Specifies the policy access type and restriction level. See the for details.

Required

-

-

staged boolean

When true, the policy is not active or applied to any data sources.

Required

-

• true

• false

This object specifies the conditions under which the policy applies to a data source. Set the value to null to enforce the policy only when it is applied by data owners. Do not include this object in your payload to apply the policy to all data sources. See the for additional parameters and details.

Optional

By default, the policy applies to all data sources.

-

shareResponsibility boolean

When true, users need to meet the conditions in this policy OR another share responsibility policy that applies to the data source. This parameter is not applicable to policies with actions.subscriptionType with a value of manual. When

Optional

When subscriptionType is policy, shareResponsibility is true. When subscriptionType is guardrail, shareResponsibility is false.

• true

• false

subscriptionType string

The restriction level of the subscription policy.

Required

-

• approval: Users are granted access when approved by a specified user

• automatic: Anyone is granted access

• manual

columnRegex.regex string

A regular expression that matches names of columns.

Required when type is columnRegex.

-

-

columnRegex.caseInsensitive boolean

When true, the regular expression is case insensitive.

Optional

false

• true

• false

columnTag object

This object specifies the column tags required for the policy to apply to the data source. Child parameters are outlined below.

Required if type is columnTags.

-

-

columnTag.name string

The name of the tag.

Required if type is columnTags

-

-

columnTag.displayName string

The display name of the tag.

Optional

-

-

columnTag.hasLeafNodes boolean

When true, the tag applied has child tags.

Optional

-

-

server string

The server that contains the data sources the policy should be applied to.

Required when type is server.

-

-

startDate string

Applies the policy to data sources created on or after this startDate and before the endDate (if the endDate is specified).

Required when type is time.

-

-

endDate string

Applies the policy to data sources created on or before this endDate and after the startDate.

Optional

null

-

id integer

The unique identifier of the policy.

type string

The type of policy. For write access policies, the type is subscription.

name string

The name of the policy.

template boolean

Specifies whether or not the policy is available as a template.

certification object

The certification object only applies to data policies, not write access policies.

actions array[]

Specifies the policy access type and restriction level.

actions.type string

The type of policy. For write access policies, the type is subscription.

actions.accessGrant string

The type of access the user is granted. For write access policies, actions.accessGrant is WRITE.

actions.description string

The description of the policy.

actions.allowDiscovery boolean

When true, users can still see that the data source exists in Immuta, even if they do not have the attributes and groups specified by the policy.

actions.subscriptionType string

The restriction level of the subscription policy.

actions.shareResponsibility boolean

When true, users need to meet the conditions in this policy OR another share responsibility policy that applies to the data source. This parameter is not applicable to policies with actions.subscriptionType with a value of manual. When

actions.automaticSubscription boolean

When true, users will automatically be subscribed to the data source when they meet the conditions specified in the policy. This parameter is not applicable to policies with actions.subscriptionType with a value of manual.

staged boolean

When true, the policy is staged and not active on any data sources.

circumstances array[]

Specifies the conditions under which the policy applies to a data source. See the for child parameters.

profile integer

The unique identifier of the user who has been granted write access.

group string

The name of the group that has been granted write access, when applicable.

policy boolean

When true, the access has been granted by a policy on the data source.

expiration string

The date the user's access expires.

acknowledgeRequired boolean

When true, the users must manually request access to the data source.

createdAt string

The date and time the user's access to the data source was granted.

updatedAt string

The date and time the user's access to the data source was updated.

accessGrant string

The type of access the user has to the data source: READ or WRITE.

approved boolean

When true, the user's access to the data source has been approved.