list_data_permissions_on_dataset

DatasetsApi.list_data_permissions_on_dataset(role_id, id, is_tbac=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

List Lake Formation data filters (or TBAC column access) on a dataset

Returns Lake Formation data-cell filters for the dataset when is_tbac is omitted/false. Caller must have access to the dataset. Owners/editors see all filters; read-only callers only see filters whose EffectiveTags grant them access. Not supported when the dataset is TBAC-enabled (unless is_tbac=true, which returns TBAC column-tag access instead of LF filters). Not paginated: the handler returns the full visible filter list in one response (no limit/offset/nextToken). Treat an empty array as no filters.

Parameters:

  • role_id (str) – Amorphic role ID the request is authorized against. Must be a role the user belongs to. Caller must have access to the dataset. (required)

  • id (str) – Dataset ID whose data filters (or TBAC column access) are listed. (required)

  • is_tbac (bool) – When true, returns TBAC column-level access for the caller instead of Lake Formation data filters. When omitted/false, lists LF data filters (dataset must not be TBAC-enabled).

  • _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

  • _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

  • _content_type (str, Optional) – force content-type for the request.

  • _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

  • _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

List[DataPermissionsResponseInner]

Returns:

Returns the result object.

Request and Response Examples

HTTP: GET /datasets/{id}/data-permissions

Success (HTTP 200)

JSON array of data-filter records for the dataset (schema DataPermissionsResponse). Empty array means no filters (or none visible to a read-only caller). Each item includes SystemName (Lake Formation filter name), EffectiveTags, TotalColumns, and nested DataPermissions. When is_tbac=true, the body is the TBAC column-access payload instead of this array.

Request / response example

[
  {
    "DatasetId": "49e02003-289e-41e9-a9f2-28a733349481",
    "SystemName": "sales_monthly_orders_df2",
    "TotalColumns": 12,
    "EffectiveTags": [
      "user#harshini"
    ],
    "CreatedBy": "admin",
    "LastModifiedBy": "admin",
    "LastModifiedTime": "2026-08-10T05:27:52Z",
    "DataPermissions": {
      "Name": "df2",
      "Columns": {
        "Condition": "include",
        "Expression": [
          "CustomerID",
          "Gender"
        ]
      },
      "Rows": {
        "Condition": "all",
        "Expression": "all"
      },
      "AuthorizedTags": [
        "user#harshini"
      ],
      "Encoding": "none"
    }
  }
]

Errors

Documented error codes: GE-1034.

HTTP 400

Validation or authorization failure. Body is {“Message”: “<text>”} or {“Message”: “<CODE> - <text>”}. Common cases: not authorized to view dataset data permissions; GE-1034 when listing LF filters on a TBAC-enabled dataset without is_tbac=true; dataset not found / inactive via is_dataset_valid errors.

Caller cannot view dataset data permissions

{
  "Message": "Not authorized to see dataset data permissions"
}

LF filters not supported on TBAC dataset

{
  "Message": "GE-1034 - Data Permissions is not supported for tag based access controlled dataset"
}

HTTP 500

Backend/generic failure. Body is typically {“Message”: “<CODE> - <text>”}.