Requesting Access to a Data Product

Request access to a data product or request a masking exception

Data consumers can request two types of access:

• Data access requests: These access requests grant permission to query the data sources in a data product.
• Masking exception requests: These access requests grant permission to see unmasked values in specific columns of a data product that are normally protected by a masking policy.

From either the data product Details or Columns tab, consumers can create one of these access requests:

• If approval is not required, access (or the masking exception) is automatically granted once the user acknowledges the data use agreement and answers any required question(s).
• If approval is required, the request will enter the approval flow and appear as Pending.

Once a request is approved, Immuta automatically provisions access through policies in the data platform and the access request will show as Approved:

• For data access requests, the data product itself becomes available to query.
• For masking exception requests, only the approved columns are unmasked for that user, while all other users continue to see masked values.

Data consumers can filter the Data products page by request state (Approved, Pending, Denied) to quickly see which data products or exceptions they already have access to.

Requesting data access to a data product

The user can request data access from the Request app or through a deep link URL to the request access screen which is provided in the data product or constructed from scratch.

With the UI

1. From the Data products page click into the Data product you want access to, or click the request access URL for an external catalog.
2. Click the Request access button.
3. Use the radio buttons to show if you are requesting access for yourself or someone else.
4. Fill out your answer to the access question(s).
5. Opt to review the information about existing policies on the Data sources tab.
6. Review and select the checkbox for the Data use agreement tab, if there is one.
7. Click Submit request.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Request access to a data product

post

Create a new data access request for the specified data product

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Body

userstring · uuidRequired

Immuta global user ID of the user for whom access is being requested

formanyOptional

The request form submission

Responses

201Success

application/json

Access request with user and data product metadata

idstring · cuidRequired

formVersionstringRequired

formanyOptional

The request form submission

typestring · enumRequiredExample: DATA_ACCESSPossible values:

metadataanyOptional

Metadata associated with the access request

statusstring · enumRequiredExample: PENDINGPossible values:

expirationstring · date-timeOptional

When the temporary access will expire

createdAtstring · date-timeRequired

updatedAtstring · date-timeRequired

post/api/data-product/{id}/request

POST /marketplace/api/data-product/{id}/request HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "user": "123e4567-e89b-12d3-a456-426614174000",
  "form": null
}

201Success

{
  "id": "text",
  "requestingUser": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "user": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "formVersion": "text",
  "form": null,
  "type": "DATA_ACCESS",
  "metadata": null,
  "status": "PENDING",
  "expiration": "2026-01-01T00:00:00.000Z",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "updatedAt": "2026-01-01T00:00:00.000Z",
  "dataProduct": {
    "id": "text",
    "name": "text",
    "description": "All sales records from the current fiscal year"
  },
  "asset": {
    "id": "text",
    "type": "DATA_OBJECT",
    "name": "text",
    "metadata": {
      "subjectMatterExperts": [
        {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "username": "text",
          "name": "text"
        }
      ],
      "objectPath": [
        "text"
      ],
      "technology": "Snowflake",
      "host": "text",
      "port": 1,
      "legacyType": "text",
      "dataSourceId": 1,
      "description": "text",
      "externalLink": "text"
    }
  }
}

Requesting a masking exception on a data product

The user can make a masking exception request from the Request app or through a deep link URL to the request access screen which is provided in the data product or constructed from scratch.

With the UI

1. From the Data products page click into the Data product you want access to, or click the request access URL for an external catalog.
2. Navigate to the Columns tab.
3. Click the Request masking exception button.
4. Use the checkboxes to select the masked columns you want unmasked access to and click Next.
5. Use the radio buttons to indicate if you are requesting access for yourself or someone else.
6. Fill out your answer to the access question(s).
7. Opt to review the columns and their tags again in the Columns tab.
8. Review and select the checkbox for the Data use agreement tab, if there is one.
9. Click Submit request.

With the API

Ensure you set the correct global segment and use a Request app personal access token (PAT) when using the Request app API. See the Request app API docs for additional guidance or to download the OpenAPI YAML for your own client generation.

Request masking exception to columns in a data product

post

Create a new masking exception request for specific columns in the specified data product

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

idstringRequired

Body

userstring · uuidRequired

Immuta global user ID of the user for whom access is being requested

formanyOptional

The request form submission

Responses

201Success

application/json

Access request with user and data product metadata

idstring · cuidRequired

formVersionstringRequired

formanyOptional

The request form submission

typestring · enumRequiredExample: DATA_ACCESSPossible values:

metadataanyOptional

Metadata associated with the access request

statusstring · enumRequiredExample: PENDINGPossible values:

expirationstring · date-timeOptional

When the temporary access will expire

createdAtstring · date-timeRequired

updatedAtstring · date-timeRequired

post/api/data-product/{id}/request/masking-exception

POST /marketplace/api/data-product/{id}/request/masking-exception HTTP/1.1
Host: na.api.immutacloud.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 111

{
  "user": "123e4567-e89b-12d3-a456-426614174000",
  "form": null,
  "columns": [
    {
      "columnName": "text",
      "sourceId": "text"
    }
  ]
}

201Success

{
  "id": "text",
  "requestingUser": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "user": {
    "id": 1,
    "iamId": "text",
    "globalUserId": "123e4567-e89b-12d3-a456-426614174000",
    "username": "text",
    "name": "text",
    "email": "text",
    "authorizations": {
      "ANY_ADDITIONAL_PROPERTY": [
        "text"
      ]
    }
  },
  "formVersion": "text",
  "form": null,
  "type": "DATA_ACCESS",
  "metadata": null,
  "status": "PENDING",
  "expiration": "2026-01-01T00:00:00.000Z",
  "createdAt": "2026-01-01T00:00:00.000Z",
  "updatedAt": "2026-01-01T00:00:00.000Z",
  "dataProduct": {
    "id": "text",
    "name": "text",
    "description": "All sales records from the current fiscal year"
  },
  "asset": {
    "id": "text",
    "type": "DATA_OBJECT",
    "name": "text",
    "metadata": {
      "subjectMatterExperts": [
        {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "username": "text",
          "name": "text"
        }
      ],
      "objectPath": [
        "text"
      ],
      "technology": "Snowflake",
      "host": "text",
      "port": 1,
      "legacyType": "text",
      "dataSourceId": 1,
      "description": "text",
      "externalLink": "text"
    }
  }
}