# Requesting Access to a Data Product

Data consumers can request two types of access:

* **Data access requests**: These access requests grant permission to query the data sources in a data product.
* **Masking exception requests**: These access requests grant permission to see unmasked values in specific columns of a data product that are normally protected by a masking policy.

From either the data product **Details** or **Columns** tab, consumers can create one of these access requests:

* If approval is not required, access (or the masking exception) is automatically granted once the user acknowledges the data use agreement and answers any required question(s).
* If approval is required, the request will enter the approval flow and appear as `Pending`.

Once a request is approved, Immuta automatically provisions access through policies in the data platform and the access request will show as `Approved`:

* For data access requests, the data product itself becomes available to query.
* For masking exception requests, only the approved columns are unmasked for that user, while all other users continue to see masked values.

Data consumers can filter the **Data products** page by request state (`Approved`, `Pending`, `Denied`) to quickly see which data products or exceptions they already have access to.

## Requesting data access to a data product

The user can request data access from the [Request app](https://app.immutacloud.com/marketplace/data-products) or through a deep link URL to the request access screen which is provided in the data product or [constructed from scratch](https://documentation.immuta.com/saas/configure/how-to-guides/configure-access-request-links#access-request-links-for-data-products).

### With the UI

1. From the [**Data products** page](https://app.immutacloud.com/marketplace/data-products) click into the **Data product** you want access to, or click the request access URL for an external catalog.
2. Click the **Request access** button.
3. Use the radio buttons to show if you are requesting access for yourself or someone else.
4. **Fill out your answer** to the access question(s).
5. Opt to review the [information about existing policies](https://documentation.immuta.com/saas/request/reference-guide/data-product-access#access-prevented-status) on the **Data sources** tab.
6. Review and **select the checkbox** for the **Data use agreement** tab, if there is one.
7. Click **Submit request**.

### With the API

Ensure you set the [correct global segment](https://documentation.immuta.com/saas/developer-guides/api-intro/marketplace-api#base-path-and-global-segment) and use a [Request app personal access token (PAT)](https://documentation.immuta.com/saas/developer-guides/api-intro/marketplace-api#generate-a-personal-access-token-pat) when using the Request app API. See the [Request app API docs](https://documentation.immuta.com/saas/developer-guides/api-intro/marketplace-api) for additional guidance or to download the OpenAPI YAML for your own client generation.

## Request access to a data product

> Create a new data access request for the specified data product

```json
{"openapi":"3.0.0","info":{"title":"Immuta Data Marketplace","version":"1.0"},"tags":[{"name":"Data Product","description":"APIs for managing data products"},{"name":"Access Request","description":"APIs for managing data access"}],"servers":[{"url":"https://{global-segment}.api.immutacloud.com/marketplace","description":"Marketplace API Endpoint","variables":{"global-segment":{"default":"na","enum":["na","eu","ap"],"description":"Marketplace API global segment"}}}],"security":[{"bearer":[]}],"components":{"securitySchemes":{"bearer":{"scheme":"bearer","bearerFormat":"JWT","type":"http"}},"schemas":{"CreateAccessRequest":{"type":"object","properties":{"user":{"type":"string","format":"uuid","description":"Immuta global user ID of the user for whom access is being requested"},"form":{"description":"The request form submission"}},"required":["user"]},"HydratedAccessRequest":{"type":"object","properties":{"id":{"type":"string","format":"cuid"},"requestingUser":{"type":"object","properties":{"id":{"type":"number"},"iamId":{"type":"string","description":"ID of the IAM the user is associated with"},"globalUserId":{"type":"string","format":"uuid","description":"Immuta global user ID"},"username":{"type":"string","description":"Username/login name for the user"},"name":{"type":"string","description":"Display name"},"email":{"type":"string","description":"Email address","nullable":true},"authorizations":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"required":["id","iamId","globalUserId","username","name"],"title":"Immuta User"},"user":{"type":"object","properties":{"id":{"type":"number"},"iamId":{"type":"string","description":"ID of the IAM the user is associated with"},"globalUserId":{"type":"string","format":"uuid","description":"Immuta global user ID"},"username":{"type":"string","description":"Username/login name for the user"},"name":{"type":"string","description":"Display name"},"email":{"type":"string","description":"Email address","nullable":true},"authorizations":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"required":["id","iamId","globalUserId","username","name"],"title":"Immuta User"},"formVersion":{"type":"string"},"form":{"description":"The request form submission"},"type":{"type":"string","enum":["DATA_ACCESS","MASKING_EXCEPTION"]},"metadata":{"description":"Metadata associated with the access request"},"status":{"type":"string","enum":["APPROVED","CANCELED","DENIED","PENDING","NONE","PUBLISHER","REVOKED","EXPIRED"]},"expiration":{"type":"string","format":"date-time","description":"When the temporary access will expire"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"dataProduct":{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"cuid"},{"type":"string","format":"uuid"}]},"name":{"type":"string","minLength":1,"maxLength":255,"pattern":"^[a-zA-Z0-9)(\\-_/\\\\\\s]*$","description":"Data product name"},"description":{"oneOf":[{"type":"string","description":"Data product description"}],"nullable":true,"description":"Data product description"}},"required":["id","name"]},"asset":{"discriminator":{"propertyName":"type"},"oneOf":[{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Asset ID"},"name":{"type":"string","minLength":1,"description":"Asset name"},"type":{"type":"string","enum":["DATA_PRODUCT"]},"createdAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"updatedAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"dagTagId":{"oneOf":[{"type":"number"}],"nullable":true},"requestId":{"type":"string","format":"cuid","description":"If requested, the ID of the access request for the asset"},"status":{"type":"string","enum":["APPROVED","CANCELED","DENIED","PENDING","NONE","PUBLISHER","REVOKED","EXPIRED"]},"metadata":{"type":"object","properties":{"subjectMatterExperts":{"default":[],"type":"array","items":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Immuta global user ID of the subject matter expert"},"username":{"type":"string"},"name":{"type":"string"}},"required":["id"]}},"domains":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Array of domain IDs associated with the data product"},"description":{"oneOf":[{"type":"string","description":"Data product description"}],"nullable":true,"description":"Data product description"}},"required":["domains"],"description":"Data product asset metadata"},"createdBy":{"type":"string","format":"uuid","description":"Immuta global user ID of the user who created the data product"}},"required":["id","name","type","metadata","createdBy"],"title":"Data Product Asset"},{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Asset ID"},"name":{"type":"string","minLength":1,"description":"Asset name"},"type":{"type":"string","enum":["DATA_OBJECT"]},"createdAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"updatedAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"dagTagId":{"oneOf":[{"type":"number"}],"nullable":true},"requestId":{"type":"string","format":"cuid","description":"If requested, the ID of the access request for the asset"},"status":{"type":"string","enum":["APPROVED","CANCELED","DENIED","PENDING","NONE","PUBLISHER","REVOKED","EXPIRED"]},"metadata":{"type":"object","properties":{"subjectMatterExperts":{"default":[],"type":"array","items":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Immuta global user ID of the subject matter expert"},"username":{"type":"string"},"name":{"type":"string"}},"required":["id"]}},"objectPath":{"type":"array","items":{"type":"string"}},"technology":{"type":"string","enum":["Snowflake","PostgreSQL","Databricks","Glue","MySQL","Teradata","MariaDB","Oracle","SQLServer","Trino","Redshift"]},"legacyType":{"type":"string"},"dataSourceId":{"type":"number"},"description":{"oneOf":[{"type":"string"}],"nullable":true},"externalLink":{"oneOf":[{"type":"string"}],"nullable":true}},"required":["objectPath"],"description":"Data object asset metadata"},"registered":{"default":true,"type":"boolean","description":"Whether the asset has been registered"}},"required":["id","name","type","metadata"],"title":"Data Object Asset"}],"title":"Asset"}},"required":["id","requestingUser","user","formVersion","type","status","createdAt","updatedAt"],"title":"Hydrated Access Request","description":"Access request with user and data product metadata"}}},"paths":{"/api/data-product/{id}/request":{"post":{"description":"Create a new data access request for the specified data product","operationId":"requestAccess","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HydratedAccessRequest"}}}}},"summary":"Request access to a data product","tags":["Data Product","Access Request"]}}}}
```

## Requesting a masking exception on a data product

The user can make a masking exception request from the [Request app](https://app.immutacloud.com/marketplace/data-products) or through a deep link URL to the request access screen which is provided in the data product or [constructed from scratch](https://documentation.immuta.com/saas/configure/how-to-guides/configure-access-request-links#access-request-links-for-data-products).

### With the UI

1. From the [**Data products** page](https://app.immutacloud.com/marketplace/data-products) click into the **Data product** you want access to, or click the request access URL for an external catalog.
2. Navigate to the **Columns** tab.
3. Click the **Request masking exception** button.
4. Use the checkboxes to select the masked columns you want unmasked access to and click **Next**.
5. Use the radio buttons to indicate if you are requesting access for yourself or someone else.
6. **Fill out your answer** to the access question(s).
7. Opt to review the columns and their tags again in the **Columns** tab.
8. Review and **select the checkbox** for the **Data use agreement** tab, if there is one.
9. Click **Submit request**.

### With the API

Ensure you set the [correct global segment](https://documentation.immuta.com/saas/developer-guides/api-intro/marketplace-api#base-path-and-global-segment) and use a [Request app personal access token (PAT)](https://documentation.immuta.com/saas/developer-guides/api-intro/marketplace-api#generate-a-personal-access-token-pat) when using the Request app API. See the [Request app API docs](https://documentation.immuta.com/saas/developer-guides/api-intro/marketplace-api) for additional guidance or to download the OpenAPI YAML for your own client generation.

## Request masking exception to columns in a data product

> Create a new masking exception request for specific columns in the specified data product

```json
{"openapi":"3.0.0","info":{"title":"Immuta Data Marketplace","version":"1.0"},"tags":[{"name":"Data Product","description":"APIs for managing data products"},{"name":"Access Request","description":"APIs for managing data access"}],"servers":[{"url":"https://{global-segment}.api.immutacloud.com/marketplace","description":"Marketplace API Endpoint","variables":{"global-segment":{"default":"na","enum":["na","eu","ap"],"description":"Marketplace API global segment"}}}],"security":[{"bearer":[]}],"components":{"securitySchemes":{"bearer":{"scheme":"bearer","bearerFormat":"JWT","type":"http"}},"schemas":{"CreateMaskingExceptionRequest":{"type":"object","properties":{"user":{"type":"string","format":"uuid","description":"Immuta global user ID of the user for whom access is being requested"},"form":{"description":"The request form submission"},"columns":{"type":"array","items":{"type":"object","properties":{"columnName":{"type":"string","description":"The name of the column to request masking exception for"},"sourceId":{"type":"string","description":"The ID of the data source this column belongs to"}},"required":["columnName","sourceId"],"description":"Column in the data source to request masking exception for"},"description":"List of columns to request masking exception for"}},"required":["user","columns"]},"HydratedAccessRequest":{"type":"object","properties":{"id":{"type":"string","format":"cuid"},"requestingUser":{"type":"object","properties":{"id":{"type":"number"},"iamId":{"type":"string","description":"ID of the IAM the user is associated with"},"globalUserId":{"type":"string","format":"uuid","description":"Immuta global user ID"},"username":{"type":"string","description":"Username/login name for the user"},"name":{"type":"string","description":"Display name"},"email":{"type":"string","description":"Email address","nullable":true},"authorizations":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"required":["id","iamId","globalUserId","username","name"],"title":"Immuta User"},"user":{"type":"object","properties":{"id":{"type":"number"},"iamId":{"type":"string","description":"ID of the IAM the user is associated with"},"globalUserId":{"type":"string","format":"uuid","description":"Immuta global user ID"},"username":{"type":"string","description":"Username/login name for the user"},"name":{"type":"string","description":"Display name"},"email":{"type":"string","description":"Email address","nullable":true},"authorizations":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}}}},"required":["id","iamId","globalUserId","username","name"],"title":"Immuta User"},"formVersion":{"type":"string"},"form":{"description":"The request form submission"},"type":{"type":"string","enum":["DATA_ACCESS","MASKING_EXCEPTION"]},"metadata":{"description":"Metadata associated with the access request"},"status":{"type":"string","enum":["APPROVED","CANCELED","DENIED","PENDING","NONE","PUBLISHER","REVOKED","EXPIRED"]},"expiration":{"type":"string","format":"date-time","description":"When the temporary access will expire"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"dataProduct":{"type":"object","properties":{"id":{"oneOf":[{"type":"string","format":"cuid"},{"type":"string","format":"uuid"}]},"name":{"type":"string","minLength":1,"maxLength":255,"pattern":"^[a-zA-Z0-9)(\\-_/\\\\\\s]*$","description":"Data product name"},"description":{"oneOf":[{"type":"string","description":"Data product description"}],"nullable":true,"description":"Data product description"}},"required":["id","name"]},"asset":{"discriminator":{"propertyName":"type"},"oneOf":[{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Asset ID"},"name":{"type":"string","minLength":1,"description":"Asset name"},"type":{"type":"string","enum":["DATA_PRODUCT"]},"createdAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"updatedAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"dagTagId":{"oneOf":[{"type":"number"}],"nullable":true},"requestId":{"type":"string","format":"cuid","description":"If requested, the ID of the access request for the asset"},"status":{"type":"string","enum":["APPROVED","CANCELED","DENIED","PENDING","NONE","PUBLISHER","REVOKED","EXPIRED"]},"metadata":{"type":"object","properties":{"subjectMatterExperts":{"default":[],"type":"array","items":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Immuta global user ID of the subject matter expert"},"username":{"type":"string"},"name":{"type":"string"}},"required":["id"]}},"domains":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Array of domain IDs associated with the data product"},"description":{"oneOf":[{"type":"string","description":"Data product description"}],"nullable":true,"description":"Data product description"}},"required":["domains"],"description":"Data product asset metadata"},"createdBy":{"type":"string","format":"uuid","description":"Immuta global user ID of the user who created the data product"}},"required":["id","name","type","metadata","createdBy"],"title":"Data Product Asset"},{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Asset ID"},"name":{"type":"string","minLength":1,"description":"Asset name"},"type":{"type":"string","enum":["DATA_OBJECT"]},"createdAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"updatedAt":{"oneOf":[{"type":"string","format":"date-time"},{"type":"string","format":"date-time"}]},"dagTagId":{"oneOf":[{"type":"number"}],"nullable":true},"requestId":{"type":"string","format":"cuid","description":"If requested, the ID of the access request for the asset"},"status":{"type":"string","enum":["APPROVED","CANCELED","DENIED","PENDING","NONE","PUBLISHER","REVOKED","EXPIRED"]},"metadata":{"type":"object","properties":{"subjectMatterExperts":{"default":[],"type":"array","items":{"type":"object","properties":{"id":{"type":"string","format":"uuid","description":"Immuta global user ID of the subject matter expert"},"username":{"type":"string"},"name":{"type":"string"}},"required":["id"]}},"objectPath":{"type":"array","items":{"type":"string"}},"technology":{"type":"string","enum":["Snowflake","PostgreSQL","Databricks","Glue","MySQL","Teradata","MariaDB","Oracle","SQLServer","Trino","Redshift"]},"legacyType":{"type":"string"},"dataSourceId":{"type":"number"},"description":{"oneOf":[{"type":"string"}],"nullable":true},"externalLink":{"oneOf":[{"type":"string"}],"nullable":true}},"required":["objectPath"],"description":"Data object asset metadata"},"registered":{"default":true,"type":"boolean","description":"Whether the asset has been registered"}},"required":["id","name","type","metadata"],"title":"Data Object Asset"}],"title":"Asset"}},"required":["id","requestingUser","user","formVersion","type","status","createdAt","updatedAt"],"title":"Hydrated Access Request","description":"Access request with user and data product metadata"}}},"paths":{"/api/data-product/{id}/request/masking-exception":{"post":{"description":"Create a new masking exception request for specific columns in the specified data product","operationId":"requestMaskingException","parameters":[{"name":"id","required":true,"in":"path","schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMaskingExceptionRequest"}}}},"responses":{"201":{"description":"","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HydratedAccessRequest"}}}}},"summary":"Request masking exception to columns in a data product","tags":["Data Product","Access Request"]}}}}
```