Timseries Subscriptions Acl

Hi!
We have some documentation about the ACL for time series subscriptions here: https://api-docs.cognite.com/20230101-alpha/tag/Data-point-subscriptions
 

timeSeriesSubscriptionsAcl should work.

Hi, thank you for identifying the correct Acl.

The documentation you linked to (https://api-docs.cognite.com/20230101-alpha/tag/Data-point-subscriptions) happens to mention the name of the Acl in this case. However I noticed that it doesn’t list all Acls, and as far as I know there is no complete documentation of this. As users of the CDF toolkit, this is needed. Does this documentation exist, and if not, can it be created?

Hi!

In the API docs for groups, there is a list of capabilities.

https://api-docs.cognite.com/20230101/tag/Groups/operation/createGroups

If you expand items and capabilities, you can see the different capabilities and which scopes are available for each capability.

I also see that I unfortunately sent you the -alpha documentation earlier. You can select the version of the API in the upper left corner. There is not difference between the stable and alpha versions for anything we have discussed in this thread.

I think we have a miscommunication. Let me offer an example to see if we are aligned. Let’s say I want to set up access to time series, and I don’t know the name of the Acl, the options for scoping, or the correct format of these items (needed for ingestion by the CDF Toolkit for CI/CD). Where can I find documentation about that?

These are the kinds of answers I would need to locate:

name of capability Acl: 

`timeSeriesAcl`

    possible actions:

    - READ

    - WRITE

    possible scopes:

    scope:

      idscope:

        ids:

    scope:

      assetRootIdScope:

        rootIds:

    scope:

      datasetScope:

        ids:

From the Data point subscriptions API documentation: 

Access control: You need READ access to subscriptions ACL to read/list subscriptions or list data, and you need WRITE access to create/update/delete subscriptions. Furthermore, you need READ access to the time series you want to get updates from. For filter subscriptions, you either need READ access to all time series, or the filter must be restricted according to your access rights (e.g. by filtering on specific data set IDs).

Subscriptions can have data sets that allow for more granular access control. The data set on a subscription does not influence the data stream, but allows you to restrict who can read/update the subscription.

[
    {"timeSeriesAcl":{"actions":["READ"], "scope":{"all":{}}}},
    {"timeSeriesSubscriptionsAcl":{"actions":["WRITE", "READ"], "scope":{"all":{}}}}
]

Note the comment about data sets and how they can be used to improve the granularity of the access control for subscriptions.

Hth.

Yes, you can see that some the answers I listed in my last post are not included in the documentation you have referenced. It is incomplete documentation, and we notice this by the trial and error we have to endure when we deploy our yaml scripts - we have to guess. Users need the formatting and options to be made explicit.

Thank you for sharing the proposed formatting. Will work on improving the information.

We’re rolling out an update to the documentation. Should be available next week.