Skip to main content
Version: v3.0.0

Grant and revoke access

Permission grant, revoke, and listing operations are performed on a feature set. For what each role allows, see Permission levels. First obtain the feature set through its workspace:

workspace = client.workspaces.list(name="default")[0]
fs = workspace.feature_sets.get_by_name("training_fs")

Working with users​

The add_* and remove_* methods operate on users, not raw email strings. A user is either a User object (returned by the users API and by the list_* methods below) or a "users/<UUID>" resource name.

When you only know someone's email address, resolve it first with client.users.find_by_email(...). Email is not guaranteed to be unique in the identity provider, so this returns a list of every matching user. Make sure you pick the right one before granting:

matches = client.users.find_by_email("bob@h2o.ai")
if len(matches) != 1:
    raise ValueError(f"ambiguous email: {matches}")
bob = matches[0]

alice = client.users.find_by_email("alice@h2o.ai")[0]
note

Before you can grant a feature set role to a user, that user must already hold a workspace-level role on the parent workspace. Otherwise the server rejects the grant.

Granting a workspace-level role to another user is not currently exposed through the Python client — the workspace creator is granted the owner role automatically, but there is no add_* equivalent for workspaces. This is achieved through the workspace UI instead.

Add permissions to a feature set​

Each add_* method accepts a single user or an iterable of users:

fs.add_owners(bob)
fs.add_editors(bob)
fs.add_consumers([bob, alice])
fs.add_sensitive_consumers(alice)
fs.add_viewers(alice)
fs.add_metadata_viewers(alice)

Remove permissions from a feature set​

Each remove_* method accepts the same inputs as its add_* counterpart:

fs.remove_owners(bob)
fs.remove_editors(bob)
fs.remove_consumers([bob, alice])
fs.remove_sensitive_consumers(alice)
fs.remove_viewers(alice)
fs.remove_metadata_viewers(alice)

List who has access​

Each list_* method returns the users that currently hold the corresponding role, or a higher one. The returned items are User objects, additionally carrying the access_type and resource_type (workspace or feature set) the role was granted through, so they can be passed straight back into the matching remove_* method.

note

The list methods do not return users directly. Instead, they return an iterator which obtains the users lazily.

owners = fs.list_owners()
editors = fs.list_editors()
sensitive_consumers = fs.list_sensitive_consumers()
consumers = fs.list_consumers()
viewers = fs.list_viewers()
metadata_viewers = fs.list_metadata_viewers()

# accessing returned element
owner = next(owners)
owner.email
owner.access_type
owner.resource_type

# Example: revoke Bob's owner role, matching on email
for user in fs.list_owners():
    if user.email == "bob@h2o.ai":
        fs.remove_owners(user)
Feedback