get_user_data_permissions_on_dataset

DatasetsApi.get_user_data_permissions_on_dataset(id, userid, role_id, limit=None, offset=None, sortorder=None, sortby=None, projection_expression=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

Get user Lake Formation data permissions on a dataset

Returns fine-grained Lake Formation column/row permissions for the path userid on the dataset. LF (TargetLocation=lf) datasets only (else IPV-1058). Response is UserDataPermissions with TablePermissions[] and DataFilterPermissions[]. Each permission entry includes Columns, ColumnCondition (Include|Exclude), and for data filters optional Rows and Name. Dataset must exist, be active, and registration completed; path userid must have access to the dataset. Query params limit/offset/sortby/sortorder/projectionExpression are accepted by API Gateway but not applied by the handler (full permission set returned). Safe to retry (read-only).

Parameters:

• id (str) – Dataset ID. Must exist (else IPV-1002), be active (else DS-1002), and use TargetLocation lf (else IPV-1058). (required)

• userid (str) – User ID whose Lake Formation table/data-filter permissions are returned. Must have access to the dataset (else AUTH-1011). (required)

• role_id (str) – Amorphic role ID the request is authorized against. Must be a role the caller belongs to. (required)

• limit (str) – Declared for listing consistency. Not applied by the LF user data-permissions handler (full set returned).

• offset (str) – Declared for listing consistency. Not applied by the LF user data-permissions handler.

• sortorder (str) – Declared for listing consistency (asc|desc). Not applied by the LF user data-permissions handler.

• sortby (str) – Declared for listing consistency. Not applied by the LF user data-permissions handler.

• projection_expression (str) – Declared for listing consistency. Not applied by the LF user data-permissions handler.

• _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

• _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

• _content_type (str, Optional) – force content-type for the request.

• _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

• _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

UserDataPermissions

Returns:

Returns the result object.

Request and Response Examples

HTTP: GET /datasets/{id}/users/{userid}/data-permissions

Parameter examples

Name	In	Example
id	path	"b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f"
userid	path	"alice@example.com"

Success (HTTP 200)

User Lake Formation permissions returned. Body is UserDataPermissions with TablePermissions and DataFilterPermissions arrays (either may be empty).

Request / response example

{
  "TablePermissions": [
    {
      "Columns": [
        "customerid",
        "orderid",
        "amount"
      ],
      "ColumnCondition": "Include"
    }
  ],
  "DataFilterPermissions": [
    {
      "Name": "sales_monthly_orders_df2",
      "Columns": [
        "customerid",
        "gender"
      ],
      "ColumnCondition": "Include",
      "Rows": "All"
    }
  ]
}

Errors

Documented error codes: IPV-1002, DS-1002, AUTH-1011, IPV-1058, RTE-1001.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<CODE> - <text>”}. Codes: IPV-1002 (dataset not found), DS-1002 (inactive dataset), AUTH-1011 (path userid has no dataset access), IPV-1058 (non-LF dataset / fine-grained column permissions unsupported).

Dataset ID not found

{
  "Message": "IPV-1002 - Invalid DatasetID - b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f, resource not found."
}

Dataset inactive

{
  "Message": "DS-1002 - Inactive DatasetId - b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f"
}

Path user lacks dataset access

{
  "Message": "AUTH-1011 - User b1e6c2a0-9f4d-4c7a-8f2e-1a2b3c4d5e6f is not authorized to view resource details"
}

Dataset is not LF

{
  "Message": "IPV-1058 - Dataset doesnot support fine grained column permissions"
}

HTTP 500

Backend/generic failure. Body is {“Message”: “<CODE> - <text>”}.

Request / response example

{
  "Message": "RTE-1001 - An error occurred."
}