Manage users, groups and content access
Distinguish administrative permissions, group membership and reader access when connecting an application to IFBI.
An integration needs both permission to perform its administrative task and a suitable reporting experience for its readers. Review those two kinds of access separately.
Distinguish the access layers
| Layer | What to verify |
|---|---|
| API identity | The token represents the intended user or service client. |
| Management permissions | The identity can perform the selected administrative operation. |
| Group membership | The intended readers belong to the approved groups. |
| Content assignments | Dashboards, KPIs and canvases are assigned appropriately. |
| Business-data access | The connection, dataset and reporting configuration expose only permitted data. |
An administrator successfully reading a dashboard is not evidence that a customer can see the intended view, or that another customer cannot access it.
Use the public account operations deliberately
The reference includes user registration and update operations, group save operations, group membership reads and resource-specific group associations. Use the request model and operation shown in the API reference.
Registration responses are operation-specific. Do not assume every create call returns a GUID in Data or a user ID. Handle credential-related material securely and use the documented user lookup operations to resolve the identifiers your application needs.
Group Save accepts a GroupSearchModel that can include users, permissions and other relationships. Inspect the existing group and complete intended membership before updating it; an incomplete model is not a safe membership-only patch.
Review access without changing it
Get Group Users returns a bare array. Dashboard and KPI group-association operations return wrapped arrays. The Review group membership and reporting assignments recipe in Recipes checks those relationships without printing member contact or authentication fields.
Use these results to check membership and assignments, then test the reader’s effective access.
Test the actual reader journey
Use an intended reader account to open the canvas and its underlying content. Check both allowed and disallowed reporting. Repeat the verification after changing groups, source data scope or sharing settings.
For application-managed customer setup, retain the group and resource mappings described in repeatable analytics setup. For browser viewing inside another application, continue with sharing and embedding.
Updated 3 days ago