---
title: "Setting up access control permissions to use Insights"
slug: "setting-up-access-control-permissions-to-use-insights"
updated: 2024-10-16T12:24:58Z
published: 2024-10-16T12:24:58Z
canonical: "support.lusid.com/setting-up-access-control-permissions-to-use-insights"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up access control permissions to use Insights

To access the [Insights application](/v1/docs/troubleshooting-a-failed-request-using-the-insights-service) and its logs, you need to ensure your users have the appropriate [roles](/v1/docs/what-is-a-role) and [policies](/v1/docs/what-are-a-policy-and-a-policy-collection) assigned to them. You can manage roles and policies within the LUSID web application.

First, you need to create a policy to grant access to the Insights application:

1. Log in to the [LUSID web app](https://www.lusid.com/app) using the credentials of a LUSID administrator.
2. From the left-hand menu, select **Identity and Access > Policies**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(203).png)
3. On the **Policies** dashboard, click the **Create policy** button. ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(204).png)
4. Specify a unique **Policy code**, **Policy validity** dates if necessary, and select whether the policy should **Allow** or **Deny** access to the features specified.
5. Select the features you would like to grant to the policy. Some of the notable features available are as follows:

![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(205).png)
  - Access to the Insights endpoints - these are the **Insights > API > Requestlogs** policies:
    - **Run GetRequestLog** (Endpoint access - get a specific log record)
    - **Run ListRequestLogs** (Endpoint access - list log records)
    - **Run GetRequest** (Endpoint access - get a request file)
    - **Run GetResponse** (Endpoint access - get a request's response file)
  - Allow a user to see all the request logs for any user (NB: by default users can view their own request logs):
    - **Insights > Requestlogs > View All Request Logs** (Feature - view the log records for all users)
    - **Insights > Requestlogsdetail > View All Request Details** (Feature - view the log request/response files for all users)
  - For the access logs, the user needs feature policies to access the relevant endpoints. This gives access to all access records for all users - there's no way to only see your own access records.
    - **Insights > API > Accesslogs > Run ListAccessEvaluationLogs** (Endpoint access - list the log records)
    - **Insights > API > Accesslogs > Run GetAccessEvaluationLog** (Endpoint access - get a specific log record)
    - **Insights > Accesslogs > View All Access Logs** (Feature - view access logs for any user)
6. Specify any **Time Restrictions** and **Advanced Options** [as usual](/v1/docs/how-do-i-create-a-feature-policy).
7. Select **Done** to review the policy, and **Save** to create the policy: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image(206).png)

Once you have created the policy, you can [assign this to any role](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api) of your choice.