Public and embedded dashboards

Dashboard publications expose one compiled dashboard as an anonymous, governed read surface. Each publication has a stable standalone URL and an iframe URL. Publishing does not create an API credential, inherit the deployer's permissions, or make arbitrary semantic queries available.

Declare a publication

Add a DashboardPublication resource to the workspace publication include path:

apiVersion: leapview.dev/v1
kind: DashboardPublication
metadata:
  workspace: visuals
  name: website-showcase
spec:
  dashboard: visual-showcase
  defaultPage: overview
  embedding:
    allowedOrigins:
      - https://leapview.dev

Origins are exact. Internet origins require HTTPS, and wildcards, credentials, paths, queries, and fragments are rejected. An empty list permits the standalone URL but denies framing.

Deploy the project to production to make the publication effective. The public ID remains stable across later deployments, removal, and re-addition. The publication follows the active production generation.

Govern anonymous data

Public execution uses a credential-less dashboard_publication principal scoped to the compiled dashboard execution manifest. Global data policies continue to apply. Add a publication-specific policy when two public presentations need different rows or masks:

apiVersion: leapview.dev/v1
kind: DataPolicy
metadata:
  workspace: visuals
  name: website-public-region
spec:
  object:
    type: semantic_model
    id: visuals
  subject:
    kind: dashboard_publication
    publication: website-showcase
  policyType: row_filter
  expression:
    field: orders.region
    operator: equals
    values: [public]

Publication subjects are supported only by data policies, not role bindings or grants. They cannot authenticate, hold tokens, use agents, export data, edit dashboards, or call the general BI API.

Operate publications

Users with MANAGE_PUBLICATIONS can use Admin → Publications or the dashboard-publication API to copy URLs, inspect origins and history, suspend, resume, or rotate a public ID. Owner, admin, and platform-admin roles receive this privilege by default.

• Suspension immediately makes documents and commands unavailable and terminates active streams.
• Resume succeeds only while the publication remains in the active production configuration.
• Rotation invalidates the prior URL and active streams immediately.
• Removing the YAML resource disables the publication while preserving its ID for a future re-addition.

Mutation API requests require an Idempotency-Key.

Verify the publication

Open the standalone URL in a private browser session and confirm the dashboard loads, page navigation works, and no application or agent controls appear. Embed the iframe from an allowed origin and exercise filters, selections, and table windows. A parent origin not listed in allowedOrigins must be rejected by browser CSP.

Suspend the publication from Admin → Publications and confirm the document becomes unavailable and any active stream closes. Resume it before sharing the URL. Use rotation only when the old URL must stop working immediately.

Embed safely

Use the generated iframe snippet. Keep sandbox="allow-scripts allow-same-origin" and referrerpolicy="no-referrer". The iframe document has no authenticated application chrome or cookies, and browser CSP verifies that the parent origin is explicitly allowed.

Public IDs reduce accidental discovery but are not secrets. Apply data policies as though anyone with the URL can view the publication, monitor public query and rate-limit telemetry, and rotate the URL if it is distributed unintentionally.