Edit online

Make sensitive or confidential data in your application more secure by preventing unauthorized run-time access to data pages.

You can use the Security tab on the data page rule form to specify one or more privileges that a user must have to access a data page, for example, to populate a landing page. By restricting access to a data page, you prevent users that do not have specific access privileges from calling that data page through flows, activities, or Pega Digital Experience (DX) API requests at run time, from separate user sessions.

Note: The following restrictions apply:
  • You can apply access restrictions on editable or savable data pages whose scope is not set to Node.
  • The Security tab is available in Pega Platform™ version 8.8.1 and later.

Before you begin:

  • Configure and add privileges that restrict access to the data page that you want to make more secure.
  • Reference those privileges in access roles for the users that you want to authorize to access data. You can add any number of access privileges, according to your business and security requirements.
For more information, see:

  1. In the navigation pane of Dev Studio, click Records.
  2. Expand the Data Model category, and then click Data Page.
  3. In the list of data pages, select the data page that you want to edit.
  4. Click the Security tab.
  5. On the Security tab, in the Restrict access section, click the Add icon.
  6. In the Privilege Class field, enter or select the applicable class of the access privilege that you want to use to restrict access to the data page.
  7. In the Privilege Name field, enter or select the identifier of the access privilege that you want to use to restrict access to the data page.

    For example:

    The following figure shows a sample configuration for run-time access restriction to a data page:

    Data page form showing sample security configuration that restricts access to the data page at run time.

    Data page security tab configuration
  8. Optional: To add more access restrictions to the data page, repeat steps 5 through 7 any number of times.
  9. Confirm your settings by clicking Save.

Result:

The next time a user requests to view data that is generated at run time by the data page to which you restricted access, your application checks whether the user has all access privileges that are required by the data page. If any of the required privileges are missing, the application denies the request.