Spaces
A Space is an access-controlled namespace boundary within an
organization that scopes which
content and datasets exist and
which users can reach them. Its id is prefixed SPC_.
A Space partitions an organization into isolated workspaces. Every content
resource and dataset belongs to exactly one Space through its spaceId, and a
role reaches a Space only when the Space grants it access. You
set access on the Space through permissions, which bind roles to an access
level. Datasets stay private to their Space unless the Space authorizes
another Space to read them through dataFlowAuthorizedTo. Each Space maps to
a data-plane storage namespace named by catalogName, under which its
materialized tables land.
Triage config
A Space carries an optional triage config that caps and prioritizes automated
alert triage for its detections. It is a
separate resource keyed by spaceId. It overrides the system-wide defaults
for that Space alone. Its settings are weeklyBudgetUsd (weekly AI spend cap,
null for unlimited), minPromotionPriority (floor for the dynamic promotion
threshold), alwaysPromotePriority (priority at or above which alerts always
promote), and alertExpirationHours (hours a queued alert stays active before
expiring). A null setting falls back to the system default.
alwaysPromotePriority must be greater than or equal to
minPromotionPriority when both are set. Editing the config requires the
ManageSimbaSettings capability.
Inputs
| Field | Type | Required | Description |
|---|---|---|---|
name | string | Required | Display name of the Space. |
catalogName | string | Required | Storage namespace segment the data plane uses for the Space's materialized tables. It keys physical Iceberg namespaces on this value. Only lowercase letters, numbers, and underscores. Immutable after creation. |
description | string | Optional | Free-text description of the Space. |
permissions | array<object> | Required | Role-to-access bindings that govern who can reach the Space. Each entry has roleId, roleName, access, and inheritedFrom. access is read, write, or execute, and a Space accepts all three. See access levels for what each grants. |
dataFlowAuthorizedTo | array<object> | Required | Other Spaces authorized to read this Space's datasets. Each entry has spaceId and spaceName. |
Outputs
| Field | Type | Description |
|---|---|---|
permissions | array<object> | inheritedFrom identifies where an inherited binding comes from, and is null for a binding set directly on the Space. |
readOnly | boolean | true when the Space cannot be edited, such as the built-in System space. false for a user-created Space. |
parentId | string | ID of the parent Space in a Space hierarchy. Null for a top-level Space. |
Plus the common resource fields.
Related
- Organizations, the tenant boundary a Space belongs to.
- Content, the authored resources a Space scopes.
- Dataset resources, the datasets a Space scopes and authorizes for cross-Space reads.