By default, every user in an account that has Treasure AI Studio can use it. If you want only specific users to have access, you can manage it per user through the Treasure AI REST API: an account administrator grants Studio access to the intended users, and everyone else is denied once your account is switched to restricted (opt-in) mode.
In the current release there is no Treasure Console UI for this — per-user access is managed entirely through the API described below.
Per-user grants only take effect once your account is switched to restricted (opt-in) mode. Until then, every user with Treasure AI Studio can use it regardless of individual grants. Restricted mode is enabled by Treasure AI — contact your Customer Success Manager to request it. When enabling restricted mode, grant access to the intended users before the change takes effect so they are not interrupted.
These endpoints use the standard Treasure AI REST API authentication. See Accessing REST APIs and Treasure API baseURLs for the base URL that applies to your region.
- Authenticate with a Master API key, supplied in the
Authorization: TD1 <api_key>header. - Granting and removing access (
PUT/DELETE) requires the account administrator role. - Reading a user's current access (
GET) is allowed for an account administrator, a delegated administrator, or the user themselves — so users can check their own access, and administrators can check any user in the account. - The target user must belong to your own account — a user ID from another account is not found.
The option key for Treasure AI Studio access is treasure_ai_studio, and the only accepted value is full_access.
These endpoints are available on API v3.
Access is evaluated when Studio issues the user a session token (at sign-in), so changes take effect from the user's next sign-in. Granting access lets the user start a Studio session from then on.
Removing access (in a restricted-mode account) immediately revokes the user's issued Treasure AI credentials, so operations that use Treasure AI data stop right away and the user cannot start a new session. A user who is already signed in, however, keeps their current session — and can continue interactions that do not rely on Treasure AI data — until they sign out or the session expires. In the current release there is no administrator action to force-terminate an already-active session — to end one immediately, the user must sign out (or wait for the session to expire). A user who was never granted access is denied at sign-in.
Grants Treasure AI Studio access to a user.
| HTTP Verb | Resource | Description |
|---|---|---|
| PUT | /v3/access_control/users/:user_id/profile_options/treasure_ai_studio | Grants Studio access to the user |
| Parameter Name | Required | Type | Description |
|---|---|---|---|
user_id | Yes | Integer | ID of the user in your account to grant access to |
| Property Name | Required | Type | Description |
|---|---|---|---|
value | Yes | string | Must be full_access. No other value is accepted. |
$ curl -X PUT \
'https://api.treasuredata.com/v3/access_control/users/<user_id>/profile_options/treasure_ai_studio' \
-H 'Authorization: TD1 <api_key>' \
-H 'Content-Type: application/json' \
-d '{"value": "full_access"}'Status: 200 OK
The response is a map of the user's profile option keys to their resolved values:
{
"treasure_ai_studio": "full_access"
}Removes a user's Treasure AI Studio grant. The user reverts to the account default — denied while your account is in restricted mode.
| HTTP Verb | Resource | Description |
|---|---|---|
| DELETE | /v3/access_control/users/:user_id/profile_options/treasure_ai_studio | Removes the user's Studio grant |
| Parameter Name | Required | Type | Description |
|---|---|---|---|
user_id | Yes | Integer | ID of the user in your account to remove access from |
$ curl -X DELETE \
'https://api.treasuredata.com/v3/access_control/users/<user_id>/profile_options/treasure_ai_studio' \
-H 'Authorization: TD1 <api_key>'Status: 204 No Content
The response body is empty. In a restricted-mode account, removing access immediately revokes the user's already-issued Treasure AI Studio credentials. (While the account is in default-allow mode, removing a grant has no immediate effect, since ungranted users are still allowed.)
Returns the user's resolved profile option values, so you can confirm whether Studio access is currently granted.
| HTTP Verb | Resource | Description |
|---|---|---|
| GET | /v3/access_control/users/:user_id/profile_options/treasure_ai_studio | Gets the user's current Studio access value |
| Parameter Name | Required | Type | Description |
|---|---|---|---|
user_id | Yes | Integer | ID of the user in your account to check |
$ curl \
'https://api.treasuredata.com/v3/access_control/users/<user_id>/profile_options/treasure_ai_studio' \
-H 'Authorization: TD1 <api_key>'Status: 200 OK
{
"treasure_ai_studio": "full_access"
}A value of null means the option is unset, so the user follows the account default.
Per-user access changes are recorded in the Premium Audit Log, so you can review when Studio access was granted to or removed from each user.
- User management — Manage the users in your account
- Accessing REST APIs — API keys and authentication
- Treasure AI Studio — Access Control — How access control works within Studio