Data access grants

A data access grant lets a Connect Any API recipe drive its requests from the rows of one Lake or Warehouse object. The recipe reads the granted rows as a stream named grant_<name>, so the API can answer questions such as "what is the score for this client?" from data the connector could not otherwise read. Users with the admin role create and manage grants in the Data access section of the connector's recipe editor. For the connector end to end, see Connect any API; for the hosts side, see Hosts, streams and data access.

Find the Data access section

Open the connector's recipe editor and select the config node. The Data access section sits below Hosts.
Only users with the admin role see the section; creating and revoking grants also needs Add/Modify Lake Objects. See Who can do what in the Lake.
Each grant row shows its name, its status, Active, Broken or Revoked, the object it reads, its columns, and a summary line with the row count, the date column, the row cap and the hosts the grant is pinned to. A token badge marks every PII column.
While there are no grants, the section reads "No data access yet. A grant lets the recipe drive its requests from the rows of one Lake or WH object. PII columns are sent as tokens."

Create a grant

Click Add data access.
Enter a Grant name. It starts with a lowercase letter, then uses lowercase letters, digits or underscores, up to 48 characters, and it must be unique for this connector. A name that breaks the rule answers "Start with a lowercase letter, then lowercase letters, digits or underscores (48 max)."; one that is already used answers "clients" is already used. The hint below the field reads "The recipe reads the rows as the stream grant_{name}."
Choose the Source, Lake or WH, then pick the Object. Type in Search objects… to narrow the list. Only objects with a PII admin view can be granted; a search with no match reads "No objects match. Only objects with a PII admin view can be granted."
Choose the Columns with Select all and Clear. A token badge marks each PII column, and the note reads "PII columns are sent as tokens, never as raw values."
Optionally set Date column (optional) and Row cap (optional); see below.
Click Continue. If something is missing, the form answers "Pick an object.", "Pick at least one column." or "Enter a whole number greater than 0."
In Confirm data access, review the Columns and Hosts lists, type the object name under Type the object name to confirm, and click Grant access. The dialog explains "Each time the recipe runs, the values of these columns are sent to every host below." With no host approved yet it warns "No approved hosts yet. The grant is pinned to the hosts approved later; each new host needs an admin confirmation."

The confirmation refuses a wrong name with "type the object name "clients_view" exactly to confirm", and if the approved hosts changed while the dialog was open it answers "the hosts changed while you were confirming - reopen the confirmation" so you confirm on the new host list.

A successful save confirms with "Data access "{name}" granted".

What the date column and row cap do

Date column (optional) bounds incremental loads: "Incremental loads read only the rows whose date falls inside the run window. Without one, every run reads the whole object." The list offers None and the object's date or datetime columns; an object without any reads "The object has no date or datetime column."
A PII-tagged column cannot be the date column: "Column "updated_at" is PII-tagged and cannot be the date column - tokens cannot bound the run window."
Row cap (optional): "A run that would read more rows than this fails before the first API request." Enter a whole number greater than 0, up to 2,147,483,647.

Manage grants and revoke one

Statuses: an Active grant loads; a Broken grant stops the connector's loads until it is restored; Revoked is final.
A connector holds at most 8 active or broken grants. At the limit the save is refused with "A connector may hold at most 8 active or broken data access grants". A duplicate name is refused with "A data access grant named "{name}" already exists".
To stop a grant, click Revoke and confirm Revoke data access "{name}"? The dialog warns "Loads that still reference the stream grant_{name} fail from the next run. The grant stays in the audit log." The Revoke button is hidden on a revoked grant, and a revoked grant cannot be changed.
Successes confirm with "Data access "{name}" granted" and "Data access revoked"; failures answer "Could not grant the data access" or "Could not revoke the data access".

When a grant breaks

A grant breaks when what it confirmed no longer matches the object:

a granted column no longer exists in the object;
a column's type changed;
a column became a computed column, is no longer one, or its script changed;
the object definition changed (its view query);
the grant definition was never pinned, so it reads "definition not pinned - an admin must re-confirm the grant".

The reason appears on the grant's row. Loads that use the grant stop with a message such as "GRANT_BROKEN: grant "clients": column "phone" no longer exists in clients_view". The next run checks the grant again: once the object and its columns resolve again, the grant returns to Active and the load can continue. If the reason says it is not pinned, an admin confirms the grant again first.

If a load fails because of a grant

Message	What it means	What to do
GRANT_STREAM: stream "grant_clients" is a data access grant - a grant feeds a parent stream and is never loaded into the Lake	A load was requested for the grant stream itself.	Do not import a grant as a table. Import its parent stream instead.
GRANT_UNKNOWN: grant "clients" of connector "scoring_api" was revoked (or does not exist)	A stream references a grant that is revoked or gone.	Ask an admin to set the access up again, or remove the grant's reference from the recipe, then run again.
GRANT_BROKEN: grant "clients": ...	The object or a granted column changed since the grant was confirmed.	Fix what the reason names, then run again. A grant whose reason says it is not pinned needs an admin confirmation first.

Preview what a grant sends

In the connector's chat, users with the admin role can preview a grant. The preview reads a few rows exactly as the parent stream receives them, with PII columns as tokens, and adds the row count plus per-column statistics: the distinct count, the null count and, for date and numeric columns, the minimum and maximum. A preview returns up to 100 rows, 20 by default. Admins also see up to three sample values per column in the grants list, with PII as tokens; everyone else sees the grant's metadata only.

Questions, answered

Can the assistant create a grant for me?

No. In the connector's chat the assistant can raise a Data access request card, with the purpose and any suggested object, columns, date column or row cap. It never creates the grant: an admin opens Open Data access from the card, reviews the prefilled Add data access form and clicks Grant access. Until then the card reads No grant created; once the grant exists, the card shows it.

How many grants can one connector hold?

Eight active or broken grants. When the limit is reached, the save is refused with "A connector may hold at most 8 active or broken data access grants". Revoked grants stay listed but do not load.

Why did my run fail with a grant error?

The stream references a grant that is revoked, missing or broken. The run error names the case: GRANT_STREAM, GRANT_UNKNOWN or GRANT_BROKEN. Fix what the message names, then run again; the table above lists each case.

Can I import a grant as a Lake table?

No. A grant feeds its parent stream and is never loaded into the Lake; loading the grant_<name> stream itself fails with "GRANT_STREAM: stream "grant_clients" is a data access grant - a grant feeds a parent stream and is never loaded into the Lake". Import the parent stream instead.

Why does my grant say Broken?

Because the object or a granted column changed after the grant was confirmed: a column was removed or changed type, its computed state or script changed, the object definition changed, or the grant was never pinned. The row shows the reason. Loads resume when the grant resolves again; a grant that is not pinned needs an admin confirmation.

What happens after I revoke a grant?

The grant stays in the list as Revoked and cannot be changed; its Revoke button disappears. Loads that still reference the stream grant_<name> fail from the next run. The audit log keeps the grant.

Why can I not delete a table that a grant reads?

The removal is refused with "Cannot remove table "clients_view": ANY API connector "scoring_api" reads it through grant "clients". Revoke the grant first." Columns are refused the same way. A broken grant still blocks the removal, because it counts as live until it is revoked.

Can I see the rows a grant will send?

With the admin role, yes, from the connector's chat: the assistant previews a few rows exactly as the parent stream receives them, with PII columns as tokens, plus per-column statistics. A preview returns up to 100 rows, 20 by default. Other users see the grant's metadata only.

What does the date column change?

It bounds each run to the rows whose date falls inside the run window, which is what incremental loads read. Without one, every run reads the whole object. A PII-tagged column cannot be the date column, because tokens cannot bound the run window.

Why is my table not in the Object list?

Only objects with a PII admin view can be granted. Check the Source you picked, Lake or WH, and clear the search; a table that is not deployed yet has no such view, so deploy it first.