Dataphin:Manage data service permissions

API permissions

Grant API permissions

1. On the API Permissions tab, click Batch Grant in the upper-right corner, or click Grant in the Actions column of the desired API.

2. On the API Authorization page, configure the following parameters.

   Parameter		Description
   API permission object	Service project	Select the service projects to grant API permissions for.
   	Account type	Select application or personal account as the account type. Application is selected by default. Application: Permissions can only be granted to applications when the API operation type is Create, Update, or Delete. Use caution when a personal account uses an API in Basic mode in the development environment to access production data. If the API is in the development environment and in Dev-Prod mode, it accesses development environment data.
   	API	Select APIs by service project and API group. You can fuzzy-search by name, batch search and add, or click the icon to filter by API group. Batch Search and Add: Click Batch Search and Add, then enter API names in the Batch Search dialog box. Use the service project.API name format for exact search. Separate names with semicolons (;), commas (,), or line breaks. Maximum: 50 APIs. Note When granting API permissions to a personal account, select a service project that you have joined.
   	API runtime environment	Required for applications. Select the API runtime environment: development environment, production environment, or both. Note The API runs based on the selected environment's configuration. In the development environment, it uses the submitted configuration. In the production environment, it uses the published configuration.
   	Application	Required for applications. Select applications from an application group. Only applications you have joined are available. You can fuzzy-search by name, batch search and add, or click the icon to filter by application group. Batch Search and Add: Click Batch Search and Add, then enter application names in the Batch Search dialog box. Use the application group.application name format for exact search. Separate names with semicolons (;), commas (,), or line breaks. Maximum: 50 applications.
   Authorization scope		Select the optional fields that require authorization based on the API runtime environment. If the API has row-level permissions, a Row-level permissions are in effect status appears. Click View Row-level Permissions to view row-level permission details in the View Row-level Permissions panel. You can switch environments to view the corresponding permissions. Note Use caution when the API is in Basic mode in the development environment and accesses production data. For production environments, response parameters come from the current online API version. For development environments, they come from the latest development version. When an application with proxy permission calls an API, data is returned based on the proxied user's row-level permissions. Without proxy permission, data is returned based on the application's own row-level permissions. For Create, Update, or Delete API operations, the API accesses data based on its runtime environment. No field selection is required.
   Permission configuration	Permission type	Usage permission is selected by default and cannot be changed. For applications, you can also select proxy permission. Usage permission: Only usage permission can be selected when the API operation type is Create, Update, or Delete. Proxy permission: Required when an API has row-level permissions and operates in proxy mode. Enable proxy mode by configuring row-level permission parameters in the public parameters section of the API call page (data service > Application Management > Authorized API Services). You must apply for proxy permission to call an API associated with row-level permissions.
   	Validity period	Select 30 Days, 90 Days, 180 Days, Permanent, or a custom expiration date.
   	Authorization reason	Enter a reason for the authorization request. Maximum: 128 characters.

3. Click OK to complete the API permission grant.

Revoke API permissions

1. On the API Permissions tab, click Batch Revoke in the upper-right corner, or click Revoke in the Actions column for the target API.

2. On the API Permission Revocation page, configure the following parameters.

   Parameter		Description
   API permission object	Service project	Select the service projects to revoke permissions from.
   	Account type	Select the account type: application or personal account.
   	API	Select the APIs to revoke permissions from. You can fuzzy-search by name, batch search and add, or click the icon to filter by API group. Batch Search and Add: Click Batch Search and Add, then enter API names in the Batch Search dialog box. Use the service project.API name format for exact search. Separate names with semicolons (;), commas (,), or line breaks. Maximum: 50 APIs.
   	Authorized account	Required for personal accounts. Select the accounts to revoke permissions from.
   	API runtime environment	Required for applications. Select the runtime environments to revoke: production environment or development environment.
   	Application	Required for applications. Select the applications to revoke permissions from. You can fuzzy-search by name, batch search and add, or click the icon to filter by application group. Batch Search and Add: Click Batch Search and Add, then enter application names in the Batch Search dialog box. Use the application group.application name format for exact search. Separate names with semicolons (;), commas (,), or line breaks. Maximum: 50 applications.
   Permission configuration	Permission type	Select the permission type to revoke. For application accounts: usage and proxy permissions can be revoked. Revoking usage permission automatically revokes the associated proxy permission. This cannot be changed. For personal account: only usage permission can be revoked.
   	Revocation reason	Enter a reason for the revocation. Maximum: 128 characters.

3. Click Submit to complete the API permission revocation.

Service unit

Grant service unit permissions

1. On the Service Unit Permissions page, click Grant in the Actions column of the target service unit.

2. In the Service Unit Authorization dialog box, configure the following parameters.

   Parameter	Description
   Account type	Only personal account is supported.
   Authorized account	Select the accounts to authorize.
   Validity period	Select a validity period.
   Permission type	Select usage permission, development permission, or both.
   Authorization reason	Enter an authorization reason. Maximum: 128 characters.

3. Click Submit to complete the service unit permission grant.

Revoke service unit permissions

1. On the Service Unit Permissions page, click Revoke in the Actions column of the target service unit.

2. In the Service Unit Permission Revocation dialog box, configure the following parameters.

   Parameter	Description
   Account type	Only personal account is supported.
   Authorized account	Select the accounts to revoke permissions from.
   Revocation reason	Enter a revocation reason. Maximum: 128 characters.

3. Click Submit to complete the service unit permission revocation.