26  Data Access Groups (DAGs)

In addition to user roles for access control, DAGs control which records each user can access. Users assigned to a DAG can only access records assigned to that particular DAG, and are blinded to records outside of their group. DAGs are particularly useful in multi-site or multi-jurisdictional projects to restrict sites from viewing records from other sites.

Users can be assigned to a DAG after being added to the project. Users can be in multiple DAGs. Users not assigned to any DAG have global access and can see all records in the project.

Records are assigned to DAG’s using the ‘Record Status Dashboard’ in REDCap.

Cannot be imported with REDCapR. See Section 27.1 for more information.

DAGs can be imported using import_dags() and assigned using import_user_dag_assignment(). If the API user is assigned to multiple DAGs, they can be switched between DAGs using switch_dag().

View the current DAGs by exporting them:

dags = project.export_dags(format_type='df')
dags
data_access_group_name unique_group_name data_access_group_id
0 Full Access full_access 2708
1 Limited Access limited_access 2709

Create and import a new DAG:

new_dag = [{"data_access_group_name": "Test DAG", "unique_group_name": ""}]
project.import_dags(new_dag)
1

Note: the unique_group_name field must be left blank as this is auto-generated by REDCap from the data_access_group_name.

The newly created DAG can now be seen and assigned to.

dags = project.export_dags(format_type='df')
dags
data_access_group_name unique_group_name data_access_group_id
0 Full Access full_access 2708
1 Limited Access limited_access 2709
2 Test DAG test_dag 2721 
dag_mapping = [{"username": 'alexey.gilman@doh.wa.gov', "redcap_data_access_group": "test_dag"}]
project.import_user_dag_assignment(dag_mapping)
1

Note: the redcap_data_access_group name when importing is the same as unique_group_name when exporting DAGs.