Shared datasets

A shared dataset is a publishable contract over one existing ReportPlane warehouse and a selected set of its connected data models. It does not create another warehouse and it never exposes the warehouse credential or provider configuration.

The current release includes publisher lifecycle, project-level read-only Dataset connections, consumer-owned Analytics APIs over connected Dataset models, and public Dataset pages with selected live charts.

Create a dataset#

Open Data Warehouses, select a warehouse, then use Shared datasets.

External provisioning tools can perform the same setup through the Management API Dataset routes. This is intended for idempotent infrastructure and collector initialization: create the Dataset as draft and unlisted, select model and published Analytics IDs, and reconcile provenance metadata by stable slug. Management automation cannot approve its own catalog entry; publishing, public visibility, submission, approval and suspension remain governed lifecycle decisions.

Each dataset requires:

• a globally unique, stable slug;
• at least one active model that is already connected to the warehouse;
• a lifecycle status: draft, published, or disabled;
• a visibility value: unlisted or public.

Publishers may also select zero or more existing Analytics APIs as public charts. A selected chart must be enabled, published, owned by the publisher project, use one of the Dataset's selected models, and execute through the Dataset warehouse. The selection does not copy the Analytics definition or create another query runtime.

You can also provide a description, source name and URL, license name and URL, and attribution text. These fields should identify where the data came from and the terms under which it may be reused.

Only workspace owners and admins can create, update, publish, disable, or archive a shared dataset. Other project users can read its configuration when they already have access to the source project.

Read-only boundary#

The dataset records only safe warehouse identity fields and selected model contracts. It does not return:

• warehouse credentials;
• decrypted secrets;
• provider connection configuration;
• ingest client configuration.

The independent process that collects or crawls source data remains a normal ReportPlane ingest producer. Sharing a dataset does not create a crawler or bypass ingest validation, quotas, or dispatch.

Lifecycle and slugs#

draft keeps the dataset unpublished while metadata is prepared. published makes its stable page and consumer binding available. disabled retains the definition while taking it out of circulation.

Archiving removes the dataset from active workspace usage. Its slug remains reserved and cannot be reused, which protects stable future /data/{slug} references from being reassigned.

Public catalog review and charts#

Public Dataset pages live at https://www.reportplane.com/data/{slug}. Selecting public visibility submits a published Dataset for ReportPlane catalog review; it does not immediately place the Dataset in the catalog. Only approved Datasets appear in /data, catalog search, and the sitemap.

Catalog review has five states:

• not_submitted: the Dataset is not both published and public;
• pending: the Dataset is waiting for review;
• approved: the Dataset is listed in the public catalog and sitemap;
• rejected: the Dataset is not listed;
• suspended: public resolution and query access are disabled.

The current Dashboard displays this status but cannot approve, reject, or suspend a Dataset. Those actions are reserved for ReportPlane operations. Any publisher edit to an approved Dataset returns it to pending review so approval does not silently carry over to changed content. A publisher cannot clear a suspension.

A published Dataset that is unlisted, pending, rejected, or not_submitted is omitted from the catalog and sitemap but remains available to someone who knows its exact slug. These exact-slug pages are marked noindex. A suspended Dataset fails closed even through its exact slug.

The page shows source, license, attribution, safe model fields, and the publisher-selected Analytics charts. It never exposes project IDs, warehouse IDs, credentials, provider configuration, fixed query internals, Runtime API Keys, or Query Client secrets.

Each chart uses the existing Analytics definition, allowed filters, parameters, query planner, binding, cache, warehouse executor, usage accounting, and publisher query quota. Disabling or archiving the Dataset, disabling its warehouse, unpublishing/disabling the Analytics API, or removing its valid warehouse binding removes the affected public surface without creating a bypass.

When a returned chart dimension is also present in that Analytics API's allowed_filters, the public page can expose it as a click-to-filter drill-down. Selecting a bar, slice, point, or table row applies only that already-authorized field to compatible charts on the same Dataset page. Core derives this presentation metadata from the existing definition; Dataset pages cannot introduce an arbitrary field, operator, query, join, or warehouse target. Resetting the view removes the shared filters.

This makes append-only operational streams useful without creating a separate dashboard query language. A collector can continuously send source events through Ingest while the selected Analytics APIs own rolling windows, aggregation, current-state resolution, limits, cache behavior, and safe interactive slices.

For example, a publisher can ingest raw certificate-log entries, vulnerability revisions, known-exploitation entries, package-registry changes, download-counter snapshots, repository observations, and security-advisory/package pairs. ReportPlane Analytics can then publish issuance rates, current severity mixes, vendor rankings, package-change flow, download comparisons, repository-language distribution, and recent high-severity advisories without requiring the collector to pre-aggregate any of those answers.

Public presentation may format timestamps, durations, units, booleans and field labels for readers, but it does not rewrite the result or calculate a second metric. A Dataset can use hidden Analytics fixed_filters for bounded rolling windows such as the latest two hours. Those constraints stay in the saved Analytics contract, are not removable from the public page, and let the publisher omit an unnecessary open-ended date-range control. Visible filters remain optional, explicitly allowed ways to narrow that governed result.

Append-only public datasets can publish current-state views with the same provider-neutral latest_by Analytics contract. Dataset and shared-chart routes do not implement a separate revision engine.

The read-only public contract is:

Method	Path	Purpose
GET	/api/v1/public/datasets	List approved, public, published Dataset summaries for the catalog and sitemap.
GET	/api/v1/public/datasets/{slug}	Resolve a published Dataset by exact slug unless it is suspended.
POST	/api/v1/public/datasets/{slug}/charts/{chart_key}/query	Execute one selected public chart with its existing allowed filters and parameters.

The chart query body uses { "query": { ... } }, matching the existing Analytics query request fields. Arbitrary Analytics IDs or warehouse destinations are not accepted.

Data freshness#

Public catalog cards, Dataset details, and unlisted shared Analytics pages may show Last data received. This timestamp is the latest successful ReportPlane ingest accepted for the model or selected Dataset models; failed ingest attempts do not advance it. It is distinct from Metadata updated, which records publication edits such as a changed name, description, source, or license. A live indicator is presentation policy derived from this verified timestamp and the Dataset's expected cadence; it does not claim that an old or unreported stream is currently live.

When data is written directly to a customer-owned warehouse outside ReportPlane ingest, Core cannot verify warehouse freshness without running an additional source-specific query. In that case the public surface displays Freshness not reported instead of estimating a timestamp.

Connect a dataset to a project#

Open Shared Datasets in the Dashboard. Approved public datasets appear in the catalog. A published dataset outside the approved catalog can be resolved only by entering its exact slug, unless ReportPlane has suspended it.

Connecting creates a DatasetBinding owned by the consumer project. The binding grants read-only product access to the Dataset contract. It does not:

• copy the publisher's models into the consumer project;
• reveal or copy warehouse credentials or configuration;
• allow the consumer to ingest into the publisher's warehouse;
• allow the consumer to edit the publisher's models.

A source project cannot connect its own Dataset because it already owns the underlying warehouse and models. Duplicate active connections are rejected. Disconnecting disables only the consumer binding and does not modify the publisher's Dataset or warehouse.

If a publisher disables or archives a Dataset, it stops resolving as an active connection. Existing binding records do not create a bypass around the publisher lifecycle.

Build Analytics APIs from shared models#

After connecting a Dataset, open New Analytics API. Its models appear in the Data Model selector with the shared Dataset name.

The consumer owns the Analytics API definition, chart settings, allowed filters, publication state, Query Clients, and Runtime API Keys. The source model and warehouse remain publisher-owned. The source warehouse is selected automatically and cannot be replaced from the consumer project.

Analytics API limits are counted for the consumer project and source model, so another consumer's Analytics definitions do not consume this project's per-model allowance.

ReportPlane uses the existing Analytics planner and warehouse executor. The Analytics definition records its Dataset binding, and runtime admits it only while the binding is enabled and the source Dataset remains published.