Set Up Data Filters for Users

Overview

User Data Filters (UDF), also referred to as user data permissions or row-level security, allow you to restrict data that are available for specific users in specific workspaces.

By setting a UDF, you can define what subset of the data in a workspace will be available for individual users or user groups.

As opposed to workspace data filters (that point to a specific column in a specific table), user data filters use MAQL expressions. This offers you more flexibility in creating complex conditions because UDFs are applied to any connected data rather than specific database columns.

UDFs also affect COUNT metrics and listed attribute values along the oriented path from the filter to the selected attribute, as defined by arrows in the Logical Data Model (LDM). Therefore, when counting or listing, a filter set for one attribute will apply to all related attributes across different datasets. Simply put, the UDF will be applied to all dataset attributes that are in the LDM along the direction of the arrows. The filter is not applied against the direction of the arrows in the LDM.

Multiple User Data Filters

You can restrict data for individual users and user groups, or combine them.

The effective filters for individual users are inherited from all user groups that the user is a member of throughout the workspace hierarchy.

For example, if a user is a member of any user groups and filters are created for these groups as well, then also all filters from these groups are applied (using the AND operator).

Set Up User Data Filters

You can set up user UDFs via:

• Entity API

  This enables you to create, replace, update, and delete individual UDFs.

• Declarative API

  This enables you to update a complete set of UDFs.

To set up UDFs, do the following:

1. Create a JSON document.
2. Add the JSON document to the workspace.

Create JSON Document

{
 "data": {
   "type": "userDataFilter",
   "id": "<data-filter-id>",
   "attributes": {
     "maql": "<maql-expression>",
     "title": "<data-filter-name>"
   },
   "relationships": {
     "user": {
       "data": {
         "id": "<user-id>",
         "type": "user"
       }
     }
   }
 }
}

{
 "data": {
   "type": "userDataFilter",
   "id": "country",
   "attributes": {
     "maql": "{label/CUSTOMER_COUNTRY} = \"Canada\"",
     "title": "tenant filtered to Canada Only"
   },
   "relationships": {
     "user": {
       "data": {
         "id": "john.doe_tenant",
         "type": "user"
       }
     }
   }
 }
}

{
 "userDataFilters": [
   {
     "id": "<data-filter-id>",
     "maql": "<maql-expression>",
     "title": "<data-filter-name>",
     "user": {
       "id": "<user-id>",
       "type": "user"
     }
   }
 ]
}

{
    "userDataFilters": [
      {
        "id": "country",
        "maql": "{label/CUSTOMER_COUNTRY} = \"Canada\"",
        "title": "tenant filtered to Canada Only",
        "user": {
          "id": "john.doe_tenant",
          "type": "user"
        }
      }
    ]
   }

Add JSON Document to Workspace

curl $HOST_URL/api/v1/entities/workspaces/<workspace-id>/userDataFilters \
-H "Authorization: Bearer $API_TOKEN" \
-H "Content-Type: application/vnd.gooddata.api+json" \
 -d @/path/to/your-filter-definition.json

curl $HOST_URL/api/v1/entities/workspaces/<workspace-id>/userDataFilters/ \
-H "Authorization: Bearer $API_TOKEN"

curl $HOST_URL/api/v1/layout/workspaces/<workspace-id>/userDataFilters \
-H "Authorization: Bearer $API_TOKEN" \
-H "Content-Type: application/json" \
-X PUT \
 -d @/path/to/your-filter-definition.json