Data Product User Access Metadata

Data product user access responses now include richer access-management metadata. API consumers can identify who granted direct data-product access, distinguish skipped removals from successful updates, and render more precise admin workflows without making extra lookup calls.

What's New

• Data product user records include role.grantedByEmail when the grant source is known.
• Update responses include changes.skippedRemovals so clients can count removal attempts that did not change access.
• Update responses may include skippedRemovals entries with the userId, email, and reason for each skipped removal.

Modified Endpoints

• GET /api/v1/accounts/{accountId}/data-products/{dataProductId}/users
• PATCH /api/v1/accounts/{accountId}/data-products/{dataProductId}/users

Response Format

List responses now include grant attribution on each returned user role:

{
  "ok": true,
  "users": [
    {
      "id": "6ccf6419-2f54-4f0d-9877-69c87f9e7254",
      "email": "[email protected]",
      "firstName": "Viewer",
      "lastName": "User",
      "status": "active",
      "role": {
        "id": "3a68f8b5-04a0-4e13-82cb-481e9d4f50af",
        "scope": "workspace:123e4567-e89b-12d3-a456-426614174000",
        "createdAt": "2026-05-03T12:00:00.000Z",
        "updatedAt": "2026-05-03T12:00:00.000Z",
        "grantedByEmail": "[email protected]"
      }
    }
  ],
  "count": 1,
  "dataProductId": "123e4567-e89b-12d3-a456-426614174000",
  "dataProductName": "Customer Success Share",
  "pagination": {
    "limit": 100,
    "offset": 0,
    "total": 1
  }
}

Update responses now expose skipped removal counts and details when a requested removal could not be applied:

{
  "ok": true,
  "users": [],
  "count": 0,
  "dataProductId": "123e4567-e89b-12d3-a456-426614174000",
  "dataProductName": "Customer Success Share",
  "changes": {
    "added": 0,
    "removed": 1,
    "skipped": 0,
    "reactivated": 0,
    "skippedRemovals": 1
  },
  "skippedRemovals": [
    {
      "userId": "6ccf6419-2f54-4f0d-9877-69c87f9e7254",
      "email": "[email protected]",
      "reason": "already_deleted"
    }
  ]
}

Migration Notes

Existing integrations can continue reading the previous response fields. Treat role.grantedByEmail and skippedRemovals as optional metadata because older grants or no-op update requests may not have attribution or skipped-removal details.