> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Check a Provider Policy before saving it > Compiles each condition of a proposed Provider Policy against the table’s columns, as saving it would, and returns every problem, the columns the conditions name, whether they read who is reading, and whether the table takes Source permissions. With count, it also counts the rows each rule and Everyone else would read, in one pass over the table, and returns numbers, never rows. A rule that reads Source permissions, or whose conditions read who is reading, is not counted. It stores nothing. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant `tenant.providerpolicies.manage`. ## Errors * `WA-PP-006`: The Policy is over a size limit or has a malformed rule. Keep a table to 50 rules, 100 conditions and 60 KiB of condition text. * `WA-PP-007`: Parable could not check the conditions. Try again. * `WA-PP-008`: A count reads the table past every Provider Policy, and your own Policies narrow it or your roles do not read it with SQL. Check the Policy without counting, or ask someone who reads every row of the table to count it. * `WA-PP-010`: A rule reads Source permissions on a table whose Provider does not say who can open each row. Choose All rows, Rows where or Hidden for this table. ## OpenAPI ````yaml /api-reference/openapi.json post /api/provider-policies/{providerKey}/{tableKey}/preview openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/provider-policies/{providerKey}/{tableKey}/preview: post: tags: - Provider policies summary: Check a Provider Policy before saving it description: >- Compiles each condition of a proposed Provider Policy against the table’s columns, as saving it would, and returns every problem, the columns the conditions name, whether they read who is reading, and whether the table takes Source permissions. With count, it also counts the rows each rule and Everyone else would read, in one pass over the table, and returns numbers, never rows. A rule that reads Source permissions, or whose conditions read who is reading, is not counted. It stores nothing. operationId: ProviderPoliciesPreviewProviderPolicyHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: providerKey parameter in: path name: providerKey required: true schema: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string - description: tableKey parameter in: path name: tableKey required: true schema: description: UUID v4 with automatic base62 encoding for client-facing APIs type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/PreviewProviderPolicyInput' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/ProviderPolicyCheckResponse' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The request is not valid. `detail` says why. A value that breaks a field rule gives the code `WA-VL-001` and an `errors` member that names each field. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '404': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The resource that the path names was not found. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 120 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: >- import { WebApiSDK } from "@parable-platform/web-api-sdk"; import type { PreviewProviderPolicyInput } from "@parable-platform/web-api-types"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const input: PreviewProviderPolicyInput = JSON.parse(`{ "definition": { "rules": [], "everyoneElse": { "access": "all_rows", "conditions": [] } }, "count": true }`); const result = await sdk.providerPolicies.previewProviderPolicy( "example", "example", input ); - label: Python SDK lang: python source: >- import json import os from parable_types_web_api import PreviewProviderPolicyInput from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) input_data = PreviewProviderPolicyInput.model_validate( json.loads("{\"definition\":{\"rules\":[],\"everyoneElse\":{\"access\":\"all_rows\",\"conditions\":[]}},\"count\":true}"), ) result = sdk.provider_policies.preview_provider_policy('example', 'example', input_data) - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{types, ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let input: types::PreviewProviderPolicyInput = serde_json::from_value( serde_json::json!({ "definition": { "rules": [], "everyoneElse": { "access": "all_rows", "conditions": [] } }, "count": true }), )?; let result = sdk.provider_policies.preview_provider_policy( serde_json::from_value(serde_json::json!("example"))?, serde_json::from_value(serde_json::json!("example"))?, input, Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nvar input webapitypes.PreviewProviderPolicyInput\nif err := json.Unmarshal([]byte(`{\"definition\":{\"rules\":[],\"everyoneElse\":{\"access\":\"all_rows\",\"conditions\":[]}},\"count\":true}`), &input); err != nil {\n\treturn err\n}\nresult, err := sdk.ProviderPoliciesNamespace.PreviewProviderPolicy(ctx, \"example\", \"example\", input)" components: schemas: PreviewProviderPolicyInput: description: A proposed Provider Policy for one table, checked and not saved. properties: count: description: |- Also count the rows each rule and Everyone else would read. Counting reads the table once; checking alone reads no row. type: boolean definition: $ref: '#/components/schemas/ProviderPolicyDefinition' required: - definition - count type: object ProviderPolicyCheckResponse: properties: columns: description: The columns the conditions name, in the table's column order. items: type: string type: array counts: description: >- Present when the request asked for counts and every condition compiled. oneOf: - $ref: '#/components/schemas/ProviderPolicyRowCounts' - enum: - null nullable: true type: object logicalName: nullable: true type: string modeled: description: |- Whether the table is modeled, as ProviderPolicyTable says. Parable refuses a SOURCE_PERMISSIONS rule on a table that is not. type: boolean problems: items: $ref: '#/components/schemas/ProviderPolicyProblem' type: array readsReader: description: >- Whether a condition reads who is reading (request_principal()), so the rows it keeps depend on the reader. type: boolean schemaName: description: A URL friendly version of a string maxLength: 255 minLength: 1 nullable: true pattern: ^[a-z0-9]+(?:[-_][a-z0-9]+)*$ type: string served: description: >- Whether the Workspace's catalog serves this table. A table it does not serve is not checked, and its names are null. type: boolean required: - served - problems - columns - readsReader - modeled type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object ProviderPolicyDefinition: additionalProperties: false description: >- A Provider Policy: which rows of one Provider table the people in each role read, in every read of the Workspace. A reader gets the union of every rule that names one of their roles; a reader no rule names gets `everyoneElse`. Parable also checks whole-table limits: a role in at most one rule, and at most 100 conditions and 60 KiB of condition text per table. properties: everyoneElse: $ref: '#/components/schemas/ProviderPolicyAccessRule' rules: items: $ref: '#/components/schemas/ProviderPolicyRule' maxItems: 50 type: array required: - rules - everyoneElse type: object ProviderPolicyRowCounts: description: |- What a proposed Provider Policy keeps, counted over the table's current rows. properties: audiences: items: $ref: '#/components/schemas/ProviderPolicyAudienceRows' type: array total: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer required: - total - audiences type: object ProviderPolicyProblem: description: >- Why a Provider Policy cannot apply as written. `ruleKey` names the rule, or is null for Everyone else; `condition` is the condition's position in that rule, from 0. The message names the column or the construct that Parable refused. It never quotes a row value. properties: condition: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: 0 type: integer message: type: string ruleKey: description: UUID v4 with automatic base62 encoding for client-facing APIs nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - condition - message type: object ProviderPolicyAccessRule: additionalProperties: false description: >- The access for readers none of whose roles a rule names. `conditions` are SQL conditions over the table's own columns, ANDed together. ROWS_WHERE needs at least one, SOURCE_PERMISSIONS may have some, which AND with source permissions, and ALL_ROWS and HIDDEN have none. properties: access: $ref: '#/components/schemas/ProviderPolicyAccess' conditions: items: description: SQL text minLength: 1 pattern: ^[\s\S]*$ type: string maxItems: 100 type: array required: - access - conditions type: object ProviderPolicyRule: additionalProperties: false description: >- One rule of a Provider Policy: the Workspace roles it binds and what they read. `key` stays the same across saves. A role appears in at most one rule of a table. `conditions` follow the same rule as for Everyone else. properties: access: $ref: '#/components/schemas/ProviderPolicyAccess' conditions: items: description: SQL text minLength: 1 pattern: ^[\s\S]*$ type: string maxItems: 100 type: array key: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string roleIds: items: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string maxItems: 50 minItems: 1 type: array required: - key - roleIds - access - conditions type: object ProviderPolicyAudienceRows: description: |- The rows one audience of a proposed Provider Policy reads: a rule, or Everyone else when `ruleKey` is null. properties: readsReader: description: |- The audience's rows differ from person to person, so `rows` is not counted (0): its conditions read who is reading, or it reads SOURCE_PERMISSIONS. type: boolean rows: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: 0 type: integer ruleKey: description: UUID v4 with automatic base62 encoding for client-facing APIs nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - readsReader - rows type: object ProviderPolicyAccess: description: >- What a Provider Policy lets a reader read from one Provider table. A rule binds Workspace roles to one access; Everyone else is the access for readers none of whose roles a rule names. A reader whose roles several rules name gets the union of those rules. Parable filter Policies use the first three only. enum: - all_rows - rows_where - hidden - source_permissions type: string headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.