Connection permissions

Whether an operation on a connection is allowed is determined by the workspace role, plus the access level and resource role.

• Access level determines who can use the connection.
• Resource role determines which operations are allowed within that scope.

For example, for a connection with an access level of Protected, only users and groups granted a permission can use the connection. Within that group, a Connection User is allowed to run SQL and view the results, while a Connection Viewer is only allowed to view the results.

For a feature overview, see Connection.

Access level

Access level	Description
Workspace	Members in the workspace can access it according to their workspace role. When you grant a resource role, members whose workspace role doesn't allow access can also access it
Protected	Only users and groups granted a resource role can access it. Users with the connection manage permission can edit the connection's permissions
Private	Only users and groups granted a resource role can access it. Even users with the connection manage permission can't edit the connection's permissions

"Users with the connection manage permission" means Workspace Owners and users whose custom role has Manage selected for Create and manage connections in Roles.

TIP

The Protected and Private access levels are an optional feature. Depending on your contract, they might not be available.

Resource role

Role	Summary
Connection Owner	Can edit and delete the connection, and change its permission settings
Connection User	Can run SQL, view the results and tables, and publish related reports
Connection Viewer	Can view the results and tables

Up to 3 Connection Owners can be added (Fixed limits and constraints). The demo connection is an exception: Codatum manages it, so you can't edit or delete the general settings, access level and permissions, or sync targets. You also can't add or remove individual Connection Owners.

Operations and required roles

"X or higher" in the tables means that role and any higher role can perform the operation. Changing a connection's permission settings includes changing the access level and granting or changing resource roles.

Access level: Workspace

Whether an operation is allowed is mainly determined by the workspace role. Users and groups granted a resource role can use this connection within that role, even if their workspace role doesn't allow it. However, a built-in Workspace Viewer granted Connection User or higher still can't run SQL, because the Workspace Viewer limit still applies.

Operation	Required role
Creating a connection	Workspace Editor or higher
Listing connection names	Workspace Viewer or higher
Editing and deleting a connection	Users with the connection manage permission, or Connection Owner
Changing a connection's permission settings	Users with the connection manage permission, or Connection Owner
Running SQL on a connection / downloading execution results	Workspace Editor or higher, or Connection User or higher (except Workspace Viewers)
Getting a connection's SQL execution results and table information	Workspace Viewer or higher, or Connection Viewer or higher

Access level: Protected

Only users and groups granted a resource role can use this connection. Users with the connection manage permission can change the connection's permission settings.

Operation	Required role
Creating a connection	Workspace Editor or higher
Listing connection names	Workspace Viewer or higher
Editing and deleting a connection	Users with the connection manage permission, or (Workspace Viewer or higher and Connection Owner)
Changing a connection's permission settings	Users with the connection manage permission, or (Workspace Viewer or higher and Connection Owner)
Running SQL on a connection / downloading execution results	Workspace Editor or higher, and Connection User or higher
Getting a connection's SQL execution results and table information	Workspace Viewer or higher, and Connection Viewer or higher

Access level: Private

Only users and groups granted a resource role can use this connection. Even users with the connection manage permission can't change the connection's permission settings.

A private connection needs at least one Connection Owner. You can't change a connection with no Connection Owner to private, and you can't remove the last Connection Owner.

Operation	Required role
Creating a connection	Workspace Editor or higher
Listing connection names	Workspace Viewer or higher, and Connection Viewer or higher
Editing and deleting a connection	Workspace Viewer or higher, and Connection Owner
Changing a connection's permission settings	Workspace Viewer or higher, and Connection Owner
Running SQL on a connection / downloading execution results	Workspace Editor or higher, and Connection User or higher
Getting a connection's SQL execution results and table information	Workspace Viewer or higher, and Connection Viewer or higher

Operations on saved queries and the catalog also follow the permissions of the connection they're linked to. For details, see Query and Catalog.