> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Read the Workspace's Provider Policies > Returns every Provider table the selected Workspace’s catalog serves with its columns and its Provider Policy, if any, the Workspace roles a rule can bind with how many members hold each, and stored Policies whose table the catalog no longer serves. Problems name each condition that no longer compiles against its table. Row counts are withheld for tables a Provider Policy narrows for the reader. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant one of `tenant.providerpolicies.view`, `tenant.providerpolicies.manage`. ## Errors * `WA-PP-007`: Parable could not list the Workspace’s Provider tables. Try again. ## OpenAPI ````yaml /api-reference/openapi.json get /api/provider-policies openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/provider-policies: get: tags: - Provider policies summary: Read the Workspace's Provider Policies description: >- Returns every Provider table the selected Workspace’s catalog serves with its columns and its Provider Policy, if any, the Workspace roles a rule can bind with how many members hold each, and stored Policies whose table the catalog no longer serves. Problems name each condition that no longer compiles against its table. Row counts are withheld for tables a Provider Policy narrows for the reader. operationId: ProviderPoliciesGetProviderPoliciesHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/WorkspaceProviderPolicies' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request is not valid. `detail` says why. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 120 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: |- import { WebApiSDK } from "@parable-platform/web-api-sdk"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const result = await sdk.providerPolicies.getProviderPolicies(); - label: Python SDK lang: python source: |- import os from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) result = sdk.provider_policies.get_provider_policies() - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let result = sdk.provider_policies.get_provider_policies( Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nresult, err := sdk.ProviderPoliciesNamespace.GetProviderPolicies(ctx)" components: schemas: WorkspaceProviderPolicies: properties: canManage: description: Whether the person reading may change Provider Policies. type: boolean roles: description: >- Every role a rule can bind, then any other role a stored rule names, by name. items: $ref: '#/components/schemas/ProviderPolicyRole' type: array tables: description: >- Every main and child Provider table the Workspace's catalog serves, by schema and name. items: $ref: '#/components/schemas/WorkspaceProviderPolicyTable' type: array unmatched: description: >- Stored Policies on tables the catalog no longer serves. A new tap or a re-created custom tap gives a table a new key, so such a Policy applies to nothing; it can still be cleared. items: $ref: '#/components/schemas/WorkspaceProviderPolicyTable' type: array required: - tables - unmatched - roles - canManage type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object ProviderPolicyRole: description: >- A Workspace's Provider Policies as its administrators see them: which rows of each Provider table the people in each Workspace role read, in every read of the Workspace. A role a Provider Policy rule can bind, or one a stored rule still names. properties: allDataAccess: description: >- The role is not removed and its own permissions cover All data access (`tenant.data.unrestricted`), by the prefix rule Parable applies to a reader's roles. Workspace Administrator covers it through bare `tenant`. Another role covers it only when it is given it. Its holders read every row of every Provider table on the reads they make themselves, whatever a rule says. Only a View as preview of a holder applies a rule that names the role. Found by permission, never by name. type: boolean assignable: description: >- Whether a rule may bind the role now: it exists and every permission it holds is a Workspace permission, the rule Workspace role assignment uses. type: boolean holders: description: Active members of this Workspace who hold the role. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string name: type: string removed: description: The role was removed. A rule that names it binds nobody. type: boolean required: - id - name - holders - assignable - removed - allDataAccess type: object WorkspaceProviderPolicyTable: description: One Provider table on the Workspace's Provider Policies page. properties: columns: description: The table's columns. Empty for a table the catalog no longer serves. items: $ref: '#/components/schemas/ProviderPolicyColumn' type: array logicalName: type: string modeled: description: >- Whether the table is modeled: its Provider says who can open each row. Only a modeled table takes a Source permissions rule. False for a table the catalog no longer serves. type: boolean parentTableKey: description: |- For a child table, its main table's key. A child table takes its own Provider Policy. nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string policy: description: Null when the table has no Provider Policy. oneOf: - $ref: '#/components/schemas/ProviderPolicyRecord' - enum: - null nullable: true type: object problems: description: |- What stops the stored Policy from applying as written, such as a condition that names a column the table no longer has. Until it is fixed, a read of the table by anyone that Policy narrows fails. items: $ref: '#/components/schemas/ProviderPolicyProblem' type: array providerKey: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string schemaName: type: string statsRowCount: description: >- The catalog's row count. Null when unknown, and for a table a Provider Policy narrows for the person reading the page: catalog statistics are withheld from the people a Policy narrows. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 nullable: true type: integer tableKey: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string tableKind: description: Null for a stored Policy whose table the catalog no longer serves. oneOf: - $ref: '#/components/schemas/CatalogTableKindEnum' - enum: - null nullable: true type: string required: - providerKey - tableKey - schemaName - logicalName - columns - problems - modeled type: object ProviderPolicyColumn: description: |- One column of a Provider table, as the catalog serves it, with the primitive a condition compares it as. properties: field: $ref: '#/components/schemas/SemanticCatalogField' primitive: oneOf: - $ref: '#/components/schemas/ProviderPolicyColumnPrimitive' - enum: - null nullable: true type: string required: - field type: object ProviderPolicyRecord: description: A table's stored Provider Policy. properties: definition: $ref: '#/components/schemas/ProviderPolicyDefinition' id: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string revision: description: 'The compare-and-swap token: a save names it as expectedRevision.' format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer updatedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string updatedBy: description: UUID v4 string as base62 pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - id - definition - revision - updatedAt - updatedBy type: object ProviderPolicyProblem: description: >- Why a Provider Policy cannot apply as written. `ruleKey` names the rule, or is null for Everyone else; `condition` is the condition's position in that rule, from 0. The message names the column or the construct that Parable refused. It never quotes a row value. properties: condition: description: >- Signed 64-bit integer; range bounded by JavaScript's safe-integer ceiling. format: int64 maximum: 9007199254740991 minimum: 0 type: integer message: type: string ruleKey: description: UUID v4 with automatic base62 encoding for client-facing APIs nullable: true pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - condition - message type: object CatalogTableKindEnum: description: |- Position of a served table in its Tap's mapping plan. SQL over Flight serves the same values under the `parable.annotation.table_kind` schema metadata key. enum: - main - quarantine - child - child_quarantine type: string SemanticCatalogField: description: >- One logical column of a served table or view. The semantic catalog is the same catalog that SQL over Flight reports in its metadata, with the Artifact tables you may read. An omitted (null) annotation field means *unknown / not yet computed*. A present value is authoritative. Identity fields (tableKind, tapKind, contractVersion) are always present. properties: arrowType: description: |- Deterministic Arrow DataType rendering (Arrow's canonical Display form). Deliberately a string, not an enum: nested and parameterized types render their full parameters (`List(Field { .. Utf8 .. })`, `Timestamp(Nanosecond, Some("UTC"))`, `Map(...)`), so the value set is open -- it is the exact type served in the Flight IPC schema for the same column, which an enum of type families could not carry. type: string hidden: description: >- True on Parable's operational columns that the logical schema still shows: the `_parable_*` envelope columns of a quarantine table. A main table's envelope columns are left out of the schema, not flagged. type: boolean name: description: |- Logical column name (lowercased source path segments joined with `__`), exactly as served by Flight GetTables. maxLength: 80 minLength: 2 type: string nullable: type: boolean poorPruning: description: >- True on columns whose physical representation defeats data skipping (JSON-encoded, native struct/array, capture buckets). SQL over Flight serves the same value under the `parable.annotation.poor_pruning` field metadata key. type: boolean scalarRef: description: >- Canonical name of the column's semantic scalar (e.g. `Contact.Email`), exactly the Flight `parable.scalar.canonical_name` field metadata value; null when the column carries no semantic scalar. Consumers needing a JSON-Schema pointer can prefix `#/definitions/scalars/`. maxLength: 128 minLength: 3 nullable: true pattern: ^[A-Z][A-Za-z0-9]*\.[A-Z][A-Za-z0-9]*$ type: string system: description: >- True on the row-state columns Parable adds to every Provider table: `dt` and the `_parable_*` load and deletion columns on main and child tables, and the `_parable_*` envelope plus `dt` on quarantine tables. They stay queryable; catalog browsers list them apart from the Provider's own fields. SQL over Flight serves the same value under the `parable.annotation.system` field metadata key. `GET /api/v2/catalog` always sets it. nullable: true type: boolean required: - name - arrowType - nullable - hidden - poorPruning type: object ProviderPolicyColumnPrimitive: description: >- The schema primitive a condition compares a column as, so a condition editor writes its literals right: quoted text for String, a number for Int and Float, true or false for Bool. A column of any other Arrow type (a date, a timestamp, a list, a struct) has none. enum: - String - Int - Float - Bool type: string ProviderPolicyDefinition: additionalProperties: false description: >- A Provider Policy: which rows of one Provider table the people in each role read, in every read of the Workspace. A reader gets the union of every rule that names one of their roles; a reader no rule names gets `everyoneElse`. Parable also checks whole-table limits: a role in at most one rule, and at most 100 conditions and 60 KiB of condition text per table. properties: everyoneElse: $ref: '#/components/schemas/ProviderPolicyAccessRule' rules: items: $ref: '#/components/schemas/ProviderPolicyRule' maxItems: 50 type: array required: - rules - everyoneElse type: object ProviderPolicyAccessRule: additionalProperties: false description: >- The access for readers none of whose roles a rule names. `conditions` are SQL conditions over the table's own columns, ANDed together. ROWS_WHERE needs at least one, SOURCE_PERMISSIONS may have some, which AND with source permissions, and ALL_ROWS and HIDDEN have none. properties: access: $ref: '#/components/schemas/ProviderPolicyAccess' conditions: items: description: SQL text minLength: 1 pattern: ^[\s\S]*$ type: string maxItems: 100 type: array required: - access - conditions type: object ProviderPolicyRule: additionalProperties: false description: >- One rule of a Provider Policy: the Workspace roles it binds and what they read. `key` stays the same across saves. A role appears in at most one rule of a table. `conditions` follow the same rule as for Everyone else. properties: access: $ref: '#/components/schemas/ProviderPolicyAccess' conditions: items: description: SQL text minLength: 1 pattern: ^[\s\S]*$ type: string maxItems: 100 type: array key: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string roleIds: items: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string maxItems: 50 minItems: 1 type: array required: - key - roleIds - access - conditions type: object ProviderPolicyAccess: description: >- What a Provider Policy lets a reader read from one Provider table. A rule binds Workspace roles to one access; Everyone else is the access for readers none of whose roles a rule names. A reader whose roles several rules name gets the union of those rules. Parable filter Policies use the first three only. enum: - all_rows - rows_where - hidden - source_permissions type: string headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.