Data Hub
Connector definitions, connections, ingestions and runs.
Data Hub combines a tenant functional permission with a relationship on the specific connection or ingestion. Both must allow the operation. Data Steward does not automatically own every connection; Data Credential Manager does not automatically gain operator access to every connection.
| Resource relationship | Additional authority on that resource |
|---|---|
| Viewer | Inspect the resource |
| Editor | Change configuration |
| Invoker | Test, discover, use or run, depending on resource type |
| Operator | Replace connection credentials, manage ingestion schedules or cancel runs |
| Grant manager | Manage resource sharing |
| Owner | All resource relationships, plus owner-only deletion, state changes and ownership transfer |
The permission descriptions identify the required relationship. Run access is checked against the associated ingestion. Connector definitions are tenant-level registrations rather than individually shared connections.
For example, running a shared ingestion requires data.ingestion.run and invoker access to that ingestion, with the required access to its source and destination connections.
Permissions
This family contains 25 permissions. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.
data.connection.create
Create a source or destination connection; the caller becomes its owner.
Create a source or destination connection; the caller becomes its owner.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.connection.list, data.connection.read |
data.connection.credential.update
Replace a connection's credentials.
Replace a connection's credentials. Requires operator access; it does not reveal stored secrets or grant general connection-editing rights.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Credential Manager |
| Custom role | Yes |
data.connection.delete
Delete a connection.
Delete a connection. Requires ownership and remains subject to dependency checks.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Steward |
| Custom role | Yes |
| Also implies | data.connection.list, data.connection.read, data.connection.update |
data.connection.discover
Discover the streams or schema exposed by a connection.
Discover the streams or schema exposed by a connection. Requires invoker access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
data.connection.list
List connections visible to the caller in the active tenant.
List connections visible to the caller in the active tenant.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.connection.read |
data.connection.read
Read a connection's non-secret configuration.
Read a connection's non-secret configuration. Requires viewer access to that connection.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
data.connection.test
Run a connectivity or configuration check.
Run a connectivity or configuration check. Requires invoker access to the connection.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
data.connection.update
Edit a connection's configuration.
Edit a connection's configuration. Requires editor access; credential replacement is a separate permission.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.connection.list, data.connection.read |
data.connection.use
Use a connection in an ingestion workflow.
Use a connection in an ingestion workflow. Requires invoker access to the connection.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
data.connector_definition.create
Register a source or target connector definition backed by a runtime image.
Register a source or target connector definition backed by a runtime image.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.connector_definition.list, data.connector_definition.read |
data.connector_definition.delete
Delete a connector definition, subject to dependency checks.
Delete a connector definition, subject to dependency checks.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.connector_definition.list, data.connector_definition.read |
data.connector_definition.list
List registered connector definitions and their supported capabilities.
List registered connector definitions and their supported capabilities.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.connector_definition.read |
data.connector_definition.read
Inspect a connector definition and its configuration schema.
Inspect a connector definition and its configuration schema.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
data.ingestion.create
Create an ingestion definition connecting a source and a destination.
Create an ingestion definition connecting a source and a destination. Access to both connections is checked separately.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.ingestion.list, data.ingestion.read |
data.ingestion.delete
Delete an ingestion definition.
Delete an ingestion definition. Requires ownership.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Steward |
| Custom role | Yes |
| Also implies | data.ingestion.list, data.ingestion.read, data.ingestion.update |
data.ingestion.list
List ingestion definitions visible to the caller.
List ingestion definitions visible to the caller.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.ingestion.read |
data.ingestion.read
Inspect an ingestion definition.
Inspect an ingestion definition. Requires viewer access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
data.ingestion.run
Start an ingestion run.
Start an ingestion run. Requires invoker access to the ingestion and appropriate connection access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
data.ingestion.schedule.update
Change an ingestion schedule.
Change an ingestion schedule. Requires operator access to the ingestion.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
data.ingestion.state.reset
Reset the ingestion's saved incremental state.
Reset the ingestion's saved incremental state. Requires ownership and can cause data to be read again.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Steward |
| Custom role | Yes |
data.ingestion.state.restore
Restore an ingestion state checkpoint.
Restore an ingestion state checkpoint. Requires ownership.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Steward |
| Custom role | Yes |
data.ingestion.update
Edit an ingestion definition.
Edit an ingestion definition. Requires editor access.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.ingestion.list, data.ingestion.read |
data.run.cancel
Cancel an ingestion run.
Cancel an ingestion run. Requires operator access to the associated ingestion.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.run.list, data.run.read |
data.run.list
List ingestion-run records visible to the caller.
List ingestion-run records visible to the caller.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |
| Also implies | data.run.read |
data.run.read
Inspect an ingestion run, including its status and available execution details.
Inspect an ingestion run, including its status and available execution details. Requires viewer access to the associated ingestion.
| Property | Value |
|---|---|
| Scope | Selected tenant |
| Granted by | Data Consumer, Data Builder, Data Steward |
| Custom role | Yes |