---
question: Which named graphs can this workspace read or edit?
kind: task
via_web: available
via_cli: na
via_python: na
via_api: available
via_config: available
ref_web: Settings › Graphs
ref_api: PUT /api/workspaces/{workspace_id}/resource-access/graphs
ref_config: graphs:
prereq: You are an owner or admin of the workspace.
next:
  - /capabilities/build/knowledge-graph/explore-the-graph
  - /capabilities/build/knowledge-graph/add-data
---

# Manage graphs

Each workspace has a graph access policy: which named graphs it reads, which it edits, and whether members may create graphs. Grants are exact graph IRIs. Without a policy, a workspace sees only the graphs created in it. The schema graph can be read, never edited.

## Web UI

### Open the settings

In the Nexus workspace, open **Settings**, then **Graphs**: "Choose the named graphs this workspace can read and edit."

### Set workspace access

Under **Workspace access**:

- **Read all graphs, including future graphs**
- **Include graphs created in this workspace**
- **Allow members to create graphs** (only with the previous box on)

### Grant graphs

Each named graph has a **Read** and an **Edit** checkbox. The **Access** filter shows All access, Read & edit, Read only or No access.

![Workspace Settings on Graphs, filtered to one graph](/abi/Screenshot_Settings_Graphs.png)

*Settings › Graphs, searched for one graph: workspace access at the top, then Read and Edit per named graph.*

### Save

Choose **Save changes**. Viewers keep read-only access whatever the grants.

## CLI

Not applicable. There is no `abi` command for workspace graph access. Use another tab on this page. The command list is the [CLI reference](/user-guide/reference/cli).

## Python

Not applicable. Graph access is a Nexus workspace setting: the triple store service has no notion of workspaces. Use the Web UI, the REST API or the Config steps on this page.

## REST API

Auth: a Nexus session of a workspace owner or admin (`POST /api/auth/login` returns the access token).

### Read the policy

```http
GET /api/workspaces/{workspace_id}/resource-access/graphs
```

It returns the policy (`data`), its `revision` and the `catalog` of graphs to choose from.

### Write it

```bash
curl -X PUT "http://localhost:9879/api/workspaces/$WORKSPACE_ID/resource-access/graphs" \
  -H "Authorization: Bearer $NEXUS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "revision": 3,
    "policy": {
      "read_all": false,
      "read": ["http://ontology.naas.ai/graph/schema"],
      "write": ["http://ontology.naas.ai/graph/my_module"],
      "include_owned": true,
      "allow_create": true
    }
  }'
```

`revision` is the one you read: a stale one answers 409. A 422 means a grant is not an absolute IRI (wildcards are refused), or a newly added grant is not in the workspace's `catalog`. A graph must exist before you can grant it.

## Config

The workspace seed in `config.yaml` sets the first policy of a workspace. It is stored the first time anything reads that workspace's graph policy, which in practice means a new workspace. After that, the stored policy is the only one: change it in Settings › Graphs or over the API.

### Seed the workspace policy

```yaml title="config.yaml"
modules:
  - module: naas_abi
    enabled: true
    config:
      nexus_config:
        organizations:
          - slug: "my-company"
            workspaces:
              - slug: "ops-workspace"
                graphs:
                  read_all: false
                  read:
                    - "http://ontology.naas.ai/graph/schema"
                  write:
                    - "http://ontology.naas.ai/graph/my_module"
                  include_owned: true
                  allow_create: true
```

The defaults are `read_all: false`, empty `read` and `write`, `include_owned: true` and `allow_create: true`. `http://ontology.naas.ai/graph/nexus` cannot be granted, and the schema graph only in `read`.

### Start the workspace

Restart the engine before the workspace is first opened. Editing `config.yaml` later and restarting changes nothing for a workspace that already has a policy.