Skip to main content
Enterprise Direct access must be enabled for your organization. Recipients must be active members of the organization with access to the project.
Direct access lets you share individual content with users or groups without sharing its containing space. Use it when someone needs one dashboard, chart, or data app from a restricted space. This page covers sharing and revoking access, roles, content boundaries, discovery, and access after content or membership changes. For automation, see the access API and content-as-code.

​
Manage direct access

You need effective Full access to the content to manage its direct assignments. This can come from an organization, project, space, or direct content role. A personal data app’s creator can also manage its sharing. Can edit alone does not let you manage sharing.
  1. Open the dashboard, independently saved chart, saved SQL chart, or data app and select Share. On a dashboard, open the three-dot menu (…) to find it.
  2. In Share with, select a user or group. Users must already have project access; groups must have access to the project.
  3. Choose Can view, Can edit, or Full access, then click Share.
  4. Send the recipient the content’s URL, or direct them to Shared with me.
Share dialog listing Viewer User with Can view access to Revenue overview

A user with direct Can view access to Revenue overview

To share with a group, select it in Share with and click Share with the appropriate role.
Finance reporting selected in Share with, with Can view chosen and the Share button enabled

Selecting a project group to share with

​
Change a role

To change an assignment, choose another role beside the user or group. Changes are saved as you make them; Done closes the dialog.
Role dropdown beside Viewer User offering Can view, Can edit, and Full access

​
Revoke access

To revoke one assignment, click its Remove access trash icon. Remove all access removes all direct assignments on this item. Removing your own assignment or all assignments asks for confirmation because you may lose access yourself.
Remove all access confirmation explaining that access through spaces remains, with Cancel and Remove buttons
The Share dialog lists direct assignments, not everyone who can access the content. Removing an assignment leaves any access the recipient has through another user, group, space, project, or organization role.

​
How roles combine

Direct roles add access to one item. They do not reduce permissions from another source or change the user’s project role. Lightdash combines applicable inherited access, direct user assignments, and direct group assignments. The highest applicable content role wins. For example, a user with Can view directly and Can edit through a group can edit. Removing the user assignment does not remove their group access. A content role does not supply missing project capabilities. For example, granting Can edit to a project Viewer does not give them access to the Explore view. Custom roles, data permissions, user attributes, and row-level filters still apply. See roles and permissions for project capabilities.

​
What a grant covers

For example, a Revenue overview dashboard in a restricted Finance space contains an owned revenue chart and a reusable Customer detail chart saved separately. Sharing the dashboard lets the recipient view the dashboard and its owned chart. They still need separate access to Customer detail. They cannot browse Finance or open its other dashboards through this grant. A dashboard grant does not grant access to independent saved charts, saved SQL charts, data apps, or external connections referenced by its tiles. Share independent content separately and check its prerequisites. Direct access also does not expand the data a user can query.

​
Find shared content

Open the project’s spaces page and select Shared with me to find content shared directly with you or one of your groups. You can also open a direct URL. Search includes directly accessible content among its supported result types; it does not make unrelated content in a restricted space accessible.
Shared with me tab listing the Revenue overview dashboard for a recipient with a direct group grant

Shared with me for a member who cannot browse the containing space

The containing space remains restricted. A direct grant does not let you browse that space, change its settings, or discover its sibling content. Use the shared item itself as your entry point.

​
Content and membership changes

For exports and scheduled deliveries, the user’s permissions and access to the originating content still apply. A direct role does not grant unrestricted exporting, scheduling, or access to delivery integrations. Direct access is authenticated sharing with existing project members. Copying a URL does not invite someone to the project or make content public. Public dashboard links and embedding use separate access controls. Direct user or group assignments do not authorize an embed JWT; configure embedded access through the embedding settings and token contract.

​
Access API

The project-scoped v2 API manages the same direct assignments as the Share dialog. It requires permission to manage direct access on the target item, including when listing assignments. The base path is:
Use dashboard, chart, sqlChart, or app for resourceType. principalType is user or group; principalUuid identifies an existing eligible user or group. API roles are viewer, editor, and admin, corresponding to the three roles above. Requests do not create project membership.

​
Troubleshoot access

If someone cannot open shared content, check that direct access is available, their account is active, and they still have project access. For a group assignment, check both their group membership and the group’s project access. For a failed tile or linked query, check the independent dependency’s access too. If someone can view but cannot edit, export, schedule, or move content, check their project capabilities and any source or destination space requirements. Full access to an item does not make them a project or space administrator. If someone still has access after you remove an assignment, check their other groups and inherited permissions. Direct access is additive; removing one path does not remove the others.