update_data_permissions_on_dataset

DatasetsApi.update_data_permissions_on_dataset(dfname, id, role_id, data_permissions_update, content_type=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

Update an existing Lake Formation data filter

Replaces AuthorizedTags (EffectiveTags) and updates Columns/Rows on an existing Lake Formation data filter identified by path dfname, then starts the async grant/revoke workflow. Required request body fields (IPV-1055 if any missing): AuthorizedTags (array), Columns (object), Rows (object). Types must be list/dict/dict respectively (IPV-1060). Columns and Rows must each include Condition and Expression. Encoding is optional (defaults to none) and applies to Rows.Expression. Expected Condition values (same contract as create): Columns.Condition = include | exclude | all; Rows.Condition = custom | all. When Columns.Condition is all, Expression is ignored and the full dataset schema is used. Rows.Expression must be non-empty; use Encoding=base64 when the expression is base64-encoded (IPV-1045 / GE-1034 on bad Encoding or empty expression). Unlike create, update does not pre-check Condition enums or that column names exist in DatasetSchema; invalid values may surface later as DS-1079 from Lake Formation. Caller must be owner or editor. Not supported for TBAC-enabled datasets (GE-1034). dfname must be the existing filter SystemName / Lake Formation Name for this dataset (typically {Domain}_{DatasetName}_{shortName}).

Parameters:

  • dfname (str) – Existing data filter name for this dataset (Lake Formation Name / SystemName from list). Rejected with IPV-1046 if not found. (required)

  • id (str) – Dataset ID that owns the data filter. (required)

  • role_id (str) – Amorphic role ID used for authorization. Must be a role the user belongs to with owner or editor permission on the dataset. (required)

  • data_permissions_update (DataPermissionsUpdate) – Must include AuthorizedTags, Columns, and Rows. See DataPermissionsUpdate for nested Condition/Expression rules. (required)

  • content_type (str) – Must be application/json.

  • _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

  • _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

  • _content_type (str, Optional) – force content-type for the request.

  • _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

  • _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

UpdateDataPermissionsResponse

Returns:

Returns the result object.

Request and Response Examples

HTTP: PUT /datasets/{id}/data-permissions/{dfname}

Request

Must include AuthorizedTags, Columns, and Rows. See DataPermissionsUpdate for nested Condition/Expression rules.

Request / response example

{
  "AuthorizedTags": [
    "user#harshini"
  ],
  "Columns": {
    "Condition": "include",
    "Expression": [
      "CustomerID",
      "Gender"
    ]
  },
  "Rows": {
    "Condition": "all",
    "Expression": "all"
  },
  "Encoding": "none"
}

Success (HTTP 200)

Filter metadata/LF filter updated and async update workflow started. Message is “Data Permission update process started”.

Request / response example

{
  "Message": "Data Permission update process started"
}

Errors

Documented error codes: IPV-1055, IPV-1060, IPV-1045, IPV-1046, AUTH-1010, DS-1079, GE-1034, DB-1002.

HTTP 400

Validation or authorization failure. Codes: IPV-1055 (missing AuthorizedTags/Columns/Rows), IPV-1060 (AuthorizedTags not a list or Columns/Rows not objects), IPV-1045 (empty Encoding or empty Rows.Expression), IPV-1046 (unknown dfname), AUTH-1010 (ineligible tags), DS-1079 (Lake Formation update_data_cells_filter failure), GE-1034 (TBAC dataset, or Rows.Expression not valid base64 when Encoding=base64), plus plain “Not authorized to update dataset data permissions” when the caller is not owner/editor.

dfname does not exist for dataset

{
  "Message": "IPV-1046 - Invalid value - sales_monthly_orders_missing, parameter cannot be updated."
}

Caller is not owner/editor

{
  "Message": "Not authorized to update dataset data permissions"
}

Missing mandatory body fields

{
  "Message": "IPV-1055 - Missing mandatory params for updating user data permissions - {'AuthorizedTags'}"
}

AuthorizedTags/Columns/Rows have wrong JSON types

{
  "Message": "IPV-1060 - Invalid parameter value"
}

Rows.Expression or Encoding invalid

{
  "Message": "IPV-1045 - Invalid value - Rows Expression"
}

Tag already has broader dataset access

{
  "Message": "AUTH-1010 - Data filter tags: group tags cannot have owner/editor/read-only on this dataset; user# tags cannot name a user with direct owner/editor/read-only on this dataset. Offending: ['user#admin']"
}

HTTP 500

Backend failure (e.g. DB-1002 when persisting updated filter metadata fails).