Data Vault
Browse, query and edit your workspace's tables, and decide who can use each one.
Data Vault is where you work with your data in the Client Portal: create tables — called collections — browse and filter records, edit them, and choose which of your app's users can use each collection. It works the same for the shared database and for your managed databases.
Before you start
- To browse and query: the Member role or above in the workspace. To add or change records: Writer or above. To create or delete collections: Admin or Owner.
- If Data Vault shows a setup card the first time you open it, follow its steps once for the workspace.
Browse a collection
Open Data Vault
Go to Data → Data Vault and pick the workspace at the top of the page.
Pick a collection
The left panel lists your collections. Click one to see its fields and records, 25 to a page.
Filter and sort
Filter with field values, such as { "status": "active" }, or search text with { "$text": "alice" }. Click a column header to sort by it.
Add and edit records
With a collection open, click New record and fill in its fields. To change a record, use Edit on its row.
Create a collection
Click New collection
Give it a name and define its fields.
Check where it will live
A new collection goes in the database you're browsing in Data Vault: Shared PostgreSQL (default) unless you've switched the database picker to one of your managed databases, listed as (dedicated). A managed database that isn't connected to the data API shows in the picker but can't be chosen; see Managed databases.
Don't name a field id, tenant_id or gf_extra: Groundfloor adds those to every collection itself, and creating the collection fails if you declare them.
A record can carry fields the collection doesn't declare. They're kept, returned when you read the record, and you can filter on them.
Deleting a collection deletes all of its records, and can't be undone.
Who can use a collection
Your team can use every collection their workspace role allows. Your app's users — the people who sign in to your Shell apps — need a grant on each collection:
| Grant | Lets them |
|---|---|
read | List the collection, and read and query its records |
write | Also create and update records |
delete | Also delete records |
A new collection is open only to the admin role. To grant another role, open the collection, click Access, pick the role (such as user or viewer) and the grant, and save. You can also manage every grant in one place on Site access.
App users can never create or delete collections, whatever their grant.
App users get access per collection, not per record
A grant covers the whole collection. Anyone whose role can read a collection sees every record in it, write lets them update any record in it, and delete lets them delete any record in it.
If users must see or change only their own records, don't give their roles any grant on that collection: a user who can read it can query the whole collection with their own token, bypassing your app. Have your app's backend (for example a Coderunner) do it instead. The backend checks the signed-in user's token (see Who can reach your Service), reads and writes the collection with a machine-to-machine (M2M) client, which collection grants don't limit, and returns or changes only that user's records. Match records by the token's sub claim (the user's ID); see Know who the user is. Per-record access for app users is planned.
Troubleshooting
| Problem | Likely cause | What to do |
|---|---|---|
| No collections appear | The workspace has none yet, or the setup card hasn't been completed | Complete the setup card, or create a collection |
| A query returns nothing | The filter is too narrow | Clear the filter |
| No New collection button | Your role can't create collections | Ask an Admin or Owner |
An app user gets 403 or an empty list | Their role has no grant on that collection | Open Access and grant it |
Next steps
- Data in Shell apps — read and write records from your app.
- Data Vault API — the same from code.
- Managed databases — a database of your own.