Context
Change Type: Feature
Product area: Application enablement & solutions
Component: Web SDK
Deployed at: eu.latest.cumulocity.com, apj.cumulocity.com, jp.cumulocity.com, cumulocity.com, us.cumulocity.com
Technical details
Build artifact: ui-c8y (1023.74.0)
Internal ID: MTM-66010
Description
The Full export option is now disabled for users who only have inventory rights. Previously, data could be exported without even an error message being displayed in the UI. This issue is now fixed.
Does this restriction refer to the “Export mode: Full” option when generating an export from the Data Explorer?
If so, which permissions are required to be able to generate this export? Why should a user with inventory permissions be restricted from exporting data from this part of the inventory.
Hi @martin.hall-may
Yes - the restriction applies everywhere where the Full option appears in the Export mode dropdown, including the new Data Explorer. To run a Full export, the user needs
the Measurements – Read permission.
Worth clarifying: this is not a newly introduced platform limitation. The permission has always been required by the backend; previously, users without it could initiate the export but received no clear feedback - the request silently failed, leaving them unaware that the issue was a missing permission. This change surfaces that requirement up front by disabling the option and explaining why.
Thanks Lukasz. I think my confusion stems from the overloading of the word “inventory”. To be clear, I wanted to check that a user with an inventory role with measurement read permissions would be able to perform a full export of measurements from devices in that part of the asset tree (see screenshot). That is, the user does not need to have a global role that grants measurement read permissions.
You’re welcome.
I can confirm that an inventory role granting measurement read is not sufficient for Full export. In that case the global Measurements – Read role is required.
Thanks Lukasz. In that case, I don’t understand why an Inventory role that provides Measurements - Read permissions for a device is not sufficient to export the measurement for that device. In fact, I have just tested this and it works. Am I misunderstanding something?
Thanks for testing on your end. I’ve just retested with a user assigned only an inventory role
granting Measurement – Read on a single device group, and the Full export was rejected on my side.
To reconcile the difference, could you share the exact roles assigned to the user you tested with both global and inventory roles? That will help us identify what’s unlocking the export in your environment.
Worth noting: based on the first screenshot you shared, you may be using an older version of the UI where the Full export action was available and clickable even without the required permission. In that version the request was sent but silently rejected by the backend - without a clear error, so the failure was easy to miss.
My mistake, Lukasz. The user I was testing with has global measurement read permissions. But I still don’t understand why inventory measurement read permissions are not sufficient for the full export (of measurements belonging to devices in the assigned groups). What is the thinking behind this?
