Security/permissions: 403 exposing timeseries externalIds and datamodel returning datapoints from unauthorized timeseries

​@Soumaya ZAMMIT I will check on this with the engineering team and get back to you with an update.

Hi ​@Soumaya ZAMMIT !

I can provide some clarity on both points.

1. ExternalIds in 403 error messages

What you're observing is the current intended behavior. Our API is designed to distinguish between a resource that doesn't exist and a resource that exists but you don't have permission to access. Including the identifier in the 403 error is part of how the API confirms which specific resource access was denied for.

We understand your concern about exposing externalIds that you consider sensitive, but changing this behavior now would be a significant breaking change for many existing applications that rely on this error structure for their logic.

However, we can transform this request into a Product Idea here in the Hub. If it gathers enough interest across our customers, we can investigate potential future changes.

2. Data model queries and Time series permissions

This is also the expected behavior, and it relates on how access control is designed to work with Data Models.

When you query a resource directly, like a time series, permissions are checked against that specific resource (e.g., its dataset). However, when you query a data model, the access control check is performed on the data model instance itself, not on the individual time series linked to it. When managing CogniteTimeSeries (representation of Time series in a data model), you should not rely on datasets but instead use spaces for access control.

You can read more about access control for CogniteTimeSeries here: https://docs.cognite.com/cdf/dm/dm_guides/dm_integrate_with_time_series/#access-control

Thanks for the helpful explanations ​@Everton Colling !

Could you please provide migration suggestions for existing data models that reference sensitive timeseries, specifically showing how to enforce group-based access controls for those sensitive data?

I suggest reaching out to your Cognite account manager for guidance on this topic, as this would require careful evaluation on your specific solution architecture and potential migration paths.