---
title: NerdGraph tutorial: Manage data access policies
source: https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-data-access-control
---

You can use our [NerdGraph API](https://docs.newrelic.com/docs/apis/nerdgraph/get-started/introduction-new-relic-nerdgraph/) to create, query, update, and delete data access policies. Data access policies control which [log partitions](https://docs.newrelic.com/docs/logs/ui-data/data-partitions/) your users can access, allowing you to restrict access to sensitive log data based on user groups.

## Requirements [#requirements]

To manage data access policies via NerdGraph, you need:

-   A [Pro or Enterprise](https://newrelic.com/pricing) edition New Relic account
-   [Authentication domain manager](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts#admin-settings) role
-   User type of [core user or full platform user](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-type)
-   A [user key](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/#user-key) for authentication.

## Before you begin [#before-you-begin]

Before using the NerdGraph API for data access policies, understand how [data access control](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/data-access-control) works, and familiarize yourself with [NerdGraph](https://api.newrelic.com/graphiql).

## Common attributes [#attributes]

The following attributes are commonly used in data access policy queries and mutations:

| Attribute            | Description                                                                                                                                                                                                                                                                                           |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `organizationId`     | The ID of the organization associated with the policy. Used to filter policies or scope policy creation.                                                                                                                                                                                              |
| `id`                 | The unique identifier of the policy. Required when updating or deleting a specific policy.                                                                                                                                                                                                            |
| `name`               | A user-friendly name for the data access policy.                                                                                                                                                                                                                                                      |
| `policy`             | The JSON object that defines the policy's rules. It includes: - `rules`: An array of rule objects. - `operations`: The operations to allow or deny (e.g., `SELECT`, `*`). - `eventTypes`: An object specifying which event types to `allow` (e.g., `["*"]`) or `except` (e.g., `["Log_accessible"]`). |
| `accountId`          | The account ID the role grants access to.                                                                                                                                                                                                                                                             |
| `dataAccessPolicyId` | The data access policy ID that defines what data in an account is allowed.                                                                                                                                                                                                                            |
| `roleId`             | The role ID that defines the access level.                                                                                                                                                                                                                                                            |

## Common operations [#operations]

Here are the most common operations for managing data access policies:

**Query data access policies associated with access grants**

This query retrieves all access grants in your organization and their associated data access policies. Use this to get which policies are currently assigned to grants.

### Sample query

```graphql
{
  customerAdministration {
    grants(filter: {organizationId: {eq: "YOUR_ORG_ID"}}) {
      items {
        dataAccessPolicy {
          id
          name
        }
      }
    }
  }
}
```

| Parameter        | Description                                                                                       |
| ---------------- | ------------------------------------------------------------------------------------------------- |
| `organizationId` | **Required.** The organization ID the grants belong to. Use the equals (`eq`) operator to filter. |

### Sample response

```json
{
  "data": {
    "customerAdministration": {
      "grants": {
        "items": [
          {
            "dataAccessPolicy": {
              "id": "DATA_ACCESS_POLICY_ID",
              "name": "DATA_ACCESS_POLICY_NAME"
            }
          }
        ]
      }
    }
  }
}
```

| Response field     | Description                                        |
| ------------------ | -------------------------------------------------- |
| `items`            | List of grants in the organization.                |
| `dataAccessPolicy` | The data access policy associated with each grant. |
| `id`               | The unique identifier of the data access policy.   |
| `name`             | The name of the data access policy.                |

**Query data access policies for an organization**

This query retrieves all data access policies in your organization.

### Sample query

```graphql
{
  customerAdministration {
    dataAccessPolicies(
      filter: {organizationId: {eq: "YOUR_ORG_ID"}}
    ) {
      items {
        id
        name
        policy
        status
        version
      }
    }
  }
}
```

| Parameter        | Description                                                                                         |
| ---------------- | --------------------------------------------------------------------------------------------------- |
| `organizationId` | **Required.** The organization ID the policies belong to. Use the equals (`eq`) operator to filter. |

### Sample response

```json
{
  "data": {
    "customerAdministration": {
      "dataAccessPolicies": {
        "items": [
          {
            "id": "ddadbdd2-183b-42d9-8a1a-41ec7692fb4c",
            "name": "Log Operations",
            "policy": {
              "rules": [
                {
                  "eventTypes": {
                    "allow": [
                      "*"
                    ],
                    "except": [
                      "Log_Operations"
                    ]
                  },
                  "operations": [
                    "*"
                  ]
                }
              ]
            },
            "status": "VALID",
            "version": "1.0-logs"
          },
          {
            "id": "bb8efcf5-3127-4a4d-b25f-114505a0a68d",
            "name": "Restrict Log_Security",
            "policy": {
              "rules": [
                {
                  "eventTypes": {
                    "allow": [
                      "*"
                    ],
                    "except": [
                      "Log_Sec%"
                    ]
                  },
                  "operations": [
                    "*"
                  ]
                }
              ]
            },
            "status": "VALID",
            "version": "1.0-logs"
          }
        ]
      }
    }
  }
}
```

| Response field | Description                                                                     |
| -------------- | ------------------------------------------------------------------------------- |
| `items`        | List of data access policies in the organization.                               |
| `id`           | The unique identifier of the data access policy.                                |
| `name`         | The name of the data access policy.                                             |
| `policy`       | The JSON object containing the policy rules with `operations` and `eventTypes`. |
| `status`       | The current status of the policy (e.g., `VALID`).                               |
| `version`      | The policy version (currently `1.0-logs`).                                      |

**Create a data access policy**

This mutation creates a new data access policy to control access to log partitions.

### Sample mutation

```graphql
mutation createMyPolicy {
  dataAccessPolicyCreate(
    policy: {rules: [{operations: ["SELECT"], eventTypes: {allow: ["*"], except: ["Log_accessible"]}}]}
    name: "Test"
    organizationId: "YOUR_ORG_ID"
  ) {
    dataAccessPolicy {
      id
    }
  }
}
```

You can also use following variables:

```graphql
mutation createMyPolicy($policy: DataAccessPolicyRawDocument!) {
  dataAccessPolicyCreate(
    policy: $policy
    name: "Test"
    organizationId: "YOUR_ORG_ID"
  ) {
    dataAccessPolicy {
      id
    }
  }
}
```

```json
{
  "policy": {
    "rules": [
      {"operations": ["SELECT"], "eventTypes": {"allow": ["*"], "except": []}}
    ]
  }
}
```

| Parameter        | Description                                                                                 |
| ---------------- | ------------------------------------------------------------------------------------------- |
| `organizationId` | **Required.** Your New Relic organization ID.                                               |
| `name`           | **Required.** A descriptive name for the policy.                                            |
| `policy`         | **Required.** The JSON object defining the policy rules with `operations` and `eventTypes`. |

### Sample response

```json
{
  "data": {
    "dataAccessPolicyCreate": {
      "dataAccessPolicy": {
        "id": "YOUR_DATA_POLICY_ID",
        "name": "Test",
        "policy": {
          "rules": [
            {
              "eventTypes": {
                "allow": [
                  "*"
                ],
                "except": [
                  "Log"
                ]
              },
              "operations": [
                "*"
              ]
            }
          ]
        },
        "status": "VALID"
      }
    }
  }
}
```

| Response field | Description                                                                     |
| -------------- | ------------------------------------------------------------------------------- |
| `id`           | The unique identifier of the newly created data access policy.                  |
| `name`         | The name of the data access policy.                                             |
| `policy`       | The JSON object containing the policy rules with `operations` and `eventTypes`. |
| `status`       | The status of the policy (e.g., `VALID`).                                       |

**Update a data access policy**

This mutation updates an existing data access policy to modify its rules or name.

### Sample mutation

```graphql
mutation {
  dataAccessPolicyUpdate(
    policy: {rules: [{operations: ["SELECT"], eventTypes: {allow: ["*"], except: ["Log_inaccessible"]}}]}
    name: "Test"
    id: "YOUR_DATA_POLICY_ID"
  ) {
    dataAccessPolicy {
      name
      id
    }
  }
}
```

| Parameter | Description                                                                                         |
| --------- | --------------------------------------------------------------------------------------------------- |
| `id`      | **Required.** The ID of the policy to update.                                                       |
| `name`    | **Optional.** Updated name for the policy.                                                          |
| `policy`  | **Optional.** The JSON object defining the updated policy rules with `operations` and `eventTypes`. |

### Sample response

```json
{
  "data": {
    "dataAccessPolicyUpdate": {
      "dataAccessPolicy": {
        "assigned": "UNASSIGNED",
        "id": "YOUR_DATA_POLICY_ID",
        "name": "Test",
        "policy": {
          "rules": [
            {
              "eventTypes": {
                "allow": [
                  "*"
                ],
                "except": [
                  "Log_inaccessible"
                ]
              },
              "operations": [
                "SELECT"
              ]
            }
          ]
        },
        "status": "VALID"
      }
    }
  }
}
```

| Response field | Description                                                                             |
| -------------- | --------------------------------------------------------------------------------------- |
| `assigned`     | Indicates if the policy is assigned to any grants (e.g., `UNASSIGNED`).                 |
| `id`           | The unique identifier of the updated data access policy.                                |
| `name`         | The name of the data access policy.                                                     |
| `policy`       | The JSON object containing the updated policy rules with `operations` and `eventTypes`. |
| `status`       | The status of the policy (e.g., `VALID`).                                               |

**Delete a data access policy**

This mutation deletes an existing data access policy.

> #### ⚠️ IMPORTANT
>
> Deleting a policy removes it from all assigned grants. Users in groups with those grants will lose the data access restrictions defined by the policy.

### Sample mutation

```graphql
mutation {
  dataAccessPolicyDelete(id: "YOUR_DATA_POLICY_ID") {
    dataAccessPolicy {
      name
      id
      policy
      status
    }
  }
}
```

| Parameter | Description                                   |
| --------- | --------------------------------------------- |
| `id`      | **Required.** The ID of the policy to delete. |

### Sample response

```json
{
  "data": {
    "dataAccessPolicyDelete": {
      "dataAccessPolicy": {
        "id": "YOUR_DATA_POLICY_ID",
        "name": "Test",
        "policy": {
          "rules": [
            {
              "eventTypes": {
                "allow": [
                  "*"
                ],
                "except": [
                  "Log_inaccessible"
                ]
              },
              "operations": [
                "SELECT"
              ]
            }
          ]
        },
        "status": "VALID"
      }
    }
  }
}
```

| Response field | Description                                                    |
| -------------- | -------------------------------------------------------------- |
| `id`           | The unique identifier of the deleted data access policy.       |
| `name`         | The name of the deleted data access policy.                    |
| `policy`       | The JSON object containing the policy rules that were deleted. |
| `status`       | The status of the policy (e.g., `VALID`).                      |

**Create an access grant with a data access policy**

This mutation creates a new access grant that includes a data access policy, assigning it to a specific account and role.

### Sample mutation

```graphql
mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {accountAccessGrants: {accountId: YOUR_ACCOUNT_ID, dataAccessPolicyId: "YOUR_DATA_POLICY_ID", roleId: "YOUR_ROLE_ID"}}
  ) {
    accessGrants {
      id
    }
  }
}
```

| Parameter            | Description                                       |
| -------------------- | ------------------------------------------------- |
| `accountId`          | **Required.** The account ID to grant access to.  |
| `dataAccessPolicyId` | **Required.** The data access policy ID to apply. |
| `roleId`             | **Required.** The role ID defining permissions.   |

### Response

The response shows the newly created access grant with its ID.

**Update an access grant with a data access policy**

This mutation updates an existing access grant to add or change the data access policy.

### Sample mutation

```graphql
mutation {
  authorizationManagementUpdateAccess(
    updateAccessOptions: {accountAccessGrant: {dataAccessPolicyId: "YOUR_DATA_POLICY_ID"}, ids: YOUR_GRANT_ID}
  ) {
    grants {
      dataAccessPolicy {
        id
      }
      id
    }
  }
}
```

| Parameter            | Description                                                    |
| -------------------- | -------------------------------------------------------------- |
| `ids`                | **Required.** The grant ID to update.                          |
| `dataAccessPolicyId` | **Required.** The data access policy ID to apply to the grant. |

### Sample response

```json
{
  "data": {
    "authorizationManagementUpdateAccess": {
      "grants": [
        {
          "dataAccessPolicy": {
            "id": "YOUR_DATA_POLICY_ID"
          },
          "id": "YOUR_GRANT_ID"
        }
      ]
    }
  }
}
```

| Response field        | Description                                                 |
| --------------------- | ----------------------------------------------------------- |
| `grants`              | List of updated grants.                                     |
| `dataAccessPolicy.id` | The ID of the data access policy now assigned to the grant. |
| `id`                  | The ID of the updated grant.                                |

**Revoke an access grant with a data access policy**

This mutation removes an access grant that includes a data access policy.

### Sample mutation

```graphql
mutation {
  authorizationManagementRevokeAccess(
    revokeAccessOptions: {accountAccessGrants: {accountId: YOUR_ACCOUNT_ID, dataAccessPolicyId: "YOUR_DATA_POLICY_ID", roleId: "YOUR_ROLE_ID"}}
  ) {
    accessGrants {
      id
    }
  }
}
```

| Parameter            | Description                                                     |
| -------------------- | --------------------------------------------------------------- |
| `accountId`          | **Required.** The account ID of the grant to revoke.            |
| `dataAccessPolicyId` | **Required.** The data access policy ID of the grant to revoke. |
| `roleId`             | **Required.** The role ID of the grant to revoke.               |

### Response

The response shows the revoked access grant with its ID.

## Related topics [#related-topics]

[Data access control UI guide](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/data-access-control)

Learn how to manage data access policies through the New Relic UI.

[User management concepts](https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/user-management-concepts)

Understand user types, roles, and access management.

[Manage users with NerdGraph](https://docs.newrelic.com/docs/apis/nerdgraph/examples/nerdgraph-manage-users)

Use the NerdGraph API to programmatically manage users and access grants.

[Log partitions](https://docs.newrelic.com/docs/logs/ui-data/data-partitions/)

Learn how to organize your log data into partitions.