List workspace permissions should return identity

[GijsR]

Hi there,

Looking through the documentation, I noticed the /api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments/permissions only returns the permissions but not the identity assigned the permission. This would be helpful for scenarios to capture what current permissions are assigned.

[Advika]

Hello @GijsR!

To view the identities assigned to permissions for that workspace, use:
/api/2.0/accounts/{account_id}/workspaces/{workspace_id}/permissionassignments
This endpoint returns the actual users, groups, and service principals mapped to each permission.

https://docs.databricks.com/api/account/workspaceassignment/list

[GijsR]

I'll give this one a try. Thanks, Advika, for the response!

[iyashk-DB]

Hello @GijsR ,

For “who has what” today, the most reliable alternatives are the system tables and Unity Catalog information schema views, which do include principals. You can use the information_schema to list the current grants the principals (GRANTEE) for catalogs, schemas, tables, views, volumes, etc.These views return identities and privilege types, and the system-level information schema lets you query across the whole metastore.
Ref Doc - https://docs.databricks.com/aws/en/sql/language-manual/sql-ref-information-schema

You can also use the system-level information schema lets you query across the whole metastore.
the system.access.audit table to capture permission-update events and ACL changes (including user_name, group_name, and permission_level) for workspace apps and other securables; this is event-oriented but can be used to reconstruct or monitor permission assignments over time.
Ref Doc - https://docs.databricks.com/aws/en/admin/system-tables/audit-logs