Cross-Workspace Authorization¶

TrueWatch isolates data by workspace, ensuring that data in each workspace remains independent and secure. It also supports cross-workspace data authorization: you can authorize data from multiple workspaces to the current workspace, then query and display it through dashboards, views, and other chart widgets. After configuring data authorization, you can view data from all authorized workspaces in a single workspace.

In addition, the platform supports unified cross-workspace query within the same site. After this feature is enabled, you can directly query and summarize data from all other workspaces in the same site from the current workspace, without configuring data authorization for each workspace individually.

Authorized To¶

Go to Management > Cross-Workspace Authorization > Authorized To. This page manages the data authorization relationships between the current workspace and other workspaces. It provides two operations:

Add Authorization¶

If you want to authorize data from the current workspace to other workspaces, complete the following steps:

1. Click Add Authorization;

2. Select the authorization scope;

   • Current-Site Authorization: Authorizes data to another workspace in the same site, and takes effect immediately after confirmation.
   • Cross-Site Authorization: Authorizes data to workspaces in different sites. An authorization pack must be generated and imported by the other party before it takes effect.

3. Enter the authorized Workspace ID;

4. Define the data scope;
5. Confirm and generate the authorization pack.

• If you select Current-Site Authorization: after clicking Confirm, the authorization takes effect immediately, and the grantee can see it in the Viewable list in their workspace.

• If you select Cross-Site Authorization: click Generate Authorization Pack, and the system generates a meta json authorization pack file. You need to provide this file to the grantee. The authorization takes effect after the grantee imports and successfully authenticates the file.

Data Scope¶

Includes Synthetic Monitoring, Cloud Billing, Logs, APM, Metrics, Basic Objects, Resource Catalog, Events, RUM, Network, Profiling, and LLM. Multiple selections are supported.

• Log Indexes: If the selected data scope includes log data (that is, "All" or "Logs" is selected), you can further select the indexes you want to authorize for viewing.

  • The indexes here include the default index and all log indexes. External indexes are not included.

• When the data scope is Metrics, you can refine the metric authorization scope:

  • Default option: The system displays "All". If the input box is left empty, all measurements in the current workspace are authorized.
  • Custom filter: You can manually enter tag conditions to filter, separating multiple tag conditions with commas in key:value format. For example, entering host:server, env:prod authorizes only metric data matching these tag conditions.

Import Authorization Pack¶

Click Import Authorization Pack and upload the meta json authorization pack file provided by the authorizer.

• Only .json files are supported.
• After import, the system automatically identifies the authorizer's site, workspace, and data scope.

After successful authentication, the current workspace can see the authorization record in the Viewable list.

Viewable¶

Go to Management > Cross-Workspace Authorization > Viewable. This page shows the data permission records that other workspaces have authorized to the current workspace.

• If the other party authorized directly through Current-Site Authorization, the record is automatically displayed in the list with the status Effective.
• If the other party generated an authorization pack through Cross-Site Authorization, you need to click Import Authorization Pack and upload the .json authorization pack file provided by the other party. After the import and authentication succeed, the record is displayed in the list and its status changes to Effective.

Understanding Authorization Status¶

In the Authorized To or Viewable list, each authorization record displays its current status:

Manage Authorizations¶

In the Authorized To or Viewable list, you can perform the following operations:

• Filter the list by site;
• Enter a workspace name or ID to search and locate;
• Delete the data authorization of a workspace;
• Re-edit authorization rules using the edit button;
• When you add or delete a data authorization, the system generates an audit event and sends an email notification to the owner and administrators of the corresponding workspace.

Impact Scope¶

When editing or deleting an authorization rule, if you reduce the data scope or log indexes, click Confirm. A slide-out panel appears on the right showing the impact scope of the removed data authorization for the currently authorized workspace, including the names of monitor and Data Access configurations.

This list can be exported as a CSV file.

Use Cases¶

After you successfully add cross-workspace authorization, you can query data across workspaces through the following entry points in the workspace.

Same-Site Cross-Workspace Query for APM and RUM¶

On the Application Performance Monitoring (APM) and Real User Monitoring (RUM) pages that support cross-workspace queries, you can use the Workspace selector at the top to select multiple authorized workspaces in the same site and jointly analyze data. The target workspaces must have valid authorization for the corresponding data types, and queries also follow feature permissions and Data Access rules.

1. Open the workspace selector and select the site and workspaces to query;
2. Use the service or application filter conditions provided on the page to determine the analysis target;
3. View the list or charts, and click a specific record to open its details in the source workspace.

Each query can include only one site. When you select a workspace in another site, the original site selection is cleared. After clearing all selections, queries return to the current workspace. Services or applications with the same name in different workspaces are displayed separately, and cannot be identified as the same object based solely on name or application ID.

Cross-Workspace Read-Only¶

When you select multiple workspaces, or select only one workspace other than the current workspace, the page enters a cross-workspace read-only state. You can view, filter, drill down, and export data in the ways supported by the page, but you cannot modify configurations across workspaces, including:

• APM service configuration, favorites, monitor configurations, and team relationships;
• RUM application configuration, SourceMap, dashboard bindings, and Data Access rules;
• Snapshot creation, editing, and deletion.

To modify a configuration, go to the workspace that owns the object, select only the current workspace, and perform the operation according to your original role permissions.

Query Limitations and Exception Handling¶

• ES deployments remain single-select. Free Plan, shared pages, and pages without a cross-workspace authorization entry retain the original limitations.
• If querying or authentication fails in any target workspace, the joint query does not replace complete results with partial results from other workspaces. Follow the page prompts to resolve the authorization issue or retry.
• When the source workspace of a record cannot be confirmed, the details or Session Replay entry is unavailable. Refresh the page and retry.
• If fields with the same name but different types exist across workspaces, you cannot sort or aggregate by that field directly. Follow the page prompts to resolve the type conflict.
• Cross-workspace CSV exports include the workspace name and workspace UUID to help distinguish the source of results.

Query Authorized Data Using Agent¶

After data authorization is complete, you can specify the target workspace, analysis target, and time range in an Agent task in the current workspace, and the Agent queries and analyzes the authorized data. Queries are still limited by the authorization scope, such as data types and log indexes. A joint query includes only workspaces within the same target site.

Data query authorization does not grant configuration modification permissions in the target workspace, nor does it establish invocation relationships between Agents. If you need the specialized capabilities or tools of a target Agent, configure A2A invocation authorization separately. For the differences between the two approaches, see Cross-Workspace Query vs. A2A: How to Choose. For sample questions, see Query Data from Other Workspaces.

Other Query Entry Points¶