Set Object Policy for a Scheduler

You can set a policy for an individual object and restrict users or groups from accessing the object. This overrides the access granted to the object at the account-level in the Control Panel. For more information, see Managing Roles.

Managing Scheduler Permissions through the UI describes how to set schedule permissions through the QDS UI.

PUT /api/v1.2/object_policy/policy

Use this API to set an object policy. Qubole supports object policy API on notebooks, clusters, and scheduler. This section describes setting an object policy for a schedule.

Note

If you allow a user with a permission who is part of the group that has restricted access, then that user is allowed access and vice versa. For more information, see Understanding the Precedence of Scheduler Permissions.

Required Role

The following users can make this API call:

  • Users who belong to the system-admin group or owner of the object.
  • Users who belong to a group associated with a role that allows setting an object policy. See Managing Groups and Managing Roles for more information.

Parameters

Note

Parameters marked in bold are mandatory. Others are optional and have default values.

Parameter Description
source_id It specifies the ID of the object based on the source_type.
source_type It specifies the object. It must be a scheduler for a schedule.
policy

Array of policies to be assigned to a schedule. Each policy include following parameters:

Note

Escape the values of policy elements and corresponding values except the user ID value and group ID value.

  • action: Name of the action with particular resource. The actions can be read, update, delete, manage, or all. The actions imply as given below:
    • read: This action is set to allow/deny a user/group to view the object.
    • update: This action is set to allow/deny a user/group to edit the object.
    • delete: This action is set to allow/deny a user/group to delete the object.
    • manage: This action allows the user/group to manage the schedule’s permissions.
    • all: This action is set to allow/deny a user/group to do read/edit/delete the object. It gets the lowest priority always. That is read, update, and delete actions get precedence over the all action.
  • access: It is set to allow or deny actions. Its value is either allow or deny.
  • condition: Array of user IDs and group IDs that have to be assigned with this policy:
    • qbol_users: An array of IDs of the user for whom this policy needs to be set. But these IDs are not similar to user IDs and create a ticket with Qubole Support to get the user IDs.
    • qbol_groups: An array of IDs of the groups for whom this policy needs to be set.

Request API Syntax

curl -X PUT -H "X-AUTH-TOKEN: <API-TOKEN>" -H "Content-Type: application/json" -H "Accept: application/json" \
-d '{"source_id":"<Object_ID>", "source_type": "<Object>",
      "policy": "[{\"access\":\"<Access>\",\"condition\":{\"qbol_users\":[<User ID>]},\"action\":[\"<Actions>\"]},
                 {\"access\":\"<Access>\",\"condition\":{\"qbol_groups\":[<Group ID>]},\"action\":[\"<Actions>\"]},
                 {\"access\":\"<Access>\",\"condition\":{\"qbol_users\":[<User ID>],\"qbol_groups\":[<Group ID>]},\"action\":[\"<Actions>\"]}]"}' \
"https://gcp.qubole.com/api/v1.2/object_policy/policy"

Sample API Request

Here is a sample API call to set an object policy for a schedule with its ID as 140.

curl -X PUT -H "X-AUTH-TOKEN: <API-TOKEN>" -H "Content-Type: application/json" -H "Accept: application/json" \
-d '{"source_id":"140", "source_type": "scheduler",
      "policy": "[{\"access\":\"allow\",\"condition\":{\"qbol_users\":[1715]},\"action\":[\"read\"]},
                 {\"access\":\"allow\",\"condition\":{\"qbol_groups\":[2352]},\"action\":[\"read\",\"update\"]},
                 {\"access\":\"deny\",\"condition\":{\"qbol_users\":[1715],\"qbol_groups\":[2352]},\"action\":[\"all\"]}]"}' \
"https://gcp.qubole.com/api/v1.2/object_policy/policy"