Skip to content

Manifests

Your governance rules exist as Attributes, Countries, Claims, and Policies, but none of it protects anything yet until it's connected to real data. That's what a Manifest does.

A Manifest (also called an Entitlement in the API) is the object that maps your actual data schema, whether JSON, XML, or database columns, to eXate's protection model. Without a Manifest, eXate has no way to know which field in your data corresponds to which Attribute, which is what enables protection down to the individual column or field, rather than an all-or-nothing decision on the whole dataset.

A Manifest contains:

  • Attribute Map: maps specific paths in your data (a JSON field, an XML element, a database column) to global Attributes, like Email or SSN.
  • Filters: fine-grained, dynamic protection rules contained directly within the Manifest, evaluated based on context. For row-level restrictions specifically, see Filter Expressions.
  • Policies: linked to the Manifest via the Attributes it maps, Policies decide who can see those Attributes unprotected. See Policies.
  • Meta Tags: optional structured metadata attached to the Manifest itself, see Meta Tags.

Does a Manifest need a Policy to exist first?

No, strictly speaking a Manifest only needs Attributes to already exist, since that's what it maps to. You can build a Manifest and a Policy in either order. The Attributes → Countries → Claims → Policies → Manifests sequence on this site reflects the order that makes the governance decisions easiest to reason about, not a hard technical dependency between Policies and Manifests specifically.

Registering an Application

Before building a Manifest, the system or API it belongs to needs to be registered as an Application, Central Services → Data Management → Applications. This is largely bookkeeping (which systems exist, who owns them), but a Manifest needs an Application to belong to.

Video walkthrough

From an earlier product version, so field names or screens may have shifted slightly.

Click the "+" button at the top of the Applications page and fill in:

  • Name, URL, Description: identifying details for the application
  • Email, Email Alias: contact addresses
  • Status: toggle indicating whether the application is active

Click the pencil icon under "Actions" for any application to edit its details.

Building a Manifest

The exact steps differ slightly by product, since each has its own portal screen for it, but the shape is the same everywhere: give it a name, provide a sample of your actual data, then map the sensitive fields in that sample to Attributes, either by hand or using GatorAId to suggest classifications automatically.

For the click-through walkthrough in your product's portal, see the APIgator Manifest Walkthrough or the Bulk ETL Walkthrough.

Where this fits

See the eXate Object Hierarchy for how Manifests, Attributes, Policies, and PETs connect, or the Glossary for a plain-English definition of every object.

What's next

A Manifest tells eXate which fields to protect. The next step, Data Protection, covers how those fields get protected, masking, tokenisation, or encryption, and which technique makes sense for what you're building.