Public Dimensions Service and Security

The Data Import API can be used to import public dimension member data, exposed via the publicDimensionData import type.

You can import up to 400,000 members per import job. For imports above this size, we recommend importing rows using multiple jobs.

Authentication Types and Access

The access to public dimension data via the Data Import API varies based on the OAuth Client configuration type:

2-Legged (Technical Connections): provides unrestricted access to dimension data, ideal for technical integrations.
3-Legged (Business User Connections): requires the user to have Read and Maintain privileges on the public dimension. These privileges can be assigned at the role level, offering granular control over who can access specific dimension data. Business users will be able to import any type of member data once the correct permissions are applied.

Note

If the public dimension is stored in an SAP Datasphere space, the user must have Write privilege to this space.

Once the correct authentication is set up, we can import public dimension member data using either the Data Import step-by step import job starting with the /publicDimensions/{publicDimensionID}/PublicDimensionData endpoint, or by using a one-click import with the /import/{PublicDimensionID}/PublicDimensionData endpoint. Here's an example sample request to write a new member to a public dimension:

{
	"Data":[
		{
			ID":"BS100",
			"Description":"Total Assets",
			"customPropertyOne":"AST",
			"customPropertyTwo":"GXS", 
			"Language":"EN", 
		} 
	]
}

Data Access Control (DAC) Filters

Importing DAC filter values (Read and Write columns, manually configured within the modeler) is not supported by the Data Import Service since this data is specific to SAP Analytics Cloud.

Inheritance of DAC Values

When a public dimension is added to a model, the model automatically adopts the DAC values set for the dimension members. These filters play a critical role in controlling access to fact data and master data within models via 3-Legged (Business user) connections.

Application of DAC Filters

DAC filters live inside of the dimension table, but the filters are applied specifically to the /factData and /masterData associated with dimension members in each model. They regulate who can write the data associated with each dimension member.

Example Scenario

Let’s take an example of how DAC, which is set at the dimension level, limits what members a user can import against at the model level. Consider a public dimension table with specific read/write permissions as follows:

Dimension Table
ID	Description	Read	Write
BS100	Total Assets	Tom	Tom
AC200	Liabilities	Jane	Jane

In this instance, if this public dimension is incorporated into a model, Tom is only be able to retrieve fact data or master data associated with the dimension member BS100 from the model, due to DAC filter settings. Similarly, Jane has access to fact data or master data corresponding to member AC200.

Data Locking

Data locking Is a dimension level setting which can restrict the change of model fact data during a certain period of the planning process. Data locks are enabled in the model preferences and for each individual dimension. When data locking is also enabled for a given dimension, the dimension table generates a new Data Locking Owner column. The minimum privilege required to import or update the data locking owner is Update.

The Data Import API can be used to create or update the data locking owner of a member which is then enforced during planning operations if a user attempts to book against a data locked member.

For example, we could introduce a new member using with a data locking owner property using /publicDimensions/{publicDimensionID}/PublicDimensionData.

{ 
	"Data":[
		{ 
			"ID":"BS100", 
			"Description":"Total Assets", 
			"Description":"Paul", 
		} 
	] 
}