generated: '2026-09-02'
method: derived
source: https://github.com/verily-src/terraform-provider-workbench/tree/main/docs — resource and data-source schemas generated by tfplugindocs from Verily's own provider, which wraps the Workbench /api/wsm and /api/user OpenAPI clients
name: Verily Workbench — entity relationship model
summary: >-
  Derived entity graph for the Verily Workbench control plane. It is NOT derived from an OpenAPI, because
  Verily serves none publicly. It is derived from the next-best first-party artifact: the schemas and
  import-ID path forms published in Verily's own Terraform provider, whose clients are code-generated from
  the internal OpenAPI. Every field name and every path form below is quoted from that published
  documentation. Cardinalities marked `inferred` are read from the required foreign-key fields and the
  import path shapes, not stated in prose by Verily.
identifier_conventions:
  primary: UUID (`id` on every entity)
  secondary: >-
    `user_facing_id` (UFID) — a human-readable slug carried by organizations, workspaces and data
    collections. In group IAM, an organization UFID must be prefixed with a tilde (~) to distinguish it
    from a UUID.
  path_forms:
  - workspaces/{workspace_uuid}/resources/{folder_id}
  - workspaces/{workspace_uuid}/controlled_gcs_buckets/{bucket_uuid}
  - workspaces/{workspace_uuid}/roles/{role_name}
  - organizations/{organization_id}/groups/{group_name}
  - organizations/{organization_id}/groups/{group_name}/roles
audit_fields:
  present_on: [workspace, folder, data_collection, data_collection_version, controlled_gcs_bucket, group]
  fields: [created_by, created_date, last_updated_by, last_updated_date]
  note: A consistent audit quartet on every managed entity — a real strength of this model.
entities:
- name: organization
  description: The tenant. Owns pods, workspaces, data collections and groups.
  keys: [id, user_facing_id]
- name: pod
  description: >-
    The billing container. Links a Google Cloud or AWS billing account to the workspaces and data
    collections created under it. An invalid or disconnected pod disables a workspace (see errors/).
  keys: [id]
- name: workspace
  description: The unit of analysis. Backed by a GCP project or an AWS account.
  required: [organization_id, pod_id, user_facing_id]
  optional: [display_name, description, location, policies, properties]
  read_only: [id, gcp_project_id, aws_account_id, created_by, created_date, last_updated_by, last_updated_date]
- name: folder
  description: Hierarchical grouping of resources inside a workspace; nests within itself.
  required: [display_name, workspace_id]
  optional: [description, parent_folder_id, properties]
- name: resource
  description: >-
    A cloud resource in a workspace, either `controlled` (created and managed by Workbench) or
    `referenced` (a pointer to something outside the workspace) — the `stewardship_type` field.
    Types seen across the provider and the CLI: gcs-bucket, gcs-object, bq-dataset, bq-table, git-repo,
    dataproc-cluster, aurora-database, s3-external-bucket, s3-storage-folder, ecr-external-repository,
    gcp-notebook, ec2.
  fields_of_note: [resource_type, stewardship_type, resource_lineage, clone_instruction, storage_class, location, folder_id]
  clone_instructions: [COPY_RESOURCE, COPY_DEFINITION, COPY_LINK_REFERENCE, COPY_NOTHING, COPY_REFERENCE]
- name: data_collection
  description: >-
    A publishable dataset with a maintainer, governed by policies and discoverable through Data Exchange.
  required: [organization_id, organization_name, pod_id, support_email, user_facing_id]
  optional: [display_name, description, location, policies, properties, therapeutic_tags, update_frequency]
- name: data_collection_version
  description: >-
    An immutable version of a data collection. Version binding (2026-04-23) prevents mixing resources
    across versions; Data Explorer underlays became multi-version on 2026-05-15.
  required: [workspace_id, display_name]
- name: group
  description: >-
    A Workbench-managed group, backed by an email address, with optional membership expiry and a
    require-grant-reason control.
  required: [group_name, organization_user_facing_id]
  optional: [organization_id, description, expiration_days, expiration_notification, require_grant_reason, sync_group]
  read_only: [group_email, internal_name]
- name: iam_binding
  description: >-
    Role grants on a workspace or a group. Group roles are enumerated in the provider docs as ADMIN,
    OWNER, READER, SUPPORT. Principals are users (by email), groups, or `public`.
  variants: [workspace_iam_binding, workspace_iam_member, workspace_iam_policy, group_iam_binding, group_iam_member, group_iam_policy]
- name: policy
  description: >-
    A governance constraint attached to a workspace or data collection, namespaced (`terra`) with a name
    and key/value additional_data. Documented policy families: region, network, perimeter, app, group and
    required-form.
  fields:
  - namespace
  - name
  - 'additional_data[].key'
  - 'additional_data[].value'
- name: user
  description: An organization member, addressed by email. Invited, enabled, disabled, revoked or archived.
- name: app
  description: A cloud application instance in a workspace (JupyterLab, RStudio, SAS Viya, custom).
- name: workflow_job
  description: A Cromwell/WDL, Nextflow or AWS HealthOmics run submitted against a workspace.
relationships:
- from: organization
  to: pod
  type: has_many
  via: organization_id
  confidence: inferred
- from: organization
  to: group
  type: has_many
  via: organization_user_facing_id / organization_id
  confidence: high
- from: organization
  to: workspace
  type: has_many
  via: organization_id
  confidence: high
- from: organization
  to: data_collection
  type: has_many
  via: organization_id
  confidence: high
- from: pod
  to: workspace
  type: has_many
  via: pod_id
  confidence: high
- from: pod
  to: data_collection
  type: has_many
  via: pod_id
  confidence: high
- from: workspace
  to: folder
  type: has_many
  via: workspace_id
  confidence: high
- from: folder
  to: folder
  type: has_many
  via: parent_folder_id
  confidence: high
- from: workspace
  to: resource
  type: has_many
  via: workspace_id
  confidence: high
- from: folder
  to: resource
  type: has_many
  via: folder_id
  confidence: high
- from: data_collection
  to: data_collection_version
  type: has_many
  via: workspace_id (the data collection id is passed as workspace_id in the provider example)
  confidence: high
- from: workspace
  to: iam_binding
  type: has_many
  via: workspace_id
  confidence: high
- from: group
  to: iam_binding
  type: has_many
  via: group
  confidence: high
- from: workspace
  to: policy
  type: has_many
  via: policies[]
  confidence: high
- from: data_collection
  to: policy
  type: has_many
  via: policies[]
  confidence: high
- from: workspace
  to: gcp_project / aws_account
  type: has_one
  via: gcp_project_id / aws_account_id
  confidence: high
- from: resource
  to: resource
  type: has_many
  via: resource_lineage[]
  confidence: medium
  note: Lineage records where a cloned resource came from.
gaps:
- No public OpenAPI, so operationIds, request/response shapes and enums beyond those quoted here are unknown.
- The apps, workflow jobs, users and data-explorer entities have no Terraform coverage; they are described from the CLI surface only.