Appearance
Governance API
47 operations. Paths are relative to the API host (http://localhost:5080 in local development). Every operation accepts an OIDC bearer token (Authorization: Bearer …) or a workspace API key (X-Api-Key: keel_live_…); errors are RFC 9457 Problem Details with a code (error codes). Permissions: matrix.
| Method | Path | Summary |
|---|---|---|
| GET | /api/v1/workspaces/{workspaceId}/certification | A metric's certification level, dates, at-risk flag and every criterion checked now. |
| POST | /api/v1/workspaces/{workspaceId}/certification:certify | Certify (or renew) a metric that meets every criterion (stewards and admins); it expires after the validity period. |
| POST | /api/v1/workspaces/{workspaceId}/certification:request | Request certification of a metric; 422 Governance.CertificationCriteriaNotMet lists the unmet criteria in details. |
| POST | /api/v1/workspaces/{workspaceId}/certification:revoke | Revoke a certification (back to Draft) or deprecate the metric. |
| GET | /api/v1/workspaces/{workspaceId}/certification/settings | The tenant's certification criteria and validity period. |
| PUT | /api/v1/workspaces/{workspaceId}/certification/settings | Change the tenant's certification criteria (Owners; audited). |
| GET | /api/v1/workspaces/{workspaceId}/domains | Business domains, parents before children. |
| POST | /api/v1/workspaces/{workspaceId}/domains | Create a business domain, optionally under a parent. |
| GET | /api/v1/workspaces/{workspaceId}/glossary:export | Download the glossary as CSV (default) or JSON, in the import format. |
| POST | /api/v1/workspaces/{workspaceId}/glossary:import | Import terms from CSV or JSON text (stewards and admins); returns counts and row errors. |
| GET | /api/v1/workspaces/{workspaceId}/glossary/search | Full-text and trigram search over terms (a synonym finds its canonical term first) and model assets. |
| GET | /api/v1/workspaces/{workspaceId}/glossary/suggestions | Term and synonym suggestions (default: awaiting a decision), merges first. |
| POST | /api/v1/workspaces/{workspaceId}/glossary/suggestions:generate | Refresh suggestions from the models' business names now (they also refresh on every release). |
| POST | /api/v1/workspaces/{workspaceId}/glossary/suggestions/{suggestionId}:accept | Create the suggested Draft term, or add the suggested synonyms to the existing term. |
| POST | /api/v1/workspaces/{workspaceId}/glossary/suggestions/{suggestionId}:reject | Dismiss a suggestion; it is not proposed again. |
| GET | /api/v1/workspaces/{workspaceId}/glossary/terms | Glossary terms by name (Page<T>), optionally by status, domain or a name/synonym filter. |
| POST | /api/v1/workspaces/{workspaceId}/glossary/terms | Create a Draft term. |
| GET | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId} | A term with its people, related terms and the assets it is linked to. |
| PUT | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId} | Replace a term's content (approved terms: stewards and admins only; deprecated terms are frozen). |
| POST | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}:approve | Approve a term in review (stewards and admins; audited). |
| POST | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}:deprecate | Deprecate a term; 422 Governance.ReplacementRequired when it is linked to certified metrics and no replacement is given. |
| POST | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}:submit | Submit a Draft term for review. |
| POST | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}/links | Link the term to a metric, entity, dimension, measure, table or column. |
| DELETE | /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}/links | Remove a link (the asset is a query parameter: asset references contain slashes). |
| GET | /api/v1/workspaces/{workspaceId}/governance/assets | Governed assets with their effective owner, domain and linked terms (asset picker). |
| GET | /api/v1/workspaces/{workspaceId}/governance/summary | Governance dashboard counts: unowned assets, terms by status, pending suggestions, certified metrics without an approved term. |
| GET | /api/v1/workspaces/{workspaceId}/metrics | The metrics catalog: every metric with its certification level, trust and owner. |
| GET | /api/v1/workspaces/{workspaceId}/models/{modelId}/metrics/{metric} | A metric with its definition, lineage, glossary terms and certification status. |
| GET | /api/v1/workspaces/{workspaceId}/ownership | Ownership assignments (optionally of one asset). |
| PUT | /api/v1/workspaces/{workspaceId}/ownership | Assign the owner, stewards and domain of an asset. |
| POST | /api/v1/workspaces/{workspaceId}/ownership:bulk | Assign an owner and stewards to every entity, metric and table of a domain or a source schema. |
| GET | /api/v1/workspaces/{workspaceId}/ownership/unowned | Entities, metrics and scanned tables without an owner (Page<T>). |
| GET | /api/v1/workspaces/{workspaceId}/policies | Access policies and Keel's suggestions, by priority then name (stewards and admins). |
| POST | /api/v1/workspaces/{workspaceId}/policies | Create a column mask, row filter or deny policy (audited). |
| POST | /api/v1/workspaces/{workspaceId}/policies:apply-default | One-click fix: accept (or create) and enable the default Restricted-column mask. |
| GET | /api/v1/workspaces/{workspaceId}/policies:coverage | Restricted columns that Analysts still see unmasked. |
| GET | /api/v1/workspaces/{workspaceId}/policies:effective | Policies on one model object for a user (default: you; others need Govern). |
| POST | /api/v1/workspaces/{workspaceId}/policies:impact | Blast radius of a draft policy (nothing is stored): columns, entities and metrics it would touch, and the exports of those models. |
| POST | /api/v1/workspaces/{workspaceId}/policies:simulate | View as a member or role: the policies that apply on the model and why, with the effective filters, masks and hidden assets. Compile or run the model's query with viewAs for the SQL and the preview rows. |
| POST | /api/v1/workspaces/{workspaceId}/policies:suggest | Propose the default mask for Restricted columns (F11 FR4) when none exists. |
| GET | /api/v1/workspaces/{workspaceId}/policies/{policyId} | One access policy. |
| PUT | /api/v1/workspaces/{workspaceId}/policies/{policyId} | Replace a policy's definition (before/after audited). |
| DELETE | /api/v1/workspaces/{workspaceId}/policies/{policyId} | Delete a policy (audited). |
| POST | /api/v1/workspaces/{workspaceId}/policies/{policyId}:accept | Accept a policy Keel suggested: it is enabled and enforced. |
| POST | /api/v1/workspaces/{workspaceId}/policies/{policyId}:disable | Stop enforcing a policy (it is kept). |
| POST | /api/v1/workspaces/{workspaceId}/policies/{policyId}:enable | Enforce an accepted policy. |
| POST | /api/v1/workspaces/{workspaceId}/policies/{policyId}:reject | Reject a policy Keel suggested; it is not proposed again. |
GetCertificationStatus
http
GET /api/v1/workspaces/{workspaceId}/certificationA metric's certification level, dates, at-risk flag and every criterion checked now.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
assetRef | query | string | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | CertificationStatusDto |
Response 200: CertificationStatusDto
| Field | Type | Notes |
|---|---|---|
assetRef | string | |
atRisk | boolean | |
certifiedAt | date-time? | |
certifiedBy | PersonDto? | |
criteria | CriterionResult[] | |
expiresAt | date-time? | |
level | CertificationLevel | One of Draft, Reviewed, Certified, Deprecated |
requestedAt | date-time? | |
requestedBy | PersonDto? | |
revokedReason | string? | |
tracked | boolean |
CertifyMetric
http
POST /api/v1/workspaces/{workspaceId}/certification:certifyCertify (or renew) a metric that meets every criterion (stewards and admins); it expires after the validity period.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): CertificationRequest
| Field | Type | Notes |
|---|---|---|
assetRef | string | A metric: metric:{modelId}/{name}. |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
| 422 | Unprocessable Entity | ProblemDetails |
RequestCertification
http
POST /api/v1/workspaces/{workspaceId}/certification:requestRequest certification of a metric; 422 Governance.CertificationCriteriaNotMet lists the unmet criteria in details.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): CertificationRequest
| Field | Type | Notes |
|---|---|---|
assetRef | string | A metric: metric:{modelId}/{name}. |
| Status | Description | Body |
|---|---|---|
| 200 | OK | CertificationRequestedDto |
| 422 | Unprocessable Entity | ProblemDetails |
Response 200: CertificationRequestedDto
| Field | Type | Notes |
|---|---|---|
level | CertificationLevel | One of Draft, Reviewed, Certified, Deprecated |
RevokeCertification
http
POST /api/v1/workspaces/{workspaceId}/certification:revokeRevoke a certification (back to Draft) or deprecate the metric.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): RevokeCertificationRequest
| Field | Type | Notes |
|---|---|---|
assetRef | string | |
deprecate | boolean? | Deprecate the metric instead of returning it to Draft. |
reason | string? |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
GetCertificationSettings
http
GET /api/v1/workspaces/{workspaceId}/certification/settingsThe tenant's certification criteria and validity period.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | CertificationRules |
Response 200: CertificationRules
| Field | Type | Notes |
|---|---|---|
minTrustScore | int32? | |
requireApprovedTerm | boolean | |
requireDescription | boolean | |
requireOwner | boolean | |
requirePassingCriticalRules | boolean | |
requireStewardApproval | boolean | |
validityDays | int32 |
UpdateCertificationSettings
http
PUT /api/v1/workspaces/{workspaceId}/certification/settingsChange the tenant's certification criteria (Owners; audited).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): CertificationRules
| Field | Type | Notes |
|---|---|---|
minTrustScore | int32? | |
requireApprovedTerm | boolean | |
requireDescription | boolean | |
requireOwner | boolean | |
requirePassingCriticalRules | boolean | |
requireStewardApproval | boolean | |
validityDays | int32 |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
ListDomains
http
GET /api/v1/workspaces/{workspaceId}/domainsBusiness domains, parents before children.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | DomainDto[] |
CreateDomain
http
POST /api/v1/workspaces/{workspaceId}/domainsCreate a business domain, optionally under a parent.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): CreateDomainRequest
| Field | Type | Notes |
|---|---|---|
description | string? | |
name | string | |
owners | string[]? | |
parentId | uuid? |
| Status | Description | Body |
|---|---|---|
| 201 | Created | CreatedResponse |
Response 201: CreatedResponse
| Field | Type | Notes |
|---|---|---|
id | uuid |
ExportGlossary
http
GET /api/v1/workspaces/{workspaceId}/glossary:exportDownload the glossary as CSV (default) or JSON, in the import format.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
format | query | GlossaryFileFormat | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | string |
ImportGlossary
http
POST /api/v1/workspaces/{workspaceId}/glossary:importImport terms from CSV or JSON text (stewards and admins); returns counts and row errors.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): ImportGlossaryRequest
| Field | Type | Notes |
|---|---|---|
content | string | |
format | GlossaryFileFormat | One of Csv, Json |
| Status | Description | Body |
|---|---|---|
| 200 | OK | ImportResultDto |
Response 200: ImportResultDto
| Field | Type | Notes |
|---|---|---|
created | int32 | |
errors | string[] | |
skipped | int32 | |
updated | int32 |
SearchGlossary
http
GET /api/v1/workspaces/{workspaceId}/glossary/searchFull-text and trigram search over terms (a synonym finds its canonical term first) and model assets.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
q | query | string | yes | |
limit | query | int32 | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | GlossarySearchDto |
Response 200: GlossarySearchDto
| Field | Type | Notes |
|---|---|---|
assets | AssetHitDto[] | |
query | string | |
terms | TermHitDto[] |
ListTermSuggestions
http
GET /api/v1/workspaces/{workspaceId}/glossary/suggestionsTerm and synonym suggestions (default: awaiting a decision), merges first.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
status | query | ProposalStatus | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | TermSuggestionDto[] |
GenerateTermSuggestions
http
POST /api/v1/workspaces/{workspaceId}/glossary/suggestions:generateRefresh suggestions from the models' business names now (they also refresh on every release).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 202 | Accepted | SuggestionsQueuedDto |
Response 202: SuggestionsQueuedDto
| Field | Type | Notes |
|---|---|---|
jobId | uuid |
AcceptTermSuggestion
http
POST /api/v1/workspaces/{workspaceId}/glossary/suggestions/{suggestionId}:acceptCreate the suggested Draft term, or add the suggested synonyms to the existing term.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
suggestionId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | SuggestionAcceptedDto |
Response 200: SuggestionAcceptedDto
| Field | Type | Notes |
|---|---|---|
termId | uuid |
RejectTermSuggestion
http
POST /api/v1/workspaces/{workspaceId}/glossary/suggestions/{suggestionId}:rejectDismiss a suggestion; it is not proposed again.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
suggestionId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
ListGlossaryTerms
http
GET /api/v1/workspaces/{workspaceId}/glossary/termsGlossary terms by name (Page<T>), optionally by status, domain or a name/synonym filter.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
status | query | TermStatus | no | |
domainId | query | uuid | no | |
filter | query | string | no | |
page | query | int32 | no | |
pageSize | query | int32 | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PagedResultOfTermSummaryDto |
Response 200: PagedResultOfTermSummaryDto
| Field | Type | Notes |
|---|---|---|
hasNext | boolean | |
items | TermSummaryDto[] | |
page | int32 | |
pageSize | int32 | |
totalCount | int64 |
CreateGlossaryTerm
http
POST /api/v1/workspaces/{workspaceId}/glossary/termsCreate a Draft term.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): TermRequest
| Field | Type | Notes |
|---|---|---|
definition | string? | |
domainId | uuid? | |
name | string | |
owner | string? | |
relatedTermIds | uuid[]? | |
stewards | string[]? | |
synonyms | string[]? |
| Status | Description | Body |
|---|---|---|
| 201 | Created | CreatedResponse |
Response 201: CreatedResponse
| Field | Type | Notes |
|---|---|---|
id | uuid |
GetGlossaryTerm
http
GET /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}A term with its people, related terms and the assets it is linked to.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | TermDto |
Response 200: TermDto
| Field | Type | Notes |
|---|---|---|
approvedAt | date-time? | |
approvedBy | PersonDto? | |
createdAt | date-time | |
definition | string | |
deprecationReason | string? | |
domain | string? | |
domainId | uuid? | |
id | uuid | |
links | TermLinkDto[] | |
name | string | |
origin | Origin | One of Discovered, Inferred, LlmSuggested, UserDefined, Imported |
owner | PersonDto? | |
related | RelatedTermDto[] | |
replacement | RelatedTermDto? | |
status | TermStatus | One of Draft, InReview, Approved, Deprecated |
stewards | PersonDto[] | |
submittedAt | date-time? | |
submittedBy | PersonDto? | |
synonyms | string[] | |
updatedAt | date-time? |
UpdateGlossaryTerm
http
PUT /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}Replace a term's content (approved terms: stewards and admins only; deprecated terms are frozen).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes |
Request body (application/json): TermRequest
| Field | Type | Notes |
|---|---|---|
definition | string? | |
domainId | uuid? | |
name | string | |
owner | string? | |
relatedTermIds | uuid[]? | |
stewards | string[]? | |
synonyms | string[]? |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
ApproveGlossaryTerm
http
POST /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}:approveApprove a term in review (stewards and admins; audited).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
DeprecateGlossaryTerm
http
POST /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}:deprecateDeprecate a term; 422 Governance.ReplacementRequired when it is linked to certified metrics and no replacement is given.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes |
Request body (application/json): DeprecateTermRequest
| Field | Type | Notes |
|---|---|---|
reason | string? | |
replacementTermId | uuid? | Required when the term is linked to certified metrics (F09 AC2). |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
| 422 | Unprocessable Entity | ProblemDetails |
SubmitGlossaryTerm
http
POST /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}:submitSubmit a Draft term for review.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
LinkGlossaryTerm
http
POST /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}/linksLink the term to a metric, entity, dimension, measure, table or column.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes |
Request body (application/json): LinkTermRequest
| Field | Type | Notes |
|---|---|---|
assetRef | string | See docs/02 §6, e.g. metric:{modelId}/net_revenue or model:{modelId}/entity:customer. |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
UnlinkGlossaryTerm
http
DELETE /api/v1/workspaces/{workspaceId}/glossary/terms/{termId}/linksRemove a link (the asset is a query parameter: asset references contain slashes).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
termId | path | uuid | yes | |
assetRef | query | string | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
ListGovernedAssets
http
GET /api/v1/workspaces/{workspaceId}/governance/assetsGoverned assets with their effective owner, domain and linked terms (asset picker).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
filter | query | string | no | |
kind | query | AssetKind | no | |
unowned | query | boolean | no | |
page | query | int32 | no | |
pageSize | query | int32 | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PagedResultOfGovernedAssetDto |
Response 200: PagedResultOfGovernedAssetDto
| Field | Type | Notes |
|---|---|---|
hasNext | boolean | |
items | GovernedAssetDto[] | |
page | int32 | |
pageSize | int32 | |
totalCount | int64 |
GetGovernanceSummary
http
GET /api/v1/workspaces/{workspaceId}/governance/summaryGovernance dashboard counts: unowned assets, terms by status, pending suggestions, certified metrics without an approved term.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | GovernanceSummaryDto |
Response 200: GovernanceSummaryDto
| Field | Type | Notes |
|---|---|---|
assets | int32 | |
certifiedMetrics | int32 | |
certifiedMetricsWithoutApprovedTerm | int32 | |
domains | int32 | |
pendingSuggestions | int32 | |
terms | TermCountsDto | |
unownedAssets | int32 |
ListCatalogMetrics
http
GET /api/v1/workspaces/{workspaceId}/metricsThe metrics catalog: every metric with its certification level, trust and owner.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
modelId | query | uuid | no | |
filter | query | string | no | |
level | query | CertificationLevel | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | MetricSummaryDto[] |
GetCatalogMetric
http
GET /api/v1/workspaces/{workspaceId}/models/{modelId}/metrics/{metric}A metric with its definition, lineage, glossary terms and certification status.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
modelId | path | uuid | yes | |
metric | path | string | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | MetricDetailDto |
Response 200: MetricDetailDto
| Field | Type | Notes |
|---|---|---|
certification | CertificationStatusDto | |
definition | string? | |
dimensions | int32 | |
domain | string? | |
lineage | string[] | |
metric | MetricSummaryDto | |
termLinks | RelatedTermDto[] |
ListOwnership
http
GET /api/v1/workspaces/{workspaceId}/ownershipOwnership assignments (optionally of one asset).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
assetRef | query | string | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | OwnershipDto[] |
AssignOwnership
http
PUT /api/v1/workspaces/{workspaceId}/ownershipAssign the owner, stewards and domain of an asset.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): AssignOwnershipRequest
| Field | Type | Notes |
|---|---|---|
assetRef | string | |
domainId | uuid? | |
owner | string? | |
stewards | string[]? |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
BulkAssignOwnership
http
POST /api/v1/workspaces/{workspaceId}/ownership:bulkAssign an owner and stewards to every entity, metric and table of a domain or a source schema.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): BulkAssignOwnershipRequest
| Field | Type | Notes |
|---|---|---|
dataSourceId | uuid? | |
domainId | uuid? | |
overwrite | boolean? | |
owner | string? | |
schema | string? | |
stewards | string[]? |
| Status | Description | Body |
|---|---|---|
| 200 | OK | BulkAssignedDto |
Response 200: BulkAssignedDto
| Field | Type | Notes |
|---|---|---|
assigned | int32 | |
unchanged | int32 |
ListUnownedAssets
http
GET /api/v1/workspaces/{workspaceId}/ownership/unownedEntities, metrics and scanned tables without an owner (Page<T>).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
kind | query | AssetKind | no | |
page | query | int32 | no | |
pageSize | query | int32 | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PagedResultOfGovernedAssetDto |
Response 200: PagedResultOfGovernedAssetDto
| Field | Type | Notes |
|---|---|---|
hasNext | boolean | |
items | GovernedAssetDto[] | |
page | int32 | |
pageSize | int32 | |
totalCount | int64 |
ListAccessPolicies
http
GET /api/v1/workspaces/{workspaceId}/policiesAccess policies and Keel's suggestions, by priority then name (stewards and admins).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
includeRejected | query | boolean | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PolicyDto[] |
CreateAccessPolicy
http
POST /api/v1/workspaces/{workspaceId}/policiesCreate a column mask, row filter or deny policy (audited).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): PolicyRequest
| Field | Type | Notes |
|---|---|---|
appliesTo | string[]? | |
description | string? | |
enabled | boolean? | |
exempt | string[]? | |
keep | int32? | |
mask | PolicyMask? | |
name | string | |
priority | int32? | |
rowFilter | RowFilterInput? | |
scope | string | |
scopeKind | PolicyScopeKind | One of Asset, Tag, Domain, Sensitivity |
type | PolicyType | One of ColumnMask, RowFilter, Deny |
| Status | Description | Body |
|---|---|---|
| 201 | Created | CreatedResponse |
Response 201: CreatedResponse
| Field | Type | Notes |
|---|---|---|
id | uuid |
ApplyDefaultMaskPolicy
http
POST /api/v1/workspaces/{workspaceId}/policies:apply-defaultOne-click fix: accept (or create) and enable the default Restricted-column mask.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | DefaultMaskAppliedDto |
Response 200: DefaultMaskAppliedDto
| Field | Type | Notes |
|---|---|---|
columns | int32 | |
name | string | |
policyId | uuid |
GetPolicyCoverage
http
GET /api/v1/workspaces/{workspaceId}/policies:coverageRestricted columns that Analysts still see unmasked.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PolicyCoverageDto |
Response 200: PolicyCoverageDto
| Field | Type | Notes |
|---|---|---|
restricted | int32 | |
suggestionId | uuid? | |
uncovered | RestrictedDimension[] |
GetEffectivePolicies
http
GET /api/v1/workspaces/{workspaceId}/policies:effectivePolicies on one model object for a user (default: you; others need Govern).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
assetRef | query | string | yes | |
userId | query | uuid | no |
| Status | Description | Body |
|---|---|---|
| 200 | OK | EffectivePoliciesDto |
Response 200: EffectivePoliciesDto
| Field | Type | Notes |
|---|---|---|
assetRef | string | |
hidden | boolean | |
masks | EffectiveMaskDto[] | |
policies | PolicyTraceDto[] | |
roles | string[] | |
rowFilters | EffectiveRowFilterDto[] | |
userId | uuid? |
GetAccessPolicyImpact
http
POST /api/v1/workspaces/{workspaceId}/policies:impactBlast radius of a draft policy (nothing is stored): columns, entities and metrics it would touch, and the exports of those models.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): PolicyRequest
| Field | Type | Notes |
|---|---|---|
appliesTo | string[]? | |
description | string? | |
enabled | boolean? | |
exempt | string[]? | |
keep | int32? | |
mask | PolicyMask? | |
name | string | |
priority | int32? | |
rowFilter | RowFilterInput? | |
scope | string | |
scopeKind | PolicyScopeKind | One of Asset, Tag, Domain, Sensitivity |
type | PolicyType | One of ColumnMask, RowFilter, Deny |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PolicyImpactDto |
Response 200: PolicyImpactDto
| Field | Type | Notes |
|---|---|---|
columns | int32 | |
entities | int32 | |
exports | int32 | |
metrics | int32 | |
models | int32 | |
targets | PolicyImpactTargetDto[] |
SimulateAccessPolicies
http
POST /api/v1/workspaces/{workspaceId}/policies:simulateView as a member or role: the policies that apply on the model and why, with the effective filters, masks and hidden assets. Compile or run the model's query with viewAs for the SQL and the preview rows.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
Request body (application/json): SimulatePolicyRequest
| Field | Type | Notes |
|---|---|---|
attributes | object? | |
modelId | uuid | |
role | string? | |
userId | uuid? |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PolicySimulationDto |
Response 200: PolicySimulationDto
| Field | Type | Notes |
|---|---|---|
deniedAssets | string[] | |
masks | EffectiveMaskDto[] | |
missingAttributes | string[] | |
modelId | uuid | |
principal | SimulatedPrincipalDto | |
rowFilters | EffectiveRowFilterDto[] | |
trace | PolicyTraceDto[] |
SuggestAccessPolicies
http
POST /api/v1/workspaces/{workspaceId}/policies:suggestPropose the default mask for Restricted columns (F11 FR4) when none exists.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PolicySuggestionsDto |
Response 200: PolicySuggestionsDto
| Field | Type | Notes |
|---|---|---|
proposed | uuid[] |
GetAccessPolicy
http
GET /api/v1/workspaces/{workspaceId}/policies/{policyId}One access policy.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 200 | OK | PolicyDto |
Response 200: PolicyDto
| Field | Type | Notes |
|---|---|---|
appliesTo | string[] | |
confidence | number | |
createdAt | date-time | |
description | string? | |
enabled | boolean | |
evidence | Evidence[] | |
exempt | string[] | |
id | uuid | |
keep | int32? | |
mask | PolicyMask? | |
name | string | |
origin | Origin | One of Discovered, Inferred, LlmSuggested, UserDefined, Imported |
priority | int32 | |
rowFilter | RowFilterDto? | |
rule | string | |
scope | string | |
scopeKind | PolicyScopeKind | One of Asset, Tag, Domain, Sensitivity |
status | ProposalStatus | One of Proposed, Accepted, Rejected, Superseded |
type | PolicyType | One of ColumnMask, RowFilter, Deny |
updatedAt | date-time? |
UpdateAccessPolicy
http
PUT /api/v1/workspaces/{workspaceId}/policies/{policyId}Replace a policy's definition (before/after audited).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
Request body (application/json): PolicyRequest
| Field | Type | Notes |
|---|---|---|
appliesTo | string[]? | |
description | string? | |
enabled | boolean? | |
exempt | string[]? | |
keep | int32? | |
mask | PolicyMask? | |
name | string | |
priority | int32? | |
rowFilter | RowFilterInput? | |
scope | string | |
scopeKind | PolicyScopeKind | One of Asset, Tag, Domain, Sensitivity |
type | PolicyType | One of ColumnMask, RowFilter, Deny |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
DeleteAccessPolicy
http
DELETE /api/v1/workspaces/{workspaceId}/policies/{policyId}Delete a policy (audited).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
AcceptAccessPolicySuggestion
http
POST /api/v1/workspaces/{workspaceId}/policies/{policyId}:acceptAccept a policy Keel suggested: it is enabled and enforced.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
DisableAccessPolicy
http
POST /api/v1/workspaces/{workspaceId}/policies/{policyId}:disableStop enforcing a policy (it is kept).
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
EnableAccessPolicy
http
POST /api/v1/workspaces/{workspaceId}/policies/{policyId}:enableEnforce an accepted policy.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |
RejectAccessPolicySuggestion
http
POST /api/v1/workspaces/{workspaceId}/policies/{policyId}:rejectReject a policy Keel suggested; it is not proposed again.
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
workspaceId | path | uuid | yes | |
policyId | path | uuid | yes |
| Status | Description | Body |
|---|---|---|
| 204 | No Content | — |