# Workflow API Privacy Rules

<details>

<summary>Help us improve this article</summary>

This article is part of a significant update to the Bubble manual and your feedback is critical to our efforts to continuously enhance our written documentation.\
\
We would greatly appreciate if you could take a moment to let us know your thoughts on the quality of it. Thank you for your support!\
\
[Give feedback on this article](https://docs.google.com/forms/d/e/1FAIpQLSfe7eaYVxkqTa_nn3QE6VObCxWB1hgh6sHUQGQ0Eit8JlAS7g/viewform?usp=pp_url\&entry.619913899=https://manual.bubble.io/help-guides/apis-connect-to-other-apps/the-bubble-api/the-workflow-api/workflow-api-privacy-rules\&entry.80834677=Workflow+API+Privacy+Rules)

</details>

Whenever you run any kind of workflow in your app, they will respect the privacy rules of any data type referenced in that workflow. The same applies to API workflows - the authentication of the client sending the request determines what kind of data they have access to.

<figure><img src="https://34394582-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M5sbzwG7CljeZdkntrL%2Fuploads%2FcP4RL7KdI73EqLT3Puau%2Fprivacy-rules-illustration-b.jpeg?alt=media&#x26;token=7a296176-f2df-4fd3-8fc4-5dc1d98f20f7" alt=""><figcaption><p>Privacy Rules serve as a secure filter to stop unauthorized access to your app's database.</p></figcaption></figure>

It’s important to note that privacy rules apply to what data they can see, but it doesn’t affect the actions in your workflow. For example, a workflow may be affected by the *Find this in searches* privacy setting: in this scenario, an authenticated client would only be able to search for things that a privacy rule grants them access to.

> Privacy Rules affect your ***database**.* They can stop an API Workflow from accessing specific *data* based on who the client[^1] is, but it will **not** stop the API Workflow from running altogether.

Let’s say that you have a [*Make changes to a thing*](#user-content-fn-2)[^2] action inside of that workflow. The action would complete regardless of Privacy Rules, but if you are searching for a thing to make changes to, Privacy Rules may stop you from *finding* the thing you want to change.

In other words, the action would technically complete, but if you don’t find the record you want to make changes to it won’t make any difference.

> The new Privacy Rule settings that are introduced when you activate the Data API in your app’s settings (Create via API, Modify via API and Delete via API) do **not** affect your API workflows.

In essence, by running an API workflow you have the freedom to change anything you want in the database, but the access to database records is still protected by privacy rules.

## Overriding Privacy Rules

In any API workflow you can override Privacy Rules by checking the *Ignore privacy rules* when running the workflow box. This is useful in cases where you need to execute a workflow that needs to have access to data that the Current User does not have have access to because of Privacy Rules.

<figure><img src="https://34394582-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M5sbzwG7CljeZdkntrL%2Fuploads%2FYw6wbvJPbHtfnuB4yNnK%2Fignore-privacy-rules-api-workflow%402x.png?alt=media&#x26;token=d1b37adf-c759-4195-af82-f443a65d8914" alt=""><figcaption><p>Checking <em>Ignore Privacy Rules</em> lets you override the rules that affect the User that initiated the workflow in all the actions associated with this workflow.</p></figcaption></figure>

\\

[^1]: The *client* is the one to initiate an API request, as opposed to the *server* who is the one to receive it and respond.\
    \
    In the context of Privacy Rules, the identity of the client is determined by how that client has authenticated the call.\
    \
    Article: [Authentication](https://manual.bubble.io/~/revisions/MbM8yVwmuAbVH022ZLKz/help-guides/integrations/api/the-bubble-api/the-workflow-api/broken-reference)

[^2]: The *Make changes to a thing* action is an action in Bubble that saves changes to one or more fields in a specific database record in your app.
