Roles and access control

Who can see which datasets, and how to give partial access.

Role	Can
`owner`	Everything, including billing and deleting the organisation
`admin`	Everything except billing
`engineer`	Query, create dashboards and monitors, ingest
`analyst`	Query and create dashboards. No ingest, no monitor changes
`viewer`	Read dashboards and saved queries. No ad-hoc query

Dataset-level access

Roles are organisation-wide; groups narrow them to datasets. A group binds a role to a set of datasets, and a user in that group has that role only there.

cURL

curl -X POST https://api.logstreem.com/v1/groups \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Payments engineers",
    "role": "engineer",
    "datasets": ["payments-service", "stripe-webhooks"],
    "members": ["usr_9f2c7b1a", "usr_4a81e0c3"]
  }'

Field-level and row-level

For anything finer than a dataset, use a view — a named filter that behaves like its own dataset — and scope the group to the view. That is how a vendor gets their own rows without seeing anyone else's.

cURL

# A view that only exposes one tenant's rows
curl -X POST https://api.logstreem.com/v1/datasets/api-gateway-prod/views \
  -H "Authorization: Bearer $LOGSTREEM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "tenant-acme", "filter": "tenant_id == \"acme\"", "redact": ["email", "ip"] }'

Redaction happens at read, PII removal should happen at write

redact on a view hides fields from that view's readers. It does not remove them from storage. If the data should never have been stored, filter it in your shipper — see redaction.

PreviousTokens NextAudit log