How access profiles and security groups control what an integration can do.
Perspio controls access in two layers. They apply to people using the Perspio web app and to API applications in the same way.
| Layer | Controls | Set in Perspio as |
|---|---|---|
| Access profile | Which operations can be performed | Full Access, Read Only, or a Custom profile with specific APIs selected |
| Security groups | Which assets can be seen | One or more security groups. With none assigned, every asset in the tenant is visible |
Access profiles
An access profile (also called a role) decides which API operations are allowed. Operations are grouped the same way as the modules in the Perspio web app, so a Custom profile can, for example, allow Assets and Reports but not Users. A call to an operation outside the profile fails.
Security groups
Security groups are the only way to restrict which assets are visible. Add assets to a group through the Perspio web app or the Groups APIs, then assign the group. Only assets in the assigned groups are returned.
API applications
An administrator chooses an API application's access profile and security groups when they create it in Perspio. They can also leave it unrestricted, with Full Access and no security groups. These settings apply to every access token the application receives. To change what an integration can do, update its API application. No code change is needed.