NerdGraph tutorial: Manage data access policies

You can use our NerdGraph API to create, query, update, and delete data access policies. Data access policies control which log partitions your users can access, allowing you to restrict access to sensitive log data based on user groups.

Requirements

To manage data access policies via NerdGraph, you need:

A Pro or Enterprise edition New Relic account
Authentication domain manager role
User type of core user or full platform user
A user key for authentication.

Before you begin

Before using the NerdGraph API for data access policies, understand how data access control works, and familiarize yourself with NerdGraph.

Common attributes

The following attributes are commonly used in data access policy queries and mutations:

Attribute	Description
`organizationId`	The ID of the organization associated with the policy. Used to filter policies or scope policy creation.
`id`	The unique identifier of the policy. Required when updating or deleting a specific policy.
`name`	A user-friendly name for the data access policy.
`policy`	The JSON object that defines the policy's rules. It includes: `rules`: An array of rule objects. `operations`: The operations to allow or deny (e.g., `SELECT`, ``). `eventTypes`: An object specifying which event types to `allow` (e.g., `[""]`) or `except` (e.g., `["Log_accessible"]`).
`accountId`	The account ID the role grants access to.
`dataAccessPolicyId`	The data access policy ID that defines what data in an account is allowed.
`roleId`	The role ID that defines the access level.

Common operations

Here are the most common operations for managing data access policies:

This query retrieves all access grants in your organization and their associated data access policies. Use this to get which policies are currently assigned to grants.

Sample query

{
  customerAdministration {
    grants(filter: { organizationId: { eq: "YOUR_ORG_ID" } }) {
      items {
        dataAccessPolicy {
          id
          name
        }
      }
    }
  }
}

Parameter	Description
`organizationId`	Required. The organization ID the grants belong to. Use the equals (`eq`) operator to filter.

Sample response

{
  "data": {
    "customerAdministration": {
      "grants": {
        "items": [
          {
            "dataAccessPolicy": {
              "id": "DATA_ACCESS_POLICY_ID",
              "name": "DATA_ACCESS_POLICY_NAME"
            }
          }
        ]
      }
    }
  }
}

Response field	Description
`items`	List of grants in the organization.
`dataAccessPolicy`	The data access policy associated with each grant.
`id`	The unique identifier of the data access policy.
`name`	The name of the data access policy.

This query retrieves all data access policies in your organization.

Sample query

{
  customerAdministration {
    dataAccessPolicies(filter: { organizationId: { eq: "YOUR_ORG_ID" } }) {
      items {
        id
        name
        policy
        status
        version
      }
    }
  }
}

Parameter	Description
`organizationId`	Required. The organization ID the policies belong to. Use the equals (`eq`) operator to filter.

Sample response

{
  "data": {
    "customerAdministration": {
      "dataAccessPolicies": {
        "items": [
          {
            "id": "ddadbdd2-183b-42d9-8a1a-41ec7692fb4c",
            "name": "Log Operations",
            "policy": {
              "rules": [
                {
                  "eventTypes": {
                    "allow": ["*"],
                    "except": ["Log_Operations"]
                  },
                  "operations": ["*"]
                }
              ]
            },
            "status": "VALID",
            "version": "1.0-logs"
          },
          {
            "id": "bb8efcf5-3127-4a4d-b25f-114505a0a68d",
            "name": "Restrict Log_Security",
            "policy": {
              "rules": [
                {
                  "eventTypes": {
                    "allow": ["*"],
                    "except": ["Log_Sec%"]
                  },
                  "operations": ["*"]
                }
              ]
            },
            "status": "VALID",
            "version": "1.0-logs"
          }
        ]
      }
    }
  }
}

Response field	Description
`items`	List of data access policies in the organization.
`id`	The unique identifier of the data access policy.
`name`	The name of the data access policy.
`policy`	The JSON object containing the policy rules with `operations` and `eventTypes`.
`status`	The current status of the policy (e.g., `VALID`).
`version`	The policy version (currently `1.0-logs`).

This mutation creates a new data access policy to control access to log partitions.

Sample mutation

mutation createMyPolicy {
  dataAccessPolicyCreate(
    policy: {
      rules: [
        {
          operations: ["SELECT"]
          eventTypes: { allow: ["*"], except: ["Log_accessible"] }
        }
      ]
    }
    name: "Test"
    organizationId: "YOUR_ORG_ID"
  ) {
    dataAccessPolicy {
      id
    }
  }
}

You can also use following variables:

mutation createMyPolicy($policy: DataAccessPolicyRawDocument!) {
  dataAccessPolicyCreate(
    policy: $policy
    name: "Test"
    organizationId: "YOUR_ORG_ID"
  ) {
    dataAccessPolicy {
      id
    }
  }
}

{
  "policy": {
    "rules": [
      {
        "operations": ["SELECT"],
        "eventTypes": { "allow": ["*"], "except": [] }
      }
    ]
  }
}

Parameter	Description
`organizationId`	Required. Your New Relic organization ID.
`name`	Required. A descriptive name for the policy.
`policy`	Required. The JSON object defining the policy rules with `operations` and `eventTypes`.

Sample response

{
  "data": {
    "dataAccessPolicyCreate": {
      "dataAccessPolicy": {
        "id": "YOUR_DATA_POLICY_ID",
        "name": "Test",
        "policy": {
          "rules": [
            {
              "eventTypes": {
                "allow": ["*"],
                "except": ["Log"]
              },
              "operations": ["*"]
            }
          ]
        },
        "status": "VALID"
      }
    }
  }
}

Response field	Description
`id`	The unique identifier of the newly created data access policy.
`name`	The name of the data access policy.
`policy`	The JSON object containing the policy rules with `operations` and `eventTypes`.
`status`	The status of the policy (e.g., `VALID`).

This mutation updates an existing data access policy to modify its rules or name.

Sample mutation

mutation {
  dataAccessPolicyUpdate(
    policy: {
      rules: [
        {
          operations: ["SELECT"]
          eventTypes: { allow: ["*"], except: ["Log_inaccessible"] }
        }
      ]
    }
    name: "Test"
    id: "YOUR_DATA_POLICY_ID"
  ) {
    dataAccessPolicy {
      name
      id
    }
  }
}

Parameter	Description
`id`	Required. The ID of the policy to update.
`name`	Optional. Updated name for the policy.
`policy`	Optional. The JSON object defining the updated policy rules with `operations` and `eventTypes`.

Sample response

{
  "data": {
    "dataAccessPolicyUpdate": {
      "dataAccessPolicy": {
        "assigned": "UNASSIGNED",
        "id": "YOUR_DATA_POLICY_ID",
        "name": "Test",
        "policy": {
          "rules": [
            {
              "eventTypes": {
                "allow": ["*"],
                "except": ["Log_inaccessible"]
              },
              "operations": ["SELECT"]
            }
          ]
        },
        "status": "VALID"
      }
    }
  }
}

Response field	Description
`assigned`	Indicates if the policy is assigned to any grants (e.g., `UNASSIGNED`).
`id`	The unique identifier of the updated data access policy.
`name`	The name of the data access policy.
`policy`	The JSON object containing the updated policy rules with `operations` and `eventTypes`.
`status`	The status of the policy (e.g., `VALID`).

This mutation deletes an existing data access policy.

Importante

Deleting a policy removes it from all assigned grants. Users in groups with those grants will lose the data access restrictions defined by the policy.

Sample mutation

mutation {
  dataAccessPolicyDelete(id: "YOUR_DATA_POLICY_ID") {
    dataAccessPolicy {
      name
      id
      policy
      status
    }
  }
}

Parameter	Description
`id`	Required. The ID of the policy to delete.

Sample response

{
  "data": {
    "dataAccessPolicyDelete": {
      "dataAccessPolicy": {
        "id": "YOUR_DATA_POLICY_ID",
        "name": "Test",
        "policy": {
          "rules": [
            {
              "eventTypes": {
                "allow": ["*"],
                "except": ["Log_inaccessible"]
              },
              "operations": ["SELECT"]
            }
          ]
        },
        "status": "VALID"
      }
    }
  }
}

Response field	Description
`id`	The unique identifier of the deleted data access policy.
`name`	The name of the deleted data access policy.
`policy`	The JSON object containing the policy rules that were deleted.
`status`	The status of the policy (e.g., `VALID`).

This mutation creates a new access grant that includes a data access policy, assigning it to a specific account and role.

Sample mutation

mutation {
  authorizationManagementGrantAccess(
    grantAccessOptions: {
      accountAccessGrants: {
        accountId: YOUR_ACCOUNT_ID
        dataAccessPolicyId: "YOUR_DATA_POLICY_ID"
        roleId: "YOUR_ROLE_ID"
      }
    }
  ) {
    accessGrants {
      id
    }
  }
}

Parameter	Description
`accountId`	Required. The account ID to grant access to.
`dataAccessPolicyId`	Required. The data access policy ID to apply.
`roleId`	Required. The role ID defining permissions.

Response

The response shows the newly created access grant with its ID.

This mutation updates an existing access grant to add or change the data access policy.

Sample mutation

mutation {
  authorizationManagementUpdateAccess(
    updateAccessOptions: {
      accountAccessGrant: { dataAccessPolicyId: "YOUR_DATA_POLICY_ID" }
      ids: YOUR_GRANT_ID
    }
  ) {
    grants {
      dataAccessPolicy {
        id
      }
      id
    }
  }
}

Parameter	Description
`ids`	Required. The grant ID to update.
`dataAccessPolicyId`	Required. The data access policy ID to apply to the grant.

Sample response

{
  "data": {
    "authorizationManagementUpdateAccess": {
      "grants": [
        {
          "dataAccessPolicy": {
            "id": "YOUR_DATA_POLICY_ID"
          },
          "id": "YOUR_GRANT_ID"
        }
      ]
    }
  }
}

Response field	Description
`grants`	List of updated grants.
`dataAccessPolicy.id`	The ID of the data access policy now assigned to the grant.
`id`	The ID of the updated grant.

This mutation removes an access grant that includes a data access policy.

Sample mutation

mutation {
  authorizationManagementRevokeAccess(
    revokeAccessOptions: {
      accountAccessGrants: {
        accountId: YOUR_ACCOUNT_ID
        dataAccessPolicyId: "YOUR_DATA_POLICY_ID"
        roleId: "YOUR_ROLE_ID"
      }
    }
  ) {
    accessGrants {
      id
    }
  }
}

Parameter	Description
`accountId`	Required. The account ID of the grant to revoke.
`dataAccessPolicyId`	Required. The data access policy ID of the grant to revoke.
`roleId`	Required. The role ID of the grant to revoke.

Response

The response shows the revoked access grant with its ID.

Data access control UI guide

Learn how to manage data access policies through the New Relic UI.

User management concepts

Understand user types, roles, and access management.

Manage users with NerdGraph

Use the NerdGraph API to programmatically manage users and access grants.

Log partitions

Learn how to organize your log data into partitions.

NerdGraph tutorial: Manage data access policies

Requirements

Before you begin

Common attributes

Common operations

Query data access policies associated with access grants

Sample query

Sample response

Query data access policies for an organization

Sample query

Sample response

Create a data access policy

Sample mutation

Sample response

Update a data access policy

Sample mutation

Sample response

Delete a data access policy

Importante

Sample mutation

Sample response

Create an access grant with a data access policy

Sample mutation

Response

Update an access grant with a data access policy

Sample mutation

Sample response

Revoke an access grant with a data access policy

Sample mutation

Response

Data access control UI guide

User management concepts

Manage users with NerdGraph

Log partitions

NerdGraph tutorial: Manage data access policies

Requirements .css-21sua1{background:none;border:none;width:0;padding:0;}

Before you begin

Common attributes

Common operations

Query data access policies for an organization

Create a data access policy

Update a data access policy

Delete a data access policy

Create an access grant with a data access policy

Update an access grant with a data access policy

Revoke an access grant with a data access policy

Related topics

Data access control UI guide

User management concepts

Manage users with NerdGraph

Log partitions

Requirements