Sign in

v3

latestOpenAPI 3.1.02026-07-31115157197.4 KB
Bucket Access

Grant Bucket Access

Grant a principal access to a dataset's S3 bucket by SKU.

Resolves (dataset_id, lag, cut) → dataset_name via admin_config.bulk_bucket_details and delegates to BucketPolicyManager.add_principal_for_sku, which is idempotent.

Compliance gate (runs before any S3 write): the client_name (=clients.key) must resolve to a clients.id (422 unknown_client otherwise), and the SKU must not be blocked for that client by the live served-lag restriction model (403 compliance_blocked otherwise).

post/v2/bucket-access/datasets/{dataset_id}/grant

Path parameters

dataset_idstring required

Request body

principal_arnstring required

IAM principal ARN to grant access to (e.g. 'arn:aws:iam::123456789012:user/alice'), or a 12-digit AWS account id which is converted to '<id>:root'.

client_namestring required

Client name; must exist in admin_config.clients.

lagstring nullable

Lag of the dataset SKU to grant access to. Omit (or null) for the no-lag variant — bulk_bucket_details stores no-lag rows with lag=null.

cutstring nullable

Cut of the dataset SKU to grant access to. Omit (or null) for the no-cut variant — bulk_bucket_details stores no-cut rows with cut=null.

Response

Successful Response

dataset_idstring required
lagstring nullable required
cutstring nullable required
principal_arnstring required
client_namestring required
grantedboolean required