# Data Access API



<Callout>
  Use of this API is dependent on enabling data security. See the associated [Data Access Controls](/features/security/data-access-controls) and [Data Masking](/features/security/data-masking) guides for details.
</Callout>

<EndpointIndex
  names={[
  	'addUserDataAccess',
  	'fetchUserDataAccess',
  	'fetchUserDataAccessForTenant',
  	'deleteUserDataAccess',
  ]}
/>

Add User Data Access [#add-user-data-access]

<ApiEndpoint name="addUserDataAccess" />

Fetch User Data Access [#fetch-user-data-access]

<ApiEndpoint name="fetchUserDataAccess" />

Fetch User Data Access For Tenant [#fetch-user-data-access-for-tenant]

<ApiEndpoint name="fetchUserDataAccessForTenant" />

Delete User Data Access [#delete-user-data-access]

<ApiEndpoint name="deleteUserDataAccess" />

<ApiSchema name="UserDataAccessRequest" />

<ApiSchema name="UserDataAccessResponse" />

See Also [#see-also]

* [Data Access Controls](/features/security/data-access-controls)
* [Data Masking](/features/security/data-masking)


## API Reference

PATCH /auth/users/{locator}/dataaccess/{tenantLocator} — addUserDataAccess
Tags: users-controller
Permissions: write
Parameters:
  locator (uuid, path, required)
  tenantLocator (uuid, path, required)
Request body (UserDataAccessRequest):
Responses:
  200 UserDataAccessResponse — OK

GET /auth/users/{locator}/dataaccess — fetchUserDataAccess
Tags: users-controller
Permissions: read
Parameters:
  locator (uuid, path, required)
Responses:
  200 UserDataAccessResponse[] — OK

GET /auth/users/{locator}/dataaccess/{tenantLocator} — fetchUserDataAccessForTenant
Tags: users-controller
Permissions: read
Parameters:
  locator (uuid, path, required)
  tenantLocator (uuid, path, required)
Responses:
  200 UserDataAccessResponse — OK

DELETE /auth/users/{locator}/dataaccess/{tenantLocator} — deleteUserDataAccess
Tags: users-controller
Permissions: write
Parameters:
  locator (uuid, path, required)
  tenantLocator (uuid, path, required)
Responses:
  200 — OK

UserDataAccessRequest
Properties:
  maskingLevel (Enum none | level1 | level2, required)
  accessControlFields (map<string, map<string, string[]>>, required)

UserDataAccessResponse
Properties:
  userLocator (uuid, required)
  tenantLocator (uuid, required)
  maskingLevel (Enum none | level1 | level2, required)
  accessControlFields (map<string, map<string, string[]>>, required)