Python SDK

import json
import os

from parable_types_web_api import SetProviderPolicyInput
from parable_web_api_sdk import ClientConfig, WebApiSDK

sdk = WebApiSDK(
    ClientConfig(
        base_url=os.environ["PARABLE_API_URL"],
        auth_token=os.environ["PARABLE_API_TOKEN"],
        default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]},
    )
)

input_data = SetProviderPolicyInput.model_validate(
    json.loads("{\"expectedRevision\":1,\"definition\":{\"rules\":[],\"everyoneElse\":{\"access\":\"all_rows\",\"conditions\":[]}}}"),
)
result = sdk.provider_policies.set_provider_policy('example', 'example', input_data)

sdk, err := webapisdk.New(webapisdk.SDKConfig{
	BaseURL: os.Getenv("PARABLE_API_URL"),
	Auth:    &webapisdk.AuthConfig{Token: os.Getenv("PARABLE_API_TOKEN")},
	RequestInterceptor: func(ctx context.Context, req *http.Request) error {
		req.Header.Set("X-Tenant", os.Getenv("PARABLE_WORKSPACE"))
		return nil
	},
})
if err != nil {
	return err
}

var input webapitypes.SetProviderPolicyInput
if err := json.Unmarshal([]byte(`{"expectedRevision":1,"definition":{"rules":[],"everyoneElse":{"access":"all_rows","conditions":[]}}}`), &input); err != nil {
	return err
}
result, err := sdk.ProviderPoliciesNamespace.SetProviderPolicy(ctx, "example", "example", input)

{
  "data": {
    "definition": {
      "everyoneElse": {
        "access": "all_rows",
        "conditions": [
          "<string>"
        ]
      },
      "rules": [
        {
          "access": "all_rows",
          "conditions": [
            "<string>"
          ],
          "key": "<string>",
          "roleIds": [
            "<string>"
          ]
        }
      ]
    },
    "id": "<string>",
    "revision": 0,
    "updatedAt": "2023-11-07T05:31:56Z",
    "updatedBy": "<string>"
  },
  "meta": {
    "requestId": "<string>",
    "totalCount": 123
  },
  "links": {
    "first": "<string>",
    "last": "<string>",
    "next": "<string>",
    "prev": "<string>"
  }
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

Too Many Requests

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

Set one Provider table's Provider Policy

Replaces the Provider Policy on one Provider table of the selected Workspace: rules that bind Workspace roles to All rows, Rows where (SQL conditions over the table’s columns), Hidden or Source permissions (the rows each reader can open in the Provider, with optional conditions), and what Everyone else reads. Someone whose roles several rules name reads the union of those rules. It applies to every read in the Workspace, by a Parable’s Primary too. The save is refused unless every condition compiles against the table’s columns, unless a Source permissions rule is on a table whose Provider says who can open each row, and unless expectedRevision is the table’s current revision. Every save is kept in the Policy’s history.

PUT

api

provider-policies

{providerKey}

{tableKey}

Python SDK

import json
import os

from parable_types_web_api import SetProviderPolicyInput
from parable_web_api_sdk import ClientConfig, WebApiSDK

sdk = WebApiSDK(
    ClientConfig(
        base_url=os.environ["PARABLE_API_URL"],
        auth_token=os.environ["PARABLE_API_TOKEN"],
        default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]},
    )
)

input_data = SetProviderPolicyInput.model_validate(
    json.loads("{\"expectedRevision\":1,\"definition\":{\"rules\":[],\"everyoneElse\":{\"access\":\"all_rows\",\"conditions\":[]}}}"),
)
result = sdk.provider_policies.set_provider_policy('example', 'example', input_data)

sdk, err := webapisdk.New(webapisdk.SDKConfig{
	BaseURL: os.Getenv("PARABLE_API_URL"),
	Auth:    &webapisdk.AuthConfig{Token: os.Getenv("PARABLE_API_TOKEN")},
	RequestInterceptor: func(ctx context.Context, req *http.Request) error {
		req.Header.Set("X-Tenant", os.Getenv("PARABLE_WORKSPACE"))
		return nil
	},
})
if err != nil {
	return err
}

var input webapitypes.SetProviderPolicyInput
if err := json.Unmarshal([]byte(`{"expectedRevision":1,"definition":{"rules":[],"everyoneElse":{"access":"all_rows","conditions":[]}}}`), &input); err != nil {
	return err
}
result, err := sdk.ProviderPoliciesNamespace.SetProviderPolicy(ctx, "example", "example", input)

{
  "data": {
    "definition": {
      "everyoneElse": {
        "access": "all_rows",
        "conditions": [
          "<string>"
        ]
      },
      "rules": [
        {
          "access": "all_rows",
          "conditions": [
            "<string>"
          ],
          "key": "<string>",
          "roleIds": [
            "<string>"
          ]
        }
      ]
    },
    "id": "<string>",
    "revision": 0,
    "updatedAt": "2023-11-07T05:31:56Z",
    "updatedBy": "<string>"
  },
  "meta": {
    "requestId": "<string>",
    "totalCount": 123
  },
  "links": {
    "first": "<string>",
    "last": "<string>",
    "next": "<string>",
    "prev": "<string>"
  }
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

Too Many Requests

{
  "detail": "<string>",
  "status": 400,
  "title": "Bad Request",
  "type": "about:blank",
  "code": "WA-VL-001",
  "details": "<unknown>",
  "errors": "<unknown>",
  "requestId": "<string>"
}

Access

This operation needs a Parable token. An MCP token cannot call it. See Authentication for the kinds of token. Your roles must grant tenant.providerpolicies.manage.

Errors

WA-PP-001: Someone saved this table’s Provider Policy after the revision the save names. Load the table’s Provider Policy again and make the change on top of it.
WA-PP-002: The Workspace’s catalog serves no Provider table with this key. Choose a table the catalog serves. A Policy on a table that is gone can only be cleared.
WA-PP-003: A condition does not compile against the table’s columns. Fix or remove each condition the problems name.
WA-PP-004: A rule names a role a Workspace administrator cannot assign in this Workspace. Bind only Workspace roles.
WA-PP-005: Two rules name the same role. Name each role in at most one rule of the table.
WA-PP-006: The Policy is over a size limit or has a malformed rule. Keep a table to 50 rules, 100 conditions and 60 KiB of condition text.
WA-PP-007: Parable could not check the conditions, so nothing was saved. Try again.
WA-PP-010: A rule reads Source permissions on a table whose Provider does not say who can open each row. Choose All rows, Rows where or Hidden for this table.

Authorizations

Authorization

string

header

required

A personal access token, which starts with pat_. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API.

Headers

X-Tenant

string

Workspace slug. Overrides subdomain-based workspace resolution when provided.

Example:

"acme"

X-Request-ID

string<uuid>

Optional request correlation ID echoed back in the response.

Example:

"550e8400-e29b-41d4-a716-446655440000"

Path Parameters

providerKey

string

required

providerKey parameter UUID v4 with automatic base62 encoding for client-facing APIs

tableKey

string

required

tableKey parameter UUID v4 with automatic base62 encoding for client-facing APIs

Body

application/json

Replaces one table's Provider Policy. A definition with no rules and Everyone else at All rows clears it; the row and its history stay.

definition

object

required

A Provider Policy: which rows of one Provider table the people in each role read, in every read of the Workspace. A reader gets the union of every rule that names one of their roles; a reader no rule names gets everyoneElse. Parable also checks whole-table limits: a role in at most one rule, and at most 100 conditions and 60 KiB of condition text per table.

Show child attributes

expectedRevision

integer<int64>

required

The revision the change starts from: 0 for a table with no Provider Policy yet. Another save in between refuses this one.

Required range: 0 <= x <= 9007199254740991

Response

Successful response

data

object

required

A table's stored Provider Policy.

Show child attributes

Overview

REST API

Set one Provider table's Provider Policy

Access

Errors

Authorizations

Headers

Path Parameters

Body

Response

​Access

​Errors

Authorizations

Headers

Path Parameters

Body

Response

Access

Errors