ControlPlane

• Stability: stable
• Since: 0.1.0

Use the control plane API to manage organizations, data products, versions, applications, principals, permissions, profiles, and outlet triggers. Each method takes an execution context (caller identity) and returns the same context alongside the result so you can chain multiple administrative calls in a flow.

• Qualified id: com.dataspine.controlplane.ControlPlane@1
• Kind: interface

Methods

addDataProductVersion

• Stability: stable

Create an immutable, semver-tagged build of a data product by uploading its source files and declaring any native runtime library dependencies. Use the returned version id to deploy, reference, or roll back to a specific build.

addDataProductVersion(request: AddDataProductVersionRequest): AddDataProductVersionResponse

Parameters

Name	Type	Description
request	AddDataProductVersionRequest	Selects the target data product, supplies the semver triple, serialized files with base64 content, native library dependencies, and optional documentation paths for the new version.

Return type

AddDataProductVersionResponse

bindOutletLambdaTrigger

• Stability: stable

Enable event delivery by attaching one or more outlet versions to a trigger. After binding, events produced by those outlet versions will invoke the trigger's Lambda configuration.

bindOutletLambdaTrigger(request: BindOutletLambdaTriggerRequest): BindOutletLambdaTriggerResponse

Parameters

Name	Type	Description
request	BindOutletLambdaTriggerRequest	Selects the trigger and lists outlet version ids that should begin forwarding events to Lambda.

Return type

BindOutletLambdaTriggerResponse

clearDataProductProfile

• Stability: stable

Remove the data product-specific profile override so that reconciliation falls back to organization defaults (or platform defaults when no org default is configured).

clearDataProductProfile(request: ClearDataProductProfileRequest): ClearDataProductProfileResponse

Parameters

Name	Type	Description
request	ClearDataProductProfileRequest	Selects the data product whose profile override should be removed.

Return type

ClearDataProductProfileResponse

createApplication

• Stability: stable

Validates the caller's JWT, resolves the target data product from id or root namespace, and invokes the control plane CreateApplication RPC. On success the new application's UUID is returned alongside the untouched execution context.

createApplication(request: CreateApplicationRequest): CreateApplicationResponse

Parameters

Name	Type	Description
request	CreateApplicationRequest	Selects the parent data product and supplies initial tags JSON plus CORS allow-origins for the new application.

Return type

CreateApplicationResponse

createApplicationAwsPrincipalAssociation

• Stability: stable

Link a Dataspine principal to an AWS IAM principal (ARN) for an application. Use this to tell Dataspine which AWS identity should be used/recognized for AWS integrations owned by that application.

createApplicationAwsPrincipalAssociation(request: CreateApplicationAwsPrincipalAssociationRequest): CreateApplicationAwsPrincipalAssociationResponse

Parameters

Name	Type	Description
request	CreateApplicationAwsPrincipalAssociationRequest	Selects the application, Dataspine principal, and IAM ARN triple to register with the control plane.

Return type

CreateApplicationAwsPrincipalAssociationResponse

createApplicationSshPrincipalAssociation

• Stability: stable

Register an SSH public key that a principal can use in the context of an application (for example, for git access or other SSH-based workflows tied to that application).

createApplicationSshPrincipalAssociation(request: CreateApplicationSshPrincipalAssociationRequest): CreateApplicationSshPrincipalAssociationResponse

Parameters

Name	Type	Description
request	CreateApplicationSshPrincipalAssociationRequest	Selects the application and principal plus the SSH public key text to register.

Return type

CreateApplicationSshPrincipalAssociationResponse

createDataProduct

• Stability: stable

Register a new data product in the catalog by reserving its root namespace and display name under an owning organization. The response provides ids you can use for publishing versions and managing infrastructure.

createDataProduct(request: CreateDataProductRequest): CreateDataProductResponse

Parameters

Name	Type	Description
request	CreateDataProductRequest	Supplies organization id, unique root namespace, and display name for the new data product.

Return type

CreateDataProductResponse

createOrganization

• Stability: stable

Provision a new organization (tenant) so you can group data products, principals, and policies under a shared administrative boundary. Root namespaces reserved here can then be used when creating data products.

createOrganization(request: CreateOrganizationRequest): CreateOrganizationResponse

Parameters

Name	Type	Description
request	CreateOrganizationRequest	Supplies organization metadata including ownership and namespace reservations.

Return type

CreateOrganizationResponse

createOutletLambdaTrigger

• Stability: stable

Create a trigger that delivers outlet events from an application to an AWS Lambda function. Use this to connect outlets to downstream AWS processing without writing custom polling infrastructure.

createOutletLambdaTrigger(request: CreateOutletLambdaTriggerRequest): CreateOutletLambdaTriggerResponse

Parameters

Name	Type	Description
request	CreateOutletLambdaTriggerRequest	Supplies application scope, Lambda ARNs, serialized tags, and backoff parameters for the new trigger.

Return type

CreateOutletLambdaTriggerResponse

createPrincipal

• Stability: stable

Create a principal (an actor identity) within an organization so it can be granted permissions and associated with external identity providers for login.

createPrincipal(request: CreatePrincipalRequest): CreatePrincipalResponse

Parameters

Name	Type	Description
request	CreatePrincipalRequest	Supplies owning organization id and JSON-encoded tags for the new principal.

Return type

CreatePrincipalResponse

createPrincipalAssociation

• Stability: stable

Link a principal to an external identity provider subject (for example, an OIDC sub). Use this to allow a user or service account authenticating via that identity provider to be treated as the principal in Dataspine.

createPrincipalAssociation(request: CreatePrincipalAssociationRequest): CreatePrincipalAssociationResponse

Parameters

Name	Type	Description
request	CreatePrincipalAssociationRequest	Supplies principal id, identity provider id, and subject string for the new association.

Return type

CreatePrincipalAssociationResponse

deleteApplication

• Stability: stable

Issues the control plane DeleteApplication RPC for the supplied application id after validating the caller credentials.

deleteApplication(request: DeleteApplicationRequest): DeleteApplicationResponse

Parameters

Name	Type	Description
request	DeleteApplicationRequest	Selects the application to remove by UUID.

Return type

DeleteApplicationResponse

deleteApplicationAwsPrincipalAssociation

• Stability: stable

Remove an AWS IAM ARN link from an application/principal association. Use this when decommissioning AWS identities, rotating roles/users, or tightening access.

deleteApplicationAwsPrincipalAssociation(request: DeleteApplicationAwsPrincipalAssociationRequest): DeleteApplicationAwsPrincipalAssociationResponse

Parameters

Name	Type	Description
request	DeleteApplicationAwsPrincipalAssociationRequest	Identifies the application, principal, and IAM ARN tuple that should be deleted.

Return type

DeleteApplicationAwsPrincipalAssociationResponse

deleteApplicationSshPrincipalAssociation

• Stability: stable

Remove a previously registered SSH public key from an application/principal association so it can no longer be used for that application's SSH workflows.

deleteApplicationSshPrincipalAssociation(request: DeleteApplicationSshPrincipalAssociationRequest): DeleteApplicationSshPrincipalAssociationResponse

Parameters

Name	Type	Description
request	DeleteApplicationSshPrincipalAssociationRequest	Identifies the application, principal, and exact SSH public key to delete.

Return type

DeleteApplicationSshPrincipalAssociationResponse

deleteDataProduct

• Stability: stable

Permanently remove a data product from the catalog. Use this when you want to decommission a product; callers should ensure dependent workloads and infrastructure are handled before deletion.

deleteDataProduct(request: DeleteDataProductRequest): DeleteDataProductResponse

Parameters

Name	Type	Description
request	DeleteDataProductRequest	Selects the data product to delete by UUID or root namespace.

Return type

DeleteDataProductResponse

deleteDataProductVersion

• Stability: stable

Remove a previously published version from the catalog using its parent data product id and semver. Use this to retract bad builds or clean up unused versions; deletion is irreversible.

deleteDataProductVersion(request: DeleteDataProductVersionRequest): DeleteDataProductVersionResponse

Parameters

Name	Type	Description
request	DeleteDataProductVersionRequest	Identifies the parent data product UUID and semver triple that should be deleted.

Return type

DeleteDataProductVersionResponse

deleteOrganization

• Stability: stable

Permanently remove an organization. Use this only when decommissioning a tenant; dependent data products and related metadata may be removed or become inaccessible as part of deletion.

deleteOrganization(request: DeleteOrganizationRequest): DeleteOrganizationResponse

Parameters

Name	Type	Description
request	DeleteOrganizationRequest	Selects the organization UUID to delete.

Return type

DeleteOrganizationResponse

deleteOutletLambdaTrigger

• Stability: stable

Delete a trigger so outlet events are no longer delivered to the configured Lambda function.

deleteOutletLambdaTrigger(request: DeleteOutletLambdaTriggerRequest): DeleteOutletLambdaTriggerResponse

Parameters

Name	Type	Description
request	DeleteOutletLambdaTriggerRequest	Selects the trigger UUID to remove.

Return type

DeleteOutletLambdaTriggerResponse

deletePrincipal

• Stability: stable

Decommission a principal so it can no longer be used for authorization or identity associations. Use this during offboarding or when cleaning up unused identities.

deletePrincipal(request: DeletePrincipalRequest): DeletePrincipalResponse

Parameters

Name	Type	Description
request	DeletePrincipalRequest	Selects the principal UUID to delete.

Return type

DeletePrincipalResponse

deletePrincipalAssociation

• Stability: stable

Remove an identity provider subject mapping from a principal. Use this when rotating identities or revoking a user's ability to authenticate as the principal.

deletePrincipalAssociation(request: DeletePrincipalAssociationRequest): DeletePrincipalAssociationResponse

Parameters

Name	Type	Description
request	DeletePrincipalAssociationRequest	Identifies the association triple that should be removed from the catalog.

Return type

DeletePrincipalAssociationResponse

describeDataProduct

• Stability: stable

Fetch a data product's catalog entry to confirm you have the right id/root namespace and to obtain the owning organization id for authorization and automation flows.

describeDataProduct(request: DescribeDataProductRequest): DescribeDataProductResponse

Parameters

Name	Type	Description
request	DescribeDataProductRequest	Selects the data product by id or root_namespace according to control plane validation rules.

Return type

DescribeDataProductResponse

describeDataProductProfile

• Stability: stable

Read the current profile override and kill-switch state for a data product. Use this to understand what configuration the infrastructure reconciler will apply and which features/components are enabled or disabled.

describeDataProductProfile(request: DescribeDataProductProfileRequest): DescribeDataProductProfileResponse

Parameters

Name	Type	Description
request	DescribeDataProductProfileRequest	Selects the data product by UUID or root namespace before issuing the describe call.

Return type

DescribeDataProductProfileResponse

describeDataProductVersion

• Stability: stable

Look up a version by UUID to retrieve its parent data product id and semver metadata. This is useful when you only have a version id (e.g. from logs or infrastructure state).

describeDataProductVersion(request: DescribeDataProductVersionRequest): DescribeDataProductVersionResponse

Parameters

Name	Type	Description
request	DescribeDataProductVersionRequest	UUID of the data product version row to describe.

Return type

DescribeDataProductVersionResponse

describeOrganization

• Stability: stable

Fetch an organization's details so you can confirm ownership, parent linkage, and reserved namespaces before creating or managing resources within it.

describeOrganization(request: DescribeOrganizationRequest): DescribeOrganizationResponse

Parameters

Name	Type	Description
request	DescribeOrganizationRequest	Selects the organization by id or name per control plane validation rules.

Return type

DescribeOrganizationResponse

describePrincipal

• Stability: stable

Fetch a principal's details, including any associated external identity provider subjects, to understand how the principal can authenticate and what metadata is attached.

describePrincipal(request: DescribePrincipalRequest): DescribePrincipalResponse

Parameters

Name	Type	Description
request	DescribePrincipalRequest	Principal UUID to describe.

Return type

DescribePrincipalResponse

grantPermission

• Stability: stable

Grant a principal the ability to perform an action on a specific resource. Use this to roll out access to data products, organizations, applications, and other managed resources.

grantPermission(request: GrantPermissionRequest): GrantPermissionResponse

Parameters

Name	Type	Description
request	GrantPermissionRequest	Specifies the principal id plus resource and permission strings to add to the catalog.

Return type

GrantPermissionResponse

listApplicationAwsPrincipalAssociations

• Stability: stable

List the AWS IAM principals currently associated with an application. Use this to audit which AWS identities are authorized/linked for that application's integrations.

listApplicationAwsPrincipalAssociations(request: ListApplicationAwsPrincipalAssociationsRequest): ListApplicationAwsPrincipalAssociationsResponse

Parameters

Name	Type	Description
request	ListApplicationAwsPrincipalAssociationsRequest	Selects the application whose AWS principal associations should be enumerated.

Return type

ListApplicationAwsPrincipalAssociationsResponse

listApplicationSshPrincipalAssociations

• Stability: stable

List the SSH public keys configured for an application, grouped by principal. Use this to audit access and to locate keys for rotation or cleanup.

listApplicationSshPrincipalAssociations(request: ListApplicationSshPrincipalAssociationsRequest): ListApplicationSshPrincipalAssociationsResponse

Parameters

Name	Type	Description
request	ListApplicationSshPrincipalAssociationsRequest	Application UUID whose SSH associations should be enumerated.

Return type

ListApplicationSshPrincipalAssociationsResponse

listApplications

• Stability: stable

Translates the optional data product selector into a ListApplications RPC, returning each application's id, tags JSON, and configured CORS origins.

listApplications(request: ListApplicationsRequest): ListApplicationsResponse

Parameters

Name	Type	Description
request	ListApplicationsRequest	Scopes the listing to a single data product using either data_product_id or data_product_root_namespace.

Return type

ListApplicationsResponse

listDataProductVersions

• Stability: stable

Browse the published versions of a data product so you can pick a specific semver (and version id) for deployment, debugging, rollback, or cleanup.

listDataProductVersions(request: ListDataProductVersionsRequest): ListDataProductVersionsResponse

Parameters

Name	Type	Description
request	ListDataProductVersionsRequest	Selects the parent data product by UUID or root namespace before listing versions.

Return type

ListDataProductVersionsResponse

listDataProducts

• Stability: stable

Discover which data products exist under a given organization so you can pick an id/root namespace for subsequent operations like version publishing, profiles, and application setup.

listDataProducts(request: ListDataProductsRequest): ListDataProductsResponse

Parameters

Name	Type	Description
request	ListDataProductsRequest	Selects the organization whose data products should be returned.

Return type

ListDataProductsResponse

listOrganizations

• Stability: stable

Browse the organization hierarchy by listing direct children under a parent organization. This is useful for management UIs and automated tenant discovery.

listOrganizations(request: ListOrganizationsRequest): ListOrganizationsResponse

Parameters

Name	Type	Description
request	ListOrganizationsRequest	Parent organization UUID whose children should be enumerated.

Return type

ListOrganizationsResponse

listOutletLambdaTriggerBindings

• Stability: stable

Inspect which outlet versions are currently attached to a trigger. Use this to validate rollout state and to decide what to unbind during cleanup or migration.

listOutletLambdaTriggerBindings(request: ListOutletLambdaTriggerBindingsRequest): ListOutletLambdaTriggerBindingsResponse

Parameters

Name	Type	Description
request	ListOutletLambdaTriggerBindingsRequest	Trigger UUID whose outlet bindings should be enumerated.

Return type

ListOutletLambdaTriggerBindingsResponse

listOutletLambdaTriggers

• Stability: stable

List the triggers configured for an application so you can audit delivery configuration and find trigger ids for update, delete, bind, or unbind operations.

listOutletLambdaTriggers(request: ListOutletLambdaTriggersRequest): ListOutletLambdaTriggersResponse

Parameters

Name	Type	Description
request	ListOutletLambdaTriggersRequest	Application UUID whose triggers should be listed.

Return type

ListOutletLambdaTriggersResponse

listPermissions

• Stability: stable

Inspect which permissions a principal currently has. This is useful for auditing access, debugging authorization failures, and building access management tooling.

listPermissions(request: ListPermissionsRequest): ListPermissionsResponse

Parameters

Name	Type	Description
request	ListPermissionsRequest	Principal whose tuples should be returned.

Return type

ListPermissionsResponse

listPrincipalAssociations

• Stability: stable

Inspect which external identity provider subjects are currently linked to a principal. This is useful for auditing and debugging authentication issues.

listPrincipalAssociations(request: ListPrincipalAssociationsRequest): ListPrincipalAssociationsResponse

Parameters

Name	Type	Description
request	ListPrincipalAssociationsRequest	Principal UUID whose associations should be returned.

Return type

ListPrincipalAssociationsResponse

listPrincipals

• Stability: stable

List the principals that exist in an organization so you can audit identities, pick ids for permission grants, or drive automation and provisioning flows.

listPrincipals(request: ListPrincipalsRequest): ListPrincipalsResponse

Parameters

Name	Type	Description
request	ListPrincipalsRequest	Organization UUID whose principals should be listed.

Return type

ListPrincipalsResponse

revokePermission

• Stability: stable

Revoke a previously granted permission so the principal no longer has the specified access to the resource.

revokePermission(request: RevokePermissionRequest): RevokePermissionResponse

Parameters

Name	Type	Description
request	RevokePermissionRequest	Identifies the tuple to remove using principal id, resource, and permission strings.

Return type

RevokePermissionResponse

setOrganizationDefaultProfile

• Stability: stable

Set the organization's default profile that will be inherited by new data products (and used as a fallback when a data product does not define its own override).

setOrganizationDefaultProfile(request: SetOrganizationDefaultProfileRequest): SetOrganizationDefaultProfileResponse

Parameters

Name	Type	Description
request	SetOrganizationDefaultProfileRequest	Selects the organization and carries the full profile_json string to store as the default.

Return type

SetOrganizationDefaultProfileResponse

unbindOutletLambdaTrigger

• Stability: stable

Disable event delivery for specific outlet versions by detaching them from the trigger.

unbindOutletLambdaTrigger(request: UnbindOutletLambdaTriggerRequest): UnbindOutletLambdaTriggerResponse

Parameters

Name	Type	Description
request	UnbindOutletLambdaTriggerRequest	Selects the trigger and lists outlet version ids that should stop invoking Lambda.

Return type

UnbindOutletLambdaTriggerResponse

updateApplication

• Stability: stable

Calls the control plane UpdateApplication RPC with the authenticated principal, replacing stored tags and allowed origins for the selected application id.

updateApplication(request: UpdateApplicationRequest): UpdateApplicationResponse

Parameters

Name	Type	Description
request	UpdateApplicationRequest	Identifies the application to mutate and carries replacement tags_json and cors_allow_origins values.

Return type

UpdateApplicationResponse

updateDataProductProfile

• Stability: stable

Set or replace the data product's profile override. Use this when you want to change how the product is reconciled and deployed (for example, sizing, runtime settings, or other profile-driven infrastructure behavior).

updateDataProductProfile(request: UpdateDataProductProfileRequest): UpdateDataProductProfileResponse

Parameters

Name	Type	Description
request	UpdateDataProductProfileRequest	Selects the data product and carries the full profile_json string to store.

Return type

UpdateDataProductProfileResponse

updateOrganization

• Stability: stable

Change an organization's mutable settings, such as display name, owner principal, parent organization, or reserved namespaces. Use this to restructure tenants or update administrative ownership.

updateOrganization(request: UpdateOrganizationRequest): UpdateOrganizationResponse

Parameters

Name	Type	Description
request	UpdateOrganizationRequest	Carries the organization id and replacement field values for the update RPC.

Return type

UpdateOrganizationResponse

updateOutletLambdaTrigger

• Stability: stable

Update a trigger's Lambda target, invocation role, tags, or retry/backoff settings. Omitted optional fields keep their current values, allowing partial updates.

updateOutletLambdaTrigger(request: UpdateOutletLambdaTriggerRequest): UpdateOutletLambdaTriggerResponse

Parameters

Name	Type	Description
request	UpdateOutletLambdaTriggerRequest	Identifies the trigger and carries optional replacements for ARNs, tags, and retry tuning.

Return type

UpdateOutletLambdaTriggerResponse

Back to Control Plane