Understand how ACLs work in Coda, specifically the read permissions

[Abhishek_Vishwakarma]

Consider an enterprise setup for Coda wherein the identities are managed via IDP (like Azure AD)

1. Is it possible to allow/restrict read permissions to docs at workspace level [for users and groups]
2. Is it possible to allow/restrict read permissions to docs at folder level [for users and groups]
3. As per documentation, SAML group sync is possible with Coda.
4. How are IDP groups mapped in Coda
5. If IDP groups are mapped to Coda user group, considering the APIs, how do we differ between a local Coda group or SAML synced group
6. We believe that permission can be granted at doc level, and not at page or table level
7. Considering the above, how can we fetch effective and exhaustive permissions of a given doc which belongs to a workspace or a folder.
8. API for doc level permission are effective or we need to leverage some other APIs to make it exhaustive considering the inherited permissions from workspace and folder level.
9. Can docs exist without belonging to a folder or workspace

[Eric_Koleda]

I’ve taken a crack at your questions, answering to the best of my knowledge.:

1. Yes, you can add/remove users from a workspace, and share docs with anyone in the workspace.
2. Yes, you can add/remove users to a folder, and they will by default get those permissions on all docs in the folder.
3. Yes.
4. Not sure what the question is, but 1:1 I guess?
5. You can’t create local groups in Coda, only syncing them in from an IdP.
6. Correct, permissions are primarily at the doc-level. You can however use the sync page feature to share just a specific page to another doc.
7. Unfortunately we don’t have an easy API endpoint for that. The Admin API (Enterprise SKU only) provides endpoints to listing Workspace users, folder permissions, and doc permissions, and you’d have to combine them all.
8. See above. There is no endpoint that returns the effective permissions.
9. No.