Create a Data Policy

name string

The name of the policy that will be displayed in the Immuta UI.

Required

-

-

type string

The type of policy.

Required

-

• subscription

• data

array

The actual rules for this policy.

Required

-

-

array

When and where the policy should get applied.

Optional

-

-

circumstanceOperator string

Specifies whether all of the circumstances must be met for the policy to be applied (AND), or just any of them (OR).

Optional

any

• all

• any

staged boolean

If true, this global policy is in a staged status.

Optional

false

• true

• false

object

Certification information for the global policy.

Optional

-

-

object

Details about the configuration of the policy.

Required

-

rules.inclusions object

The specific users this policy is meant to affect. If you use inclusions, you must add a second rules array for the other users. .

Optional

-

rules.inclusions.groups array[string]

Group names. Users in these groups will be affected by the rules in this rules array.

Required for rules.inclusions

-

object

These are the users the policy is not meant to target.

Optional

-

conditionalPredicate string

to dictate where the policy is applied.

Optional

-

operator string

Specifies whether all of the circumstances must be met for the policy to be applied (AND), or just any of them (OR).

Optional

any

purposes array[string]

Purpose names. Restriction to the data will be applied to everyone except users acting under these purposes.

Required if rules.type is Purpose Restriction

-

percent integer

Specifies the percentage of the data to show.

Required if rules.type is Minimization

-

isOlderOrNewer string

Specifies if the policy should be applied to columns older or newer than the provided time.

Required if rules.type is Time Restriction

• newer

• older

time integer

The time (in seconds) that the row must be older or newer than to be visible.

Required if rules.type is Time Restriction

-

predicate string

to dictate what rows are visible.

Required if rules.type is Row Restriction by Custom Where Clause

-

matches object

The user entitlements that must match the value in the specified column for the row to show.

Required if rules.type is Row Restriction By User Entitlements

-

matches.type string

The type of user entitlements to base the policy on.

Required if rules.type is Row Restriction By User Entitlements

• Group

• Attribute

• Purpose

matches.tag string

The tag of the column that's data must match the user's entitlement.

Required if rules.type is Row Restriction By User Entitlements

-

regex string

The regex to match against column names and apply the policy when found.

Required if type is columnRegex

-

caseInsensitive boolean

If true, the regex is case insensitive. Use with columnRegex type.

Optional

• true

• false

regex string

The regular expression that identifies the portion of the value to mask.

Required if type is Regular Expression

-

replacement string

The string that will replace the portion of the value identified by the regular expression to mask.

Required if type is Regular Expression

-

caseInsensitive boolean

If true, the regex is case insensitive. Use with Regular Expression type.

Optional

• true

• false

timePrecision string

Specifies where Immuta will round the time to.

Requires timePrecision or bucketSize if type is Grouping

• HOUR

• DAY

• MONTH

bucketSize integer

The bucket size to round to.

Requires timePrecision or bucketSize if type is Grouping

-

attributes array[object]

Attribute names and values. Users with these attributes will not be affected by this policy.

Requires either purposes or attributes

-

attributes.name string

An attribute name.

Required if attributes is used

-

attributes.value string

An attribute value.

Required if attributes is used

-

tag string

The tag to dictate when the policy is applied.

Required if type is tags

-

-

columnTag string

The column tag to dictate when the policy is applied.

Required if type is columnTags

-

-

regex string

The regex to match against column names and apply the policy when found.

Required if type is columnRegex

-

-

caseInsensitive boolean

If true, the regex is case insensitive. Use with columnRegex type.

Optional

-

• true

• false

server string

Specifies the server that contains the data sources the policy should be applied to.

Required if type is server

-

-

startDate string

Specifies to apply policies to data sources created on or after this date and before the endDate.

Required if type is time

-

-

endDate string

Specifies to apply policies to data sources created before this date and after the startDate.

Optional

-

-

domains array[object]

Specifies to apply policies to data sources in the listed domains.

Required if type is domains

-

-

domains.id string

The unique ID of the domain.

Requires either domains.id or domains.name if type is domains

-

-

domains.name string

The name of the domain.

Requires either domains.id or domains.name if type is domains

-

-

label string

The label that appears when the policy has been certified.

Required

-

-

tags array[string]

Tags that impact the certification.

Optional

-

-

recertify boolean

When true, data owners must re-certify all data sources this policy applies to.

Optional

false

• true

• false