> For the complete documentation index, see [llms.txt](https://help.tellius.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.tellius.com/tellius-6.4/embedding-tellius/embedding-url/embedding-vizpads/row-level-policy-filters.md). # Row-level policy filters Implement row-level security in embedded Tellius Vizpads with the Row Level Policy setting on the embed URL and postMessage, to enforce data access per user. ### **Steps to apply row-level policy** The URL needs to be obtained from the Tellius app. To know how to get the URL, please [refer this section](/tellius-6.4/embedding-tellius/what-you-should-know-before-embedding.md). Here's a sample URL: `https://yourcompany.tellius.com/dashboard///?utm_source=` If row-level policy filters need to be applied, the connecting process is different from the process outlined in [this section](/tellius-6.4/embedding-tellius/embedding-url/embedding-vizpads.md). #### Turning on row-level policy for an embed URL In Tellius 6.4, row-level policy is set on the embed URL itself. When you generate the URL in the **Generate Embed URL** dialog, turn on **Row Level Policy**. The setting is saved with the URL. When an embedded Vizpad with this setting loads, Tellius waits for the embedding app to send `INITIALIZE_ROW_LEVEL_POLICY` with the row-level filters, and applies them to the Vizpad before showing it. Send `INITIALIZE_ROW_LEVEL_POLICY` right after `INITIALIZE`, as shown in the sample code below. After `INITIALIZE`, Tellius waits up to 30 seconds. {% hint style="danger" %} The Vizpad isn't shown, and Tellius displays a message, in these cases: * **No policies within 30 seconds:** "Row Level Policy is taking too long. Please try again." * **Row Level Policy is on, but the message has no policies:** "Access denied: Row-level policy not applied." * **Row Level Policy is off, but the embedding app sends policies:** "Access denied: Row Level Policy is disabled but policies were found for this user." {% endhint %} {% hint style="info" %} Turn on **Row Level Policy** only for embed URLs whose users must see a restricted set of rows, and make sure your app always sends a policy for those users. For embeds that everyone may see in full, leave it off and don't send policies. {% endhint %} #### In releases before Tellius 6.4 In releases before Tellius 6.4, **userID** needed to be included in the URL (for example, `&token=&userId=` at the end of the URL). The presence of **userID** in the URL indicated that the embedding app needed to send `INITIALIZE_ROW_LEVEL_POLICY` postMessage along with the required row-level filters to Tellius. Tellius applied these filters to the Vizpad. {% hint style="danger" %} If **userID** is present in the URL and the embedding app fails to send row-level filters, an error message *"We* *did not get row-level policy"* will be sent, and the Vizpad will not be rendered.\ \ If **userID** is not present in the URL, the required Vizpad will be rendered without applying any row-level policy filters. {% endhint %} ### **Connect with Tellius** 1. To connect with Tellius, the embedding app needs to send a message called `INITIALIZE` . 2. Immediately after sending this, the embedding app sends a message `INITIALIZE_ROW_LEVEL_POLICY` with row-level policy filters. 3. Tellius validates and responds with the message `TELLIUS_INITIALIZED` . The structure of `INITIALIZE` and `INITIALIZE_ROW_LEVEL_POLICY` is given below: ```javascript var telliusFrame ; document.querySelector("iframe").addEventListener("load", function() { telliusFrame = document.getElementsByTagName("iframe")[0].contentWindow; telliusFrame.postMessage('INITIALIZE', "*"); telliusFrame.postMessage({ actionType: "INITIALIZE_ROW_LEVEL_POLICY", rowLevelPolicies: [{ "rowLevelPolicy": { "operator": "and", "args": [ { "value": "Second Class", "field": "Ship_Mode", "condition": "=" } ] }, }, { "rowLevelPolicy": { "operator": "and", "args": [ { "value": [ "Wuhan" ], "field": "City", "condition": "in" } ] }, }], }, "*") }) ``` ### **Supported filters** Please refer to the Operators and Timeline filters. #### **Sample code for timeline filter** ```javascript telliusFrame.postMessage({ actionType: "INITIALIZE_ROW_LEVEL_POLICY", rowLevelPolicies: [ { "rowLevelPolicy": { "operator": "and", "args": [ { "value": undefined, "field": "Ship_Date", "condition": "last 6 years" }] }, }], }, "*") ``` #### **Sample code for custom range filter** ```javascript telliusFrame.postMessage({ actionType: "INITIALIZE_ROW_LEVEL_POLICY", rowLevelPolicies: [ { "rowLevelPolicy": { "operator": "and", "args": [{ "value": { start: "2008-06-06T00:00:00.000+05:30", end: "2013-06-10T00:00:00.000+05:30" }, "field": "Ship_Date", "condition": "custom" }, ] }, }],}, "*") ``` In releases before Tellius 6.4, if any Viz failed to render, Tellius sent the following message to the embedding app. ```javascript { "actionType":"VIZ_RENDER_FAILED", "vizId": UUID, // viz id which failed to render "errorMessage": "" // reason why rendering failed } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.tellius.com/tellius-6.4/embedding-tellius/embedding-url/embedding-vizpads/row-level-policy-filters.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.