> ## Documentation Index > Fetch the complete documentation index at: https://developers.askparable.com/llms.txt > Use this file to discover all available pages before exploring further. # Set the Workspace's source permissions settings > Replaces the selected Workspace’s source permissions settings: whether source permissions are enforced, and whether link-only grants admit their audience. With enforcement on, a table a connector models, with no Provider Policy, reads only the rows each reader may open in the source. A table with no model still reads all rows. The save is refused unless expectedRevision is the current revision. A change is kept in the settings’ history and recorded in the audit trail with the person and the old and new values. A save that changes nothing records nothing. ## Access This operation needs a Parable token. An MCP token cannot call it. See [Authentication](/getting-started/authentication.md) for the kinds of token. Your roles must grant `tenant.providerpolicies.manage`. ## Errors * `WA-PP-009`: Someone changed the Workspace’s source permissions settings after the revision the save names. Load the settings again and make the change on top of them. ## OpenAPI ````yaml /api-reference/openapi.json put /api/provider-policies/source-permissions openapi: 3.0.3 info: description: >- Use the Workspace API to work with artifacts, connectors, Parables, and account resources. title: Workspace API version: v2026.10.22.1 servers: [] security: [] paths: /api/provider-policies/source-permissions: put: tags: - Provider policies summary: Set the Workspace's source permissions settings description: >- Replaces the selected Workspace’s source permissions settings: whether source permissions are enforced, and whether link-only grants admit their audience. With enforcement on, a table a connector models, with no Provider Policy, reads only the rows each reader may open in the source. A table with no model still reads all rows. The save is refused unless expectedRevision is the current revision. A change is kept in the settings’ history and recorded in the audit trail with the person and the old and new values. A save that changes nothing records nothing. operationId: ProviderPoliciesSetSourcePermissionsHandler parameters: - description: >- Workspace slug. Overrides subdomain-based workspace resolution when provided. in: header name: X-Tenant required: false schema: example: acme type: string - description: Optional request correlation ID echoed back in the response. in: header name: X-Request-ID required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/SetSourcePermissionsInput' required: true responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/WorkspaceSourcePermissions' links: $ref: '#/components/schemas/ResponseLinks' meta: $ref: '#/components/schemas/ResponseMeta' required: - data - meta type: object description: Successful response headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '400': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The request is not valid. `detail` says why. A value that breaks a field rule gives the code `WA-VL-001` and an `errors` member that names each field. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '401': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The token is missing, malformed, revoked, or expired. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '403': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: >- The token cannot make this request. For example, the roles of its owner do not allow the operation. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' '429': content: text/plain: schema: example: Too Many Requests type: string description: >- More than 20 requests a minute came from your address. Wait for the number of seconds in `Retry-After`, then try again. headers: Retry-After: description: The number of seconds to wait before you try again. schema: type: integer X-Request-ID: $ref: '#/components/headers/X-Request-ID' '500': content: application/problem+json: schema: $ref: '#/components/schemas/ProblemDetails' description: The request failed on the server. headers: X-Request-ID: $ref: '#/components/headers/X-Request-ID' security: - bearerAuth: [] x-codeSamples: - label: TypeScript SDK lang: typescript source: >- import { WebApiSDK } from "@parable-platform/web-api-sdk"; import type { SetSourcePermissionsInput } from "@parable-platform/web-api-types"; const sdk = new WebApiSDK({ baseUrl: process.env.PARABLE_API_URL!, auth: { token: process.env.PARABLE_API_TOKEN! }, requestInterceptor: (config) => ({ ...config, headers: { ...config.headers, "X-Tenant": process.env.PARABLE_WORKSPACE! }, }), }); const input: SetSourcePermissionsInput = JSON.parse(`{ "expectedRevision": 1, "enforced": true, "linkOnlyGrantsAdmit": true }`); const result = await sdk.providerPolicies.setSourcePermissions( input ); - label: Python SDK lang: python source: |- import json import os from parable_types_web_api import SetSourcePermissionsInput from parable_web_api_sdk import ClientConfig, WebApiSDK sdk = WebApiSDK( ClientConfig( base_url=os.environ["PARABLE_API_URL"], auth_token=os.environ["PARABLE_API_TOKEN"], default_headers={"X-Tenant": os.environ["PARABLE_WORKSPACE"]}, ) ) input_data = SetSourcePermissionsInput.model_validate( json.loads("{\"expectedRevision\":1,\"enforced\":true,\"linkOnlyGrantsAdmit\":true}"), ) result = sdk.provider_policies.set_source_permissions(input_data) - label: Rust SDK lang: rust source: >- use parable_web_api_sdk::{types, ClientConfig, RequestOptions, WebApiSdk}; let sdk = WebApiSdk::new(ClientConfig::with_base_url( std::env::var("PARABLE_API_URL")?, Some(std::env::var("PARABLE_API_TOKEN")?), None, ))?; let options = RequestOptions::with_header("X-Tenant", std::env::var("PARABLE_WORKSPACE")?, None, None); let input: types::SetSourcePermissionsInput = serde_json::from_value( serde_json::json!({ "expectedRevision": 1, "enforced": true, "linkOnlyGrantsAdmit": true }), )?; let result = sdk.provider_policies.set_source_permissions( input, Some(&options) ).await?; - label: Go SDK lang: go source: "sdk, err := webapisdk.New(webapisdk.SDKConfig{\n\tBaseURL: os.Getenv(\"PARABLE_API_URL\"),\n\tAuth: &webapisdk.AuthConfig{Token: os.Getenv(\"PARABLE_API_TOKEN\")},\n\tRequestInterceptor: func(ctx context.Context, req *http.Request) error {\n\t\treq.Header.Set(\"X-Tenant\", os.Getenv(\"PARABLE_WORKSPACE\"))\n\t\treturn nil\n\t},\n})\nif err != nil {\n\treturn err\n}\n\nvar input webapitypes.SetSourcePermissionsInput\nif err := json.Unmarshal([]byte(`{\"expectedRevision\":1,\"enforced\":true,\"linkOnlyGrantsAdmit\":true}`), &input); err != nil {\n\treturn err\n}\nresult, err := sdk.ProviderPoliciesNamespace.SetSourcePermissions(ctx, input)" components: schemas: SetSourcePermissionsInput: additionalProperties: false description: >- Replaces a Workspace's source permissions settings. Both settings are required: a save that leaves one out is refused rather than turning it off. properties: enforced: type: boolean expectedRevision: description: >- The revision the change starts from: 0 for a Workspace that never saved the settings. Another save in between refuses this one. format: int64 maximum: 9007199254740991 minimum: 0 type: integer linkOnlyGrantsAdmit: type: boolean required: - expectedRevision - enforced - linkOnlyGrantsAdmit type: object WorkspaceSourcePermissions: description: >- A Workspace's source permissions settings, on the Provider Policies page. A Workspace that never saved them reads both as false at revision 0. properties: canManage: description: Whether the person reading may change the settings. type: boolean enforced: description: >- Source permissions are enforced: a table a connector models, with no Provider Policy, reads only the rows each reader may open in the source. A table with no model still reads All rows. type: boolean linkOnlyGrantsAdmit: description: >- A link-only `domain` or `anyone` grant admits its audience. When false, such a grant admits nobody beyond the resource's other grants. type: boolean managerReadSources: description: |- The Providers the Workspace has connected whose streams declare a reporting line: the choices for manager reads, by name. items: $ref: '#/components/schemas/ManagerReadSource' type: array managerReads: description: >- Manager reads: while on, a manager reads the rows of their direct reports on the tables that opt in, such as Parable Pulse activity, by the reporting lines of one Provider. Null while off, the default. oneOf: - $ref: '#/components/schemas/WorkspaceManagerReads' - enum: - null nullable: true type: object revision: description: >- The compare-and-swap token: a save names it as expectedRevision. 0 while the Workspace has never saved the settings. format: int64 maximum: 9007199254740991 minimum: -9007199254740991 type: integer updatedAt: description: Who last changed the settings, and when. Null at revision 0. format: date-time nullable: true type: string updatedBy: description: UUID v4 string as base62 nullable: true pattern: ^[0-9A-Za-z]{1,22}$ type: string required: - enforced - linkOnlyGrantsAdmit - revision - managerReadSources - canManage type: object ResponseLinks: properties: first: nullable: true type: string last: nullable: true type: string next: nullable: true type: string prev: nullable: true type: string type: object ResponseMeta: properties: requestId: description: Unique identifier for the request type: string totalCount: description: Total count of items for paginated responses nullable: true type: integer required: - requestId type: object ProblemDetails: description: An error response in the Problem Details format (RFC 9457). properties: code: description: The stable error code, when the problem has one. example: WA-VL-001 type: string detail: description: What went wrong with this request. type: string details: description: >- Structured facts about the refusal, such as the entity or the path it concerns. Only some refusals have it. errors: description: >- The fields or filters that failed validation. Only a validation or filter error has it. requestId: description: >- The ID of the request, when the problem has one. The `X-Request-ID` response header always has it. type: string status: description: The HTTP status code. example: 400 type: integer title: description: A short summary, usually the text of the HTTP status. example: Bad Request type: string type: description: >- The problem type. It is `about:blank`: the status and `code` identify the problem. example: about:blank type: string required: - type - title - status - detail type: object ManagerReadSource: description: |- A Provider the Workspace has connected whose streams declare a reporting line (x-accessManager), such as Workday or Google Workspace. properties: connectorId: description: UUID v4 with automatic base62 encoding for client-facing APIs pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string name: type: string slug: type: string required: - connectorId - slug - name type: object WorkspaceManagerReads: description: The Workspace's manager reads setting while it is on. properties: confirmedAt: description: >- ISO8601 datetime string. Epoch wire values keep this scalar and declare x-temporal-format (unix, unix_millis, unix_micros, unix_nanos) on the property; the unit is never guessed from digit count. format: date-time type: string confirmedBy: description: >- The administrator who confirmed that the Workspace's people were told that their manager can read their activity, and when. pattern: ^[0-9A-Za-z]{1,22}$ type: string connectorId: description: >- The Provider whose reporting lines name each person's direct manager. pattern: >- ^([0-9A-Za-z]{1,22}|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$ type: string required: - connectorId - confirmedBy - confirmedAt type: object headers: X-Request-ID: description: >- The ID of the request. It is the `X-Request-ID` value that you sent, or an ID that the server made. Give it when you report a problem. schema: type: string securitySchemes: bearerAuth: description: >- A personal access token, which starts with `pat_`. A Parable token can call each operation that the roles of its owner allow. An MCP token can call only the read operations that are open to agents. A SQL token does not work on this API. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.