Administration & Settings

The Administration area is where an organization administrator configures Colrows: connections, assistants, people, governance policies, the SQL resolution cache, and organization settings. Signed-in users can open these pages; changes to organization configuration, people, policies, and credentials require an administrator, and curators can also change a datasource's asset scope.

What administrators configure

The Administration menu has these pages:

• Connections - three tabs. Datasources: create, test, update, and delete connections; set each datasource's asset scope, discovery policy, metadata enrichment, and Restricted Access switch; browse its asset catalog. See Datasources. Analytics Platforms: connect, discover, and test BI sources such as Apache Superset and Microsoft Power BI as inputs to the semantic layer. Data Catalogs: connect external catalogs, such as Databricks and Polaris, that provide additional metadata for your datasources.
• Assistants - configure the embeddable AI assistants and their datasource bindings, and register the embed integrations that let your own application start Assistant sessions for its signed-in users. See Embed an AI Assistant.
• Users and User Groups - user accounts and the groups that policies bind to. See Users & SSO.
• Data Access Policies and Data Masking Policies - see Data Access Control and Data Masking Policies.
• SQL Resolution Cache - find saved SQL by a related question or source, and mark entries stale to stop cache hits.
• Settings - three tabs. General: cloud platforms, organization personas, notification recipients, token quota and usage, billing, and the authentication realm (LDAP, OIDC, or SAML, including the SAML IdP entity ID and certificate upload). Non-administrators can view these settings but not change them. Authorization: authorization attribute definitions, identity-provider mappings, and user and resource values for attribute-based access. OAuth clients: see below.

OAuth clients & apps

Under Settings → OAuth clients, register two kinds of credential. Each has scopes, an expiry of at most one year, and a secret shown once. See Authentication.

• Server-to-server clients act as themselves through the client credentials grant. Scopes: semantic:read, semantic:read-write, semantic:sql, access-control:read, access-control:read-write, data:query, data:sql, and sql:execute.
• Apps act for your organization's users through the authorization code grant: each user signs in to Colrows and approves the app, and the user's data access and masking policies apply. Scopes: semantic:read, semantic:sql, data:query, data:sql, and sql:execute.

data:query compiles and runs read-only queries, reads results, and cancels executions. data:sql submits raw SQL and also requires data:query. sql:execute validates SQL without running the answer query. These scopes apply to the agent query routes under /api/agents/v1/.

Manage via API

Most administration lives on the platform's system and datasource APIs. Changes require an administrator identity; reads need only a signed-in user unless noted: