This page describes how to update policies using the Policy Handler API.
POST
/policy/handler
The create policy handler endpoint must be a .
The update policy handler endpoint must be a .
dataSourceId (integer): ID of the data source the policy will be applied to.
Example: 1
jsonRules (array[object]): Array of JSON rules objects.
The jsonRules array contains rules objects. The following types of policy rules are supported:
Not all combination of policy rules are valid. The examples below are supported policy rule combinations:
Prerequisite, Visibility, Masking
Prerequisite, Masking, Minimization
Prerequisite policies are used to limit usage to one or more purposes.
type (string): Policy rule type. Must be prerequisite for prerequisite policy rules.
Example: "prerequisite"
operator (string
Example:
In this example, users will only have access to data from this data source when they are acting under the purpose named Purpose Name.
Visibility policies are used to enforce row-level security.
type (string): Policy rule type. Must be visibility for row-level security policy rules.
Example: "visibility"
operator (string
Note: When adding conditions to a visibility policy rule, the field is required, and the condition value should be left empty. For example, for a group policy condition, the group name is not specified.
The user must possess the group, attribute, or purpose that matches the value stored in the field.
Example:
In this example, users will only see rows when they have an authorization that matches the value in the field department and they belong to a group that matches the value in the field organization.
Masking policy rules will mask the value in one or more columns.
type (string): Policy rule type. Must be masking for masking policy rules.
Example: "masking"
fields (array[string]
Note: When adding conditions to a masking policy rule, the field will be left blank, and the condition value should be populated.
When using a masking rule, there is an additional field that needs to be sent in the in the policyHandler.maskingConfiguration array field.
name (string): Name of the field being masked.
Example: "social"
type (string): Type of masking to apply. Supported values are "Consistent Value"
Consistent value
constant (string|null): Constant value to mask to. If this field is not defined, the value will be hashed.
Example: "REDACTED"
Regular expression
regex (string): Regex to match against when masking columns.
Example: "[0-9]{3}-[0-9]{2}"
replacement (string): String used to replace the matched regex.
Grouping
bucketSize (integer): For number fields. Size of buckets to round numbers to.
Example: 100
timePrecision (string): For time fields. Time precision to round to. Possible values: "MIN"
Example policy handler update with masking configuration metadata:
Example:
In this example, the fields email and location will be masked unless the user belongs to the group admins.
Minimization policy rules will show a limited percentage of the data, based on a high cardinality column, for everyone unless the user fulfills the policy conditions.
type (string): Policy rule type. Must be additional for minimization policy rules.
Example: "additional"
name (string
Note: When adding conditions to a minimization policy rule the field will be left blank.
When using a minimization rule, there is an additional field that needs to be sent in the in the policyHandler.additionalFilters.minimization field.
percent (integer): Percentage of the data to show to the users. This percentage will be based off of unique values in the hashPhrase column.
Example: 50
hashPhrase
Example policy handler rule:
In this example, 50 percent of the data, based on the name field, will be visible to users unless they fulfill the policy conditions.
Example data source update (partial):
Time-based rules will make a limited portion of the data available based on event time. The data source must contain an event time column in order for this policy type to be valid. For instance, users who do not fulfill the policy conditions will only see data from within the defined time window.
type (string): Policy rule type. Must be additional for minimization policy rules.
Example: "additional"
name (string
Note: When adding conditions to a time based policy rule the field will be left blank.
When using a time based rule, there is an additional field that needs to be sent in the in the policyHandler.additionalFilters field.
time (integer): Age in seconds of the oldest data a user will be allowed to see. This counts backward from the present.
Example: 14400
Example policy handler rule:
In this example, only data from the last 4 hours will be visible to users unless they fulfill the policy conditions.
Example data source update (partial):
There are three types of policy conditions:
The group policy condition restricts access to the condition when a user is a member of a group.
type (string): Type of policy condition. Must be "groups" for the group policy condition.
Example: "groups"
group (object
Example:
name (string): Name of group user must belong to in order to satisfy the policy condition.
Example: "users"
iam (string): ID of the IAM containing the group.
The attribute policy condition restricts access to the condition when a user possesses an attribute.
type (string): Type of policy condition. Must be "authorizations" for the attribute policy condition.
Example: "authorizations"
authorization (
Example:
auth (string): Name of attribute to check for attribute value.
Example: "accesses"
value (string): Value of attribute user must possess in order to satisfy the policy condition.
The purpose policy condition restricts access to the condition when a user is acting under a purpose.
type (string): Type of policy condition. Must be "purposes" for the purpose policy condition.
Example: "purpopses"
value (string
Example:
Example: See defining policy rules
Example: "or"
conditions (array[object]): Conditions to be applied for the rule. Multiple values will be evaluated according to the operator.
Example: See purpose condition object
Example: "or"
conditions (array[object]): Conditions to be applied for the rule. Multiple values will be evaluated according to the operator.
Example: See policy conditions
Example: ["email", "location"]
operator (string): Operator to be applied on conditions. Possible values: and, or.
Example: "or"
conditions (array[object]): Conditions to be applied for the rule. Multiple values will be evaluated according to the operator.
Example: See policy conditions
"Grouping""Regular Expression"Example: "Consistent Value"
metadata (object): Extra metadata used when masking the value.
Example: See masking configuration metadata
Example: "xxx-xx"
"HOUR""DAY""WEEK""MONTH""YEAR"Example: "HOUR"
minimizationExample: "minimization"
operator (string): Operator to be applied on conditions. Possible values: and, or.
Example: "or"
conditions (array[object]): Conditions to be applied for the rule. Multiple values will be evaluated according to the operator.
Example: See policy conditions
Example: "name"
timeExample: "time"
operator (string): Operator to be applied on conditions. Possible values: and, or.
Example: "or"
conditions (array[object]): Conditions to be applied for the rule. Multiple values will be evaluated according to the operator.
Example: See policy conditions
Example: See group object
field (string): Data field to match group name against when checking policy.
Example: "department"
Example: "active_directory"
Example: See group object
field (string): Data field to match attribute value against when checking policy.
Example: "department"
Example: "PII"
iam (string): ID of the IAM user must receive the attribute from.
Example: "active_directory"
Example: "Purpose"
field (string): Data field to match purpose name against when checking policy.
Example: "department"
200
PUT
/policy/handler
200
{
"type": "prerequisite",
"operator": "or",
"conditions": [{
"type": "purposes",
"value": "Purpose Name"
}]
}{
"type": "groups",
"field": "organization",
"group": {
"iam": "active_directory"
}
}{
"type": "visibility",
"operator": "and",
"conditions": [{
"type": "authorizations",
"field": "department",
"authorization": {
"auth": "accesses",
"iam": "active_directory"
}
}, {
"type": "groups",
"field": "organization",
"group": {
"iam": "active_directory"
}
}]
}{
"type": "groups",
"group": {
"name": "users",
"iam": "active_directory"
}{
"policyHandler": {
"maskingConfiguration": [{
"type": "Consistent Value",
"name": "age",
"metadata": {
"constant": "REDACTED"
}
}]
}
}{
"type":"masking",
"fields": ["email", "location"],
"operator":"or",
"conditions":[{
"type":"groups",
"group":{
"name":"admins",
"iam":"active_directory"
}
}]
}{
"type": "groups",
"group": {
"name": "users",
"iam": "active_directory"
}{
"type": "additional",
"name": "minimization",
"operator": "or",
"conditions": {
"type":"groups",
"group":{
"name":"admins",
"iam":"active_directory"
}
}
}{
"policyHandler": {
"additionalFilters": {
"minimization": {
"percent": 50,
"hashPhrase": "name"
}
}
}
}{
"type": "groups",
"group": {
"name": "users",
"iam": "active_directory"
}{
"type": "additional",
"name": "time",
"operator": "or",
"conditions": {
"type":"groups",
"group":{
"name":"admins",
"iam":"active_directory"
}
}
}{
"policyHandler": {
"additionalFilters": {
"time": 14400
}
}
}{
"type": "groups",
"group": {
"name": "users",
"iam": "active_directory"
},
"field": "department"
}{
"type": "authorizations",
"authorization": {
"auth": "accesses",
"value": "PII",
"iam": "active_directory"
},
"field": "department"
}{
"type": "purposes",
"value": "Purpose",
"field": "department"
}