Administration & Settings

The Administration area is where an organization administrator configures Colrows: connections, assistants, people, governance policies, the SQL resolution cache, and organization settings. Signed-in users can open these pages; changes to organization configuration, people, policies, and credentials require an administrator, and curators can also change a datasource's asset scope.

What administrators configure

The Administration menu has these pages:

• Connections - five tabs: Datasources, Analytics Platforms, Data Catalogs, Code Repositories, and Documents (connect AWS S3, Google Drive, or Microsoft OneDrive as read-only document sources). Under Datasources: create, test, update, and delete connections; set each datasource's asset scope, discovery policy, metadata enrichment, and Restricted Access switch; browse its asset catalog. See Datasources. Analytics Platforms: connect, discover, and test BI sources such as Apache Superset and Microsoft Power BI as inputs to the semantic layer. Data Catalogs: connect external catalogs, such as Databricks and Polaris, that provide additional metadata for your datasources.
• Assistants - configure the embeddable AI assistants and their datasource bindings, and register the embed integrations that let your own application start Assistant sessions for its signed-in users. See Embed an AI Assistant.
• Users and User Groups - user accounts and the groups that policies bind to. See Users & SSO.
• Data Access Policies and Data Masking Policies - see Data Access Control and Data Masking Policies.
• SQL Resolution Cache - find saved SQL by a related question or source, and mark entries stale to stop cache hits.
• Settings - three tabs. General: cloud platforms, organization personas, notification recipients, token quota and usage, billing, the Enable Document Processing switch, and the authentication realm (LDAP, OIDC, or SAML, including the SAML IdP entity ID and certificate upload). Non-administrators can view these settings but not change them. Authorization: authorization attribute definitions, identity-provider mappings, and user and resource values for attribute-based access. OAuth clients: see below.

OAuth clients & apps

Under Settings → OAuth clients, register two kinds of credential. Each has scopes, an expiry of at most one year, and a secret shown once. See Authentication.

• Server-to-server clients act as themselves through the client credentials grant. Scopes: semantic:read, semantic:read-write, semantic:sql, access-control:read, access-control:read-write, data:query, data:sql, and sql:execute.
• Apps act for your organization's users through the authorization code grant: each user signs in to Colrows and approves the app, and the user's data access and masking policies apply. Scopes: semantic:read, semantic:sql, data:query, data:sql, and sql:execute.

data:query compiles and runs read-only queries, reads results, and cancels executions. data:sql submits raw SQL and also requires data:query. sql:execute validates SQL without running the answer query. These scopes apply to the agent query routes under /api/agents/v1/.

Manage via API

Most administration lives on the platform's system and datasource APIs. Changes require an administrator identity; reads need only a signed-in user unless noted: