.
content:
application/json:
schema:
$ref: '#/components/schemas/ObjectPrivilegesOfMetadataResponse'
'400':
description: Invalid request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Unauthorized access.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'403':
description: Forbidden access.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: Unexpected error
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
/api/rest/2.0/security/metadata/manage-object-privilege:
post:
operationId: manageObjectPrivilege
description: "\n <span class=\"since-beta-tag\">Version: 26.3.0.cl or later</span>\n\nThis API allows the addition or deletion of object level privileges for a set of users and groups, on a set of metadata objects. It provides users to access certain features based on privilege based access control.\n\n#### Usage guidelines\n\n- Specify the `operation`. The supported operations are: `ADD`, `REMOVE`.\n- Specify the type of the objects on which the object privileges are being provided in `metadata_type`. Only `LOGICAL_TABLE` metadata type is supported for now. It may be extended for other metadata types in future.\n- Specify the list of object privilege types in the `object_privilege_types` array. The supported object privilege types are: `SPOTTER_COACHING_PRIVILEGE`.\n- Specify the identifiers (either GUID or name) for the metadata objects in the `metadata_identifiers` array.\n- Specify the `type` (`USER` or `USER_GROUP`) and `identifier` (either GUID or name) of the principals to which you want to apply the given operation and given object privileges in the `principals` array.\n- Ensure using correct Authorization Bearer Token corresponding to specific user & org.\n\n#### Example request\n\n```json\n{\n \"operation\": \"operation-type\",\n \"metadata_type\": \"metadata-type\",\n \"object_privilege_types\": [\"privilege-type-1\", \"privilege-type-2\"],\n \"metadata_identifiers\": [\"metadata-guid-or-name-1\", \"metadata-guid-or-name-1\"],\n \"principals\": [\n {\n \"type\": \"type-1\", \n \"identifier\": \"principal-guid-or-name-1\"\n },\n {\n \"type\": \"type-2\",\n \"identifier\": \"principal-guid-or-name-2\"\n }\n ]\n}\n```\n\n> ###### Note:\n> * Only admin users, users with edit access and users with coaching privilege on a given data-model can add or remove principals related to SPOTTER_COACHING_PRIVILEGE \n\n\n\n#### Endpoint URL\n"
tags:
- 26.3.0.cl
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ManageObjectPrivilegeRequest'
required: true
parameters: []
responses:
'204':
description: Object privileges added/removed successfully
'400':
description: Invalid request
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'401':
description: Unauthorized access
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'403':
description: Forbidden access
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
'500':
description: Unexpected error
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
components:
schemas:
FetchObjectPrivilegesRequest:
type: object
properties:
metadata:
description: Metadata objects for which you want to fetch object privileges. For now only LOGICAL_TABLE is supported. It may be extended to other metadata types in the future.
type: array
items:
$ref: '#/components/schemas/ObjectPrivilegesMetadataInput'
principals:
description: 'User or group objects for which you want to fetch object privileges.
If not specified, the API returns all users and groups that
have object privileges on the specified metadata objects.'
type: array
items:
$ref: '#/components/schemas/PrincipalsInput'
record_offset:
description: The starting record number from where the records should be included for each metadata type.
default: 0
type: integer
format: int32
record_size:
description: The number of records that should be included for each metadata type.
default: 20
type: integer
format: int32
required:
- metadata
PrincipalsInput:
type: object
required:
- identifier
properties:
identifier:
type: string
description: Unique ID or name of the principal object such as a user or group.
type:
type: string
enum:
- USER
- USER_GROUP
description: Principal type.
nullable: true
ObjectPrivilegesMetadataInput:
type: object
required:
- identifier
properties:
type:
type: string
enum:
- LOGICAL_TABLE
description: 'Type of metadata object.
Required if the name of the object is set as the identifier. This attribute is optional when the object GUID is specified as the identifier.'
nullable: true
identifier:
type: string
description: Unique ID or name of the metadata object.
ManageObjectPrivilegeRequest:
type: object
properties:
operation:
description: 'Operation to perform to manage object privileges. Available operations are: `ADD`, `REMOVE`.'
type: string
enum:
- ADD
- REMOVE
metadata_type:
description: Type of metadata objects on which you want to perform the operation. For now only LOGICAL_TABLE is supported. It may be extended to other metadata types in the future.
type: string
enum:
- LOGICAL_TABLE
object_privilege_types:
description: List of object privilege types on which you want to perform the operation.
type: array
items:
type: string
enum:
- SPOTTER_COACHING_PRIVILEGE
metadata_identifiers:
description: List of metadata identifiers (GUID or name) on which you want to perform the operation.
type: array
items:
type: string
principals:
description: User or group objects (GUID or name) to which you want to apply the given operation and given object privileges.
type: array
items:
$ref: '#/components/schemas/PrincipalsInput'
required:
- operation
- metadata_type
- object_privilege_types
- metadata_identifiers
- principals
ObjectPrivilegesOfMetadataResponse:
type: object
properties:
metadata_object_privileges:
type: object
nullable: true
ErrorResponse:
type: object
properties:
error:
type: object
nullable: true
securitySchemes:
bearerAuth:
type: http
scheme: bearer
x-roles:
- name: 26.2.0.cl
id: 26.2.0.cl
tags:
- 26.2.0.cl
description: Roles for version 26.2.0.cl
- name: 10.4.0.cl
id: 10.4.0.cl
tags:
- 10.4.0.cl
description: Roles for version 10.4.0.cl
- name: 26.7.0.cl
id: 26.7.0.cl
tags:
- 26.7.0.cl
description: Roles for version 26.7.0.cl
- name: 26.8.0.cl
id: 26.8.0.cl
tags:
- 26.8.0.cl
description: Roles for version 26.8.0.cl
- name: 26.6.0.cl
id: 26.6.0.cl
tags:
- 26.6.0.cl
description: Roles for version 26.6.0.cl
- name: 10.15.0.cl
id: 10.15.0.cl
tags:
- 10.15.0.cl
description: Roles for version 10.15.0.cl
- name: 10.13.0.cl
id: 10.13.0.cl
tags:
- 10.13.0.cl
description: Roles for version 10.13.0.cl
- name: 26.9.0.cl
id: 26.9.0.cl
tags:
- 26.9.0.cl
description: Roles for version 26.9.0.cl
- name: 10.7.0.cl
id: 10.7.0.cl
tags:
- 10.7.0.cl
description: Roles for version 10.7.0.cl
- name: 26.5.0.cl
id: 26.5.0.cl
tags:
- 26.5.0.cl
description: Roles for version 26.5.0.cl
- name: 9.0.0.cl
id: 9.0.0.cl
tags:
- 9.0.0.cl
description: Roles for version 9.0.0.cl
- name: 9.4.0.cl
id: 9.4.0.cl
tags:
- 9.4.0.cl
description: Roles for version 9.4.0.cl
- name: 9.12.0.cl
id: 9.12.0.cl
tags:
- 9.12.0.cl
description: Roles for version 9.12.0.cl
- name: 26.4.0.cl
id: 26.4.0.cl
tags:
- 26.4.0.cl
description: Roles for version 26.4.0.cl
- name: 10.12.0.cl
id: 10.12.0.cl
tags:
- 10.12.0.cl
description: Roles for version 10.12.0.cl
- name: 9.2.0.cl
id: 9.2.0.cl
tags:
- 9.2.0.cl
description: Roles for version 9.2.0.cl
- name: 9.9.0.cl
id: 9.9.0.cl
tags:
- 9.9.0.cl
description: Roles for version 9.9.0.cl
- name: 9.6.0.cl
id: 9.6.0.cl
tags:
- 9.6.0.cl
description: Roles for version 9.6.0.cl
- name: 10.10.0.cl
id: 10.10.0.cl
tags:
- 10.10.0.cl
description: Roles for version 10.10.0.cl
- name: 10.6.0.cl
id: 10.6.0.cl
tags:
- 10.6.0.cl
description: Roles for version 10.6.0.cl
- name: 10.3.0.cl
id: 10.3.0.cl
tags:
- 10.3.0.cl
description: Roles for version 10.3.0.cl
- name: 10.1.0.cl
id: 10.1.0.cl
tags:
- 10.1.0.cl
description: Roles for version 10.1.0.cl
- name: 10.9.0.cl
id: 10.9.0.cl
tags:
- 10.9.0.cl
description: Roles for version 10.9.0.cl
- name: 10.8.0.cl
id: 10.8.0.cl
tags:
- 10.8.0.cl
description: Roles for version 10.8.0.cl
- name: 9.5.0.cl
id: 9.5.0.cl
tags:
- 9.5.0.cl
description: Roles for version 9.5.0.cl
- name: 26.3.0.cl
id: 26.3.0.cl
tags:
- 26.3.0.cl
description: Roles for version 26.3.0.cl
- name: 10.14.0.cl
id: 10.14.0.cl
tags:
- 10.14.0.cl
description: Roles for version 10.14.0.cl
- name: 9.7.0.cl
id: 9.7.0.cl
tags:
- 9.7.0.cl
description: Roles for version 9.7.0.cl