Skip to main content

Access

These static settings decide which users DIAL Core treats as administrators or global readers, who may create Code Apps, how API keys are checked against client IP addresses, and how long per-request keys and sharing invitations live. Per-entity access is set in the dynamic configuration instead, with userRoles and Roles. This page is for platform engineers who set up access control.

Admin and global reader rules​

SettingDefaultDescription
access.admin.rulesUsers whose roles claim contains adminRules matched against identity provider claims to decide who is an admin. A caller using a per-request key is never an admin. An admin gets READ, WRITE, and SHARE on the public bucket, on publication review buckets, and under public/deployments/, but no admin grant on user buckets. Admins also call the Configuration API.
access.globalReader.rulesUsers whose roles claim contains global-readerRules that decide who is a global reader, with read access to all public and private resources. Meant for background or scheduled jobs that read user data without write access. Applications, which call with per-request keys, are excluded even if they carry a matching role.
access.createCodeAppRoles—The user roles allowed to create Code Apps or run Code Interpreter. Calls made with a per-request key are allowed even if the originating user lacks the role.

Each rule has three fields:

  • function — TRUE (everyone matches), FALSE (no one matches), EQUAL, CONTAIN, or REGEX.
  • source — the path to the claim in the JWT payload, for example roles.
  • targets — the values the function looks for in the claim.
{
  "access": {
    "admin": {
      "rules": [{ "function": "CONTAIN", "source": "roles", "targets": ["admin"] }]
    },
    "globalReader": {
      "rules": [{ "function": "EQUAL", "source": "roles", "targets": ["global-reader"] }]
    },
    "createCodeAppRoles": ["developer"]
  }
}
warning

Leave access.admin.rules out to keep the built-in default. An empty array ([]) matches everyone for resource access, so every caller without a per-request key becomes an admin of the public bucket and can reload the configuration. The Configuration API fails closed instead and denies everyone.

API keys and per-request keys​

SettingDefaultDescription
apiKeyValidation.proxyCount0The number of trusted proxies between clients and Core. Core uses it to select the client IP address from X-Forwarded-For for API key validation. 0 means no proxies. See selecting an IP address.
perRequestApiKey.ttl1800The lifetime of a per-request API key, in seconds.

Keys themselves are dynamic configuration; see Keys.

Sharing and org units​

SettingDefaultDescription
invitations.ttlInSeconds259200The default lifetime of a sharing invitation, in seconds, rounded up to whole hours. It applies when the user's role sets no share.<RESOURCE_TYPE>.invitation_ttl; see Roles.
orgUnits.enabledfalsePreview. Turns on org units: shared-space folders recorded as units and managed through /v1/org-units/public. When off, those endpoints answer 404.

Further reading​