Permissions & Sharing

Share collections with users, organizations, and the public

Control who can access your collections. Sharing requires admin permission on the collection.

Check Permissions

from docent import Docent

client = Docent()

has_write = client.has_collection_permission("my-collection-id", "write")
print(f"Has write access: {has_write}")

Parameters

collection_id · str · required

ID of the collection.

permission · str · default: "write"

Permission level to check: "read", "write", or "admin".

---

Share with the Public

# Make publicly readable
client.share_collection_with_public("my-collection-id", permission="read")

# Remove public access
client.unshare_collection_with_public("my-collection-id")

Parameters

collection_id · str · required

ID of the collection.

permission · Literal['read', 'write'] · default: "read"

Public permission level.

---

Share with a User

By Email

client.share_collection_with_email("my-collection-id", "[e-mail]")

By User ID

# Grant read access
client.share_collection_with_user("my-collection-id", "user-456", permission="read")

# Grant write access
client.share_collection_with_user("my-collection-id", "user-456", permission="write")

# Remove access
client.unshare_collection_with_user("my-collection-id", "user-456")

Parameters

collection_id · str · required

ID of the collection.

user_id · str · required

ID of the user.

permission · Literal['read', 'write', 'admin'] · default: "read"

Permission level.

Granting direct user admin access requires direct collection-admin access, an admin role in an organization that administers the collection, or a configured organization provisioner. A user who receives collection admin only as an ordinary organization member may still grant read or write access, but cannot turn that inherited access into a direct admin grant.

---

Share with an Organization

Organization sharing follows the deployment’s configured maximum permission. The default permits admin; a customer-hosted deployment may limit grants to read or write, or disable organization sharing. Lowering the maximum also limits existing organization grants during permission checks without rewriting their stored ACL rows. The internal organization-administrator grant for a service-account-owned collection is preserved. A user with direct collection-admin access may share with an organization. An organization member may do so only when they are an administrator of an organization that has ADMIN access to the collection.

Customer-hosted deployments can set collection_organization_member_max_permission = "write" so an organization ADMIN ACL grants ordinary organization members effective WRITE access. Administrators of that same organization retain the full ACL permission.

client.share_collection_with_organization(
    "my-collection-id",
    "org-789",
    permission="read",
)

# Remove organization access
client.unshare_collection_with_organization("my-collection-id", "org-789")

Parameters

collection_id · str · required

ID of the collection.

organization_id · str · required

ID of the organization.

permission · Literal['read', 'write', 'admin'] · default: "read"

Permission level, up to the deployment’s configured organization-sharing maximum.

---

Organizations

List Your Organizations

orgs = client.get_my_organizations()
for org in orgs:
    print(f"{org['id']}: {org['name']}")

List Organization Users

users = client.get_organization_users("org-789")
for user in users:
    print(f"{user['id']}: {user.get('email')}")

List Collection Collaborators

collaborators = client.get_collection_collaborators("my-collection-id")
for c in collaborators:
    print(f"{c['subject_type']}/{c['subject_id']}: {c['permission_level']}")