Cross-Workspace Authorization¶

TrueWatch isolates data by workspace to ensure that data in each workspace remains independent and secure. It also supports cross-workspace data authorization, allowing data from multiple workspaces to be authorized to the current workspace for query and display through chart components such as scenario dashboards and views. After configuring data authorization, you can view data from all authorized workspaces in a single workspace.

In addition, the platform supports unified cross-workspace querying on the same site. After enabling this feature, you can directly query and aggregate data from all other workspaces on the same site in the current workspace, without configuring data authorization for each workspace one by one.

Authorized To¶

Go to Manage > Cross-Workspace Authorization > Authorized To. This page is used to manage the data authorization relationships between the current workspace and other workspaces. The page provides two operation entry points:

Add Authorization¶

If you want to authorize data from the current workspace to other workspaces for viewing, complete the following steps:

1. Click Add Authorization;

2. Select the authorization scope;

   • Same-site authorization: Authorizes data to other workspaces on the same site; takes effect immediately after confirmation.
   • Cross-site authorization: Authorizes data to workspaces on a different site; requires generating an authorization package that takes effect after the recipient imports it.

3. Enter the Workspace ID to be authorized;

4. Define the data scope;
5. Confirm to generate the authorization package.

• If you select same-site authorization: after clicking Confirm, the authorization takes effect immediately, and the recipient can see it in the Viewable list of their workspace.

• If you select cross-site authorization: click Generate Authorization Package, and the system generates an authorization package file in meta json format. You need to provide this file to the authorized party; the authorization officially takes effect after they import it and authentication succeeds.

Data Scope¶

Includes Synthetic Monitoring, Cloud Billing, Logs, APM, Metrics, Basic Objects, Resource Catalog, Events, RUM, Network, Profile, and LLM; multiple selections are supported.

• Log indexes: If the selected data scope includes log data (that is, you have selected "All" or "Logs"), you can continue to select the indexes to be authorized for viewing;

  • The indexes here include the default index and all log indexes. Does not include external indexes.

• When "Metrics" is selected as the data scope, you can further refine the metric authorization scope:

  • Default option: The system displays "All". If you keep the input box empty, all measurements under the current workspace are authorized;
  • Custom filtering: You can manually enter tag conditions for filtering. Separate multiple tag conditions with English commas in the key:value format. For example, entering host:server, env:prod authorizes only metric data matching these tag conditions.

Import Authorization Package¶

Click Import Authorization Package to upload the meta json authorization package file provided by the authorizer.

• Only .json file format is supported.
• After import, the system automatically identifies the authorizer's site, workspace, and data scope.

After successful authentication, the current workspace can see the authorization record in the Viewable list.

Viewable¶

Go to Manage > Cross-Workspace Authorization > Viewable. This page displays the data authorization records granted to the current workspace by other workspaces.

• If the other party authorizes directly via same-site authorization, the record automatically appears in the list with the status Active;
• If the other party generated an authorization package via cross-site authorization, click Import Authorization Package to upload the .json authorization package file provided by them. After successful import and authentication, the record appears in the list and its status changes to Active.

Understanding Authorization Status¶

In the Authorized To or Viewable list, each authorization record displays its current status:

Managing Authorization¶

In the Authorized To or Viewable list, you can perform the following operations:

• Filter the list by site;
• Search for and locate a record by entering a workspace name or ID;
• Delete the data authorization of a workspace;
• Re-edit authorization rules via the edit button;
• When adding or removing data authorization, the system generates an audit event and sends an email notification to the owner and admins of the corresponding workspace.

Impact Scope¶

When editing or deleting an authorization rule, reductions may be made to the data scope or log indexes.

After you click Confirm, a slide-out panel appears on the right, showing the impact scope of removing the data authorization for the authorized workspace, including the configuration names of monitors and data access.

The list can be exported as a CSV file.

Use Cases¶

After successfully adding cross-workspace authorization, you can perform cross-workspace queries through the following entry points within the workspace.

APM and RUM Same-Site Cross-Workspace Query¶

On the Application Performance Monitoring (APM) and Real User Monitoring (RUM) pages that support cross-workspace queries, you can use the Workspace selector at the top to select multiple authorized workspaces on the same site and jointly analyze data. Target workspaces must provide valid authorization for the corresponding data types, and queries also follow feature permissions and data access rules.

1. Open the workspace selector, and select the site and workspaces to query;
2. Determine the analysis objects using the service or application filters provided on the page;
3. View lists or charts, and click a specific record to open its details in the source workspace.

Each query can contain only one site. When you select a workspace on a different site, the original site selection is cleared; after clearing all selections, queries revert to the current workspace. Services or applications with the same name in different workspaces are displayed separately and cannot be considered the same object based solely on the name or application ID.

Cross-Workspace Read-Only¶

When you select multiple workspaces, or select only a workspace other than the currently logged-in workspace, the page enters the cross-workspace read-only state. You can view, filter, drill down, and export data in the ways supported by the page, but you cannot modify configurations across workspaces, including:

• APM service configuration, favorites, monitor configuration, and team relationships;
• RUM application configuration, SourceMap, dashboard binding, and data access rules;
• Creating, editing, and deleting snapshots.

To modify configuration, go to the workspace to which the object belongs, select only the current workspace, and then operate according to the original role permissions.

Query Limitations and Exception Handling¶

• ES deployments remain single-select; shared pages and pages without a cross-workspace authorization entry retain the original limitations.
• If querying or authentication fails for any target workspace, the joint query will not replace the complete result with partial results from other workspaces. Handle the authorization according to the page prompts or retry.
• When the source workspace of a record cannot be confirmed, the details or Session Replay entry is unavailable. Refresh and retry.
• When fields with the same name but different types exist across multiple workspaces, you cannot sort or aggregate by that field directly. Handle the type conflict according to the page prompts.
• Cross-workspace CSV export includes the workspace name and workspace UUID to help distinguish the source of results.

Query Authorized Data via Agent¶

After data authorization is completed, you can specify the target workspace, analysis objects, and time range in the Agent tasks of the current workspace, and the Agent queries and analyzes the authorized data. Queries remain limited by the authorization scope, such as data types and log indexes; a single joint query only includes workspaces within the same target site.

Data query authorization does not grant configuration modification permissions in the target workspace, nor does it establish invocation relationships between Agents. When you need the specialized capabilities or tools of a target Agent, configure A2A invocation authorization separately. For the differences between the two methods, see Cross-Workspace Query vs. A2A: How to Choose; for example questions, see Query Data in Other Workspaces.

Other Query Entry Points¶