topic Re: Cannot downgrade workspace object permissions using API in Administration & Architecture

Cannot downgrade workspace object permissions using API

takak — Wed, 06 Nov 2024 16:49:43 GMT

Hi!

I'd like to restrict some users' permissions using REST API and got an issue while trying to update a permission on 'directories'.

I'm trying to set a user's permission on their default username folder in the workspace to 'can edit' so that they cannot create a new notebook until further approval. This works fine on UI, but if I try with API I get the following error.

{'error_code': 'INVALID_PARAMETER_VALUE', 'message': "Cannot downgrade xxx@abc.com's CAN_MANAGE permission on xxxxxxxxxx"}

Is there any way to make this work programmaticaly?

Re: Cannot downgrade workspace object permissions using API

Alberto_Umana — Wed, 06 Nov 2024 18:52:07 GMT

Hi @takak,

Greetings from Databricks!

What is the REST API you are making the call to?

Looks like this might not be supported programmatically, but will try to test it internally. it appears that the CAN_MANAGE permission is a higher-level permission that cannot be downgraded programmatically through the API. This restriction is likely in place to prevent accidental loss of critical management permissions.

Re: Cannot downgrade workspace object permissions using API

takak — Thu, 07 Nov 2024 04:35:08 GMT

Hi @Alberto_Umana

Thank you for your response!

The endpoint I'm calling is `/api/2.0/permissions/{workspace_object_type}/{workspace_object_id}`.

It would be great if it can be tested indeed, thanks!

Re: Cannot downgrade workspace object permissions using API

alexzet — Fri, 15 Nov 2024 21:37:16 GMT

Hello Alberto,

I am trying to disable user access to their folders in our production workspace via API, or maybe limit to can_read. When I do I get a similar message as the posting above. By default users receive the can_manage for their folders. Is there any other way to do lock down these folders? Users are created automatically via AD Groups, so it has to be done programmatically.

Any help would be grately appreciated!