To ensure your securables (i.e. dashboards and datasets) are accessible to the right people, you can create an Admin user that can access and share all securables that exist in your Luzmo organization. Among other potential use cases, this will allow you to gain access to an unshared dashboard/dataset created by a colleague who's enjoying some holidays, or to list all dashboards created by embed designer users.
Next to securables, the Admin user also gets read access to other resources created by users in your organization: their alerts (and the channels & recipients of those alerts), their tasks (e.g. to retrieve the result of a data export), and their AI conversations (including messages and message assets). This allows you to e.g. audit which alerts are being sent to which recipients, or review how AI features are being used across your organization.
Note that this access is not explicitly provisioned, but instead the admin user gets implicit access to all resources; this means you won't see the Admin user being listed in the Share modal of a securable.
Below you can find the steps necessary to create a Luzmo user with "admin" access to your Organization securables, as well as some API calls that show you how you can list or share these securables, and retrieve other organization resources via the Admin user.
The easiest way to create a Luzmo user is via the "Add new member" button in your Organization overview page. In here, we recommend creating a new user with role "Owner" and a dedicated email address (e.g. name+admin@company.com): make sure the email address you specify is valid, as it'll receive an email from Luzmo for verification (which will also allow you to set up a secure password for this user).
Once successfully created and logged in with this new user, we highly recommend to enable Multi Factor Authentication (in your Profile details page) to further secure this admin user. Last but not least, you should create an API key-token pair in the admin users' account (in Profile -> API tokens), which will be used for all admin-related API requests listed below.
After creating your admin user, it's time to promote this user's access to "Admin" to allow them to access all securables in the whole organization. For existing users, you'll need to update the association properties between the User-Organization resources:
curl https://api.luzmo.com/0.1.0/user
-H "Content-Type: application/json"
-d @- << EOF
{
"version": "0.1.0",
"action": "associate",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"id": "< user id >",
"resource": {
"role": "Organizations",
"id": "< organization id >"
},
"properties": {
"flagMember": true,
"flagEditor": true,
"flagOwn": true,
"flagAdmin": true
}
}
EOF
Once you've promoted the Luzmo user to have Admin access in your Organization, you can use its API key-token pair to list all dashboards & datasets that exist in your whole organization using the following API call:
curl https://api.luzmo.com/0.1.0/securable
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "get",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"find": {
"attributes": ["id", "type", "name"],
"options": {
"public": false
}
}
}
EOF
The response will contain one row per securable, where the "type" property indicates whether it's a dataset or a dashboard.
Once you've retrieved the list of dashboards and datasets, you might want to make one or more securables accessible to one or more users. We highly recommend providing access via Groups, as this will greatly facilitate access management in general (see this Academy article for more information about providing access to Groups).
Below you can find an example API request to share a securable with a Group, and a similar API request to share a securable with a single user.
In the request below, we're providing a specific Group "can modify" access to a specific securable:
curl https://api.luzmo.com/0.1.0/securable
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "associate",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"id": "< dataset/dashboard id >",
"resource": {
"role": "Groups",
"id": "< group id >"
},
"properties": {
"flagRead": true,
"flagUse": true,
"flagModify": true,
"flagOwn": false
}
}
EOF
In this request we're providing a specific User "can use" access to a specific securable:
curl https://api.luzmo.com/0.1.0/securable
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "associate",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"id": "< dataset/dashboard id >",
"resource": {
"role": "Users",
"id": "< user id >"
},
"properties": {
"flagRead": true,
"flagUse": true,
"flagModify": false,
"flagOwn": false
}
}
EOF
Your Admin user can also list all alerts that were set up by users in your organization, together with the channels they're linked to (which contain e.g. the recipients of an email alert). This makes it easy to verify which alerts are active and who is receiving them, without having to log in as each individual user.
curl https://api.luzmo.com/0.1.0/alert
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "get",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"find": {
"attributes": ["id", "name", "user_id", "securable_id"],
"include": [
{
"model": "Channel"
}
]
}
}
EOF
The response will contain one row per alert, where the "user_id" property indicates which user created the alert, and the "channels" property lists the channel(s) the alert is sent to (the recipients of a channel can be found in its "config" property).
Tasks keep track of (asynchronous) work that was requested by a user, such as a data export or a dataset synchronization. Your Admin user can list the tasks of all users in your organization, e.g. to check the status of a data export requested by a colleague.
curl https://api.luzmo.com/0.1.0/task
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "get",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"find": {
"attributes": ["id", "type", "status", "user_id", "requested_at", "completed_at"]
}
}
EOF
The response will contain one row per task, where the "type" property indicates what kind of task it is (e.g. "dataexport"), and the "status" property whether it's "open", "inprogress", "completed" or in "error".
Once a data export task is completed, its result contains a download link to the exported file, as well as the timestamp at which this link expires. Note that this download link is only available via the Task API: the webhook that notifies you of a completed data export doesn't contain the download link (nor its expiration), so you'll need to retrieve it with an authenticated API request like the one below:
curl https://api.luzmo.com/0.1.0/task
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "get",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"find": {
"where": {
"id": "< task id >"
},
"attributes": ["id", "status", "result"]
}
}
EOF
For a completed data export, the "result" property contains a "downloadUrl" (the link to download the exported file) and an "expiresAt" timestamp (in milliseconds, after which the link can no longer be used).
When users in your organization use Luzmo's AI features, their conversations are stored as AI conversations, which consist of AI messages (and, where applicable, message assets such as generated charts). Your Admin user can list all AI conversations of users in your organization, e.g. to review how AI features are being used.
curl https://api.luzmo.com/0.1.0/aiconversation
-H "Content-Type: application/json"
-d @- << EOF
{
"action": "get",
"key": "$LUZMO_API_KEY",
"token": "$LUZMO_API_TOKEN",
"version": "0.1.0",
"find": {
"attributes": ["id", "title", "user_id", "created_at", "updated_at"]
}
}
EOF
The response will contain one row per conversation, where the "user_id" property indicates which user owns the conversation. Deleted conversations are not returned.