# Data Hub (/docs/reference/roles-permissions/data)



Data Hub combines a tenant functional permission with a relationship on the specific connection or ingestion. Both must allow the operation. Data Steward does not automatically own every connection; Data Credential Manager does not automatically gain operator access to every connection.

| Resource relationship | Additional authority on that resource                                                      |
| --------------------- | ------------------------------------------------------------------------------------------ |
| Viewer                | Inspect the resource                                                                       |
| Editor                | Change configuration                                                                       |
| Invoker               | Test, discover, use or run, depending on resource type                                     |
| Operator              | Replace connection credentials, manage ingestion schedules or cancel runs                  |
| Grant manager         | Manage resource sharing                                                                    |
| Owner                 | All resource relationships, plus owner-only deletion, state changes and ownership transfer |

The permission descriptions identify the required relationship. Run access is checked against the associated ingestion. Connector definitions are tenant-level registrations rather than individually shared connections.

For example, running a shared ingestion requires `data.ingestion.run` **and** invoker access to that ingestion, with the required access to its source and destination connections.

## Permissions [#permissions]

This family contains **25 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### data.connection.create [#dataconnectioncreate]

      <span className="catalogue-description">
        Create a source or destination connection; the caller becomes its owner.
      </span>
    </summary>

    <div className="catalogue-content">
      Create a source or destination connection; the caller becomes its owner.

      | Property     | Value                                                                                                                                                                |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                      |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)             |
      | Custom role  | Yes                                                                                                                                                                  |
      | Also implies | [data.connection.list](/docs/reference/roles-permissions/data#dataconnectionlist), [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.credential.update [#dataconnectioncredentialupdate]

      <span className="catalogue-description">
        Replace a connection's credentials.
      </span>
    </summary>

    <div className="catalogue-content">
      Replace a connection's credentials. Requires operator access; it does not reveal stored secrets or grant general connection-editing rights.

      | Property    | Value                                                                                             |
      | ----------- | ------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                   |
      | Granted by  | [Data Credential Manager](/docs/reference/roles-permissions/system-roles#data-credential-manager) |
      | Custom role | Yes                                                                                               |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.delete [#dataconnectiondelete]

      <span className="catalogue-description">
        Delete a connection.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete a connection. Requires ownership and remains subject to dependency checks.

      | Property     | Value                                                                                                                                                                                                                                                       |
      | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                                             |
      | Granted by   | [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)                                                                                                                                                                                 |
      | Custom role  | Yes                                                                                                                                                                                                                                                         |
      | Also implies | [data.connection.list](/docs/reference/roles-permissions/data#dataconnectionlist), [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread), [data.connection.update](/docs/reference/roles-permissions/data#dataconnectionupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.discover [#dataconnectiondiscover]

      <span className="catalogue-description">
        Discover the streams or schema exposed by a connection.
      </span>
    </summary>

    <div className="catalogue-content">
      Discover the streams or schema exposed by a connection. Requires invoker access.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.list [#dataconnectionlist]

      <span className="catalogue-description">
        List connections visible to the caller in the active tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      List connections visible to the caller in the active tenant.

      | Property     | Value                                                                                                                                                                                                                                   |
      | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                         |
      | Granted by   | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role  | Yes                                                                                                                                                                                                                                     |
      | Also implies | [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread)                                                                                                                                                       |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.read [#dataconnectionread]

      <span className="catalogue-description">
        Read a connection's non-secret configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Read a connection's non-secret configuration. Requires viewer access to that connection.

      | Property    | Value                                                                                                                                                                                                                                   |
      | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                                                                         |
      | Granted by  | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                                                                                                     |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.test [#dataconnectiontest]

      <span className="catalogue-description">
        Run a connectivity or configuration check.
      </span>
    </summary>

    <div className="catalogue-content">
      Run a connectivity or configuration check. Requires invoker access to the connection.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.update [#dataconnectionupdate]

      <span className="catalogue-description">
        Edit a connection's configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Edit a connection's configuration. Requires editor access; credential replacement is a separate permission.

      | Property     | Value                                                                                                                                                                |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                      |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)             |
      | Custom role  | Yes                                                                                                                                                                  |
      | Also implies | [data.connection.list](/docs/reference/roles-permissions/data#dataconnectionlist), [data.connection.read](/docs/reference/roles-permissions/data#dataconnectionread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connection.use [#dataconnectionuse]

      <span className="catalogue-description">
        Use a connection in an ingestion workflow.
      </span>
    </summary>

    <div className="catalogue-content">
      Use a connection in an ingestion workflow. Requires invoker access to the connection.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connector\_definition.create [#dataconnector_definitioncreate]

      <span className="catalogue-description">
        Register a source or target connector definition backed by a runtime image.
      </span>
    </summary>

    <div className="catalogue-content">
      Register a source or target connector definition backed by a runtime image.

      | Property     | Value                                                                                                                                                                                                          |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)                                                       |
      | Custom role  | Yes                                                                                                                                                                                                            |
      | Also implies | [data.connector\_definition.list](/docs/reference/roles-permissions/data#dataconnector_definitionlist), [data.connector\_definition.read](/docs/reference/roles-permissions/data#dataconnector_definitionread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connector\_definition.delete [#dataconnector_definitiondelete]

      <span className="catalogue-description">
        Delete a connector definition, subject to dependency checks.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete a connector definition, subject to dependency checks.

      | Property     | Value                                                                                                                                                                                                          |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)                                                       |
      | Custom role  | Yes                                                                                                                                                                                                            |
      | Also implies | [data.connector\_definition.list](/docs/reference/roles-permissions/data#dataconnector_definitionlist), [data.connector\_definition.read](/docs/reference/roles-permissions/data#dataconnector_definitionread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connector\_definition.list [#dataconnector_definitionlist]

      <span className="catalogue-description">
        List registered connector definitions and their supported capabilities.
      </span>
    </summary>

    <div className="catalogue-content">
      List registered connector definitions and their supported capabilities.

      | Property     | Value                                                                                                                                                                                                                                   |
      | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                         |
      | Granted by   | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role  | Yes                                                                                                                                                                                                                                     |
      | Also implies | [data.connector\_definition.read](/docs/reference/roles-permissions/data#dataconnector_definitionread)                                                                                                                                  |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.connector\_definition.read [#dataconnector_definitionread]

      <span className="catalogue-description">
        Inspect a connector definition and its configuration schema.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect a connector definition and its configuration schema.

      | Property    | Value                                                                                                                                                                                                                                   |
      | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                                                                         |
      | Granted by  | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                                                                                                     |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.create [#dataingestioncreate]

      <span className="catalogue-description">
        Create an ingestion definition connecting a source and a destination.
      </span>
    </summary>

    <div className="catalogue-content">
      Create an ingestion definition connecting a source and a destination. Access to both connections is checked separately.

      | Property     | Value                                                                                                                                                            |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                  |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)         |
      | Custom role  | Yes                                                                                                                                                              |
      | Also implies | [data.ingestion.list](/docs/reference/roles-permissions/data#dataingestionlist), [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.delete [#dataingestiondelete]

      <span className="catalogue-description">
        Delete an ingestion definition.
      </span>
    </summary>

    <div className="catalogue-content">
      Delete an ingestion definition. Requires ownership.

      | Property     | Value                                                                                                                                                                                                                                                 |
      | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                                       |
      | Granted by   | [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)                                                                                                                                                                           |
      | Custom role  | Yes                                                                                                                                                                                                                                                   |
      | Also implies | [data.ingestion.list](/docs/reference/roles-permissions/data#dataingestionlist), [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread), [data.ingestion.update](/docs/reference/roles-permissions/data#dataingestionupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.list [#dataingestionlist]

      <span className="catalogue-description">
        List ingestion definitions visible to the caller.
      </span>
    </summary>

    <div className="catalogue-content">
      List ingestion definitions visible to the caller.

      | Property     | Value                                                                                                                                                                                                                                   |
      | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                         |
      | Granted by   | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role  | Yes                                                                                                                                                                                                                                     |
      | Also implies | [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread)                                                                                                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.read [#dataingestionread]

      <span className="catalogue-description">
        Inspect an ingestion definition.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect an ingestion definition. Requires viewer access.

      | Property    | Value                                                                                                                                                                                                                                   |
      | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                                                                         |
      | Granted by  | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                                                                                                     |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.run [#dataingestionrun]

      <span className="catalogue-description">
        Start an ingestion run.
      </span>
    </summary>

    <div className="catalogue-content">
      Start an ingestion run. Requires invoker access to the ingestion and appropriate connection access.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.schedule.update [#dataingestionscheduleupdate]

      <span className="catalogue-description">
        Change an ingestion schedule.
      </span>
    </summary>

    <div className="catalogue-content">
      Change an ingestion schedule. Requires operator access to the ingestion.

      | Property    | Value                                                                                                                                                    |
      | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                          |
      | Granted by  | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                      |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.state.reset [#dataingestionstatereset]

      <span className="catalogue-description">
        Reset the ingestion's saved incremental state.
      </span>
    </summary>

    <div className="catalogue-content">
      Reset the ingestion's saved incremental state. Requires ownership and can cause data to be read again.

      | Property    | Value                                                                       |
      | ----------- | --------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                             |
      | Granted by  | [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.state.restore [#dataingestionstaterestore]

      <span className="catalogue-description">
        Restore an ingestion state checkpoint.
      </span>
    </summary>

    <div className="catalogue-content">
      Restore an ingestion state checkpoint. Requires ownership.

      | Property    | Value                                                                       |
      | ----------- | --------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                             |
      | Granted by  | [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                         |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.ingestion.update [#dataingestionupdate]

      <span className="catalogue-description">
        Edit an ingestion definition.
      </span>
    </summary>

    <div className="catalogue-content">
      Edit an ingestion definition. Requires editor access.

      | Property     | Value                                                                                                                                                            |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                  |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward)         |
      | Custom role  | Yes                                                                                                                                                              |
      | Also implies | [data.ingestion.list](/docs/reference/roles-permissions/data#dataingestionlist), [data.ingestion.read](/docs/reference/roles-permissions/data#dataingestionread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.run.cancel [#dataruncancel]

      <span className="catalogue-description">
        Cancel an ingestion run.
      </span>
    </summary>

    <div className="catalogue-content">
      Cancel an ingestion run. Requires operator access to the associated ingestion.

      | Property     | Value                                                                                                                                                    |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                          |
      | Granted by   | [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role  | Yes                                                                                                                                                      |
      | Also implies | [data.run.list](/docs/reference/roles-permissions/data#datarunlist), [data.run.read](/docs/reference/roles-permissions/data#datarunread)                 |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.run.list [#datarunlist]

      <span className="catalogue-description">
        List ingestion-run records visible to the caller.
      </span>
    </summary>

    <div className="catalogue-content">
      List ingestion-run records visible to the caller.

      | Property     | Value                                                                                                                                                                                                                                   |
      | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                                         |
      | Granted by   | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role  | Yes                                                                                                                                                                                                                                     |
      | Also implies | [data.run.read](/docs/reference/roles-permissions/data#datarunread)                                                                                                                                                                     |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### data.run.read [#datarunread]

      <span className="catalogue-description">
        Inspect an ingestion run, including its status and available execution details.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect an ingestion run, including its status and available execution details. Requires viewer access to the associated ingestion.

      | Property    | Value                                                                                                                                                                                                                                   |
      | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                                                                                                                                                                         |
      | Granted by  | [Data Consumer](/docs/reference/roles-permissions/system-roles#data-consumer), [Data Builder](/docs/reference/roles-permissions/system-roles#data-builder), [Data Steward](/docs/reference/roles-permissions/system-roles#data-steward) |
      | Custom role | Yes                                                                                                                                                                                                                                     |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)