Getting Started

This tutorial gets you from a DataSHIELD server to an audit report in four steps: connect, check permissions, audit and report.

It uses OBiBa’s public Opal demo server (https://opal-demo.obiba.org), so you need an internet connection. To try a local server instead, see vignette("deploy-local-datashield-server-with-opal", package = "dsROCrate").

library(dsROCrate)

Where to go next

1. Connect to the server

USERNAME <- "administrator"
USERPASS <- "password"

con <- opalr::opal.login(
  username = USERNAME,
  password = USERPASS,
  url = SERVER
)

print(con)
#> url: https://opal-demo.obiba.org 
#> name: opal-demo.obiba.org 
#> version: 6.0.2 
#> username: administrator

Note: auditing reads server-wide information (users, permissions, DataSHIELD settings and logs), so it needs an administrator or a user with the Audit system permission. The demo server only provides the administrator account, so we use it here. For real servers, create a dedicated auditor account, see vignette("audit-permissions", package = "dsROCrate").

2. Check permissions

check_permissions(con, verbose = TRUE)
#> You are ready to audit this system!

If the account is not suitable, the function stops with instructions on how to fix it.

3. Audit a project

audit() collects all the Five Safes (people, project, data, setting and output) for a project in a single call. Here we audit the CNSIM project, for the user dsuser and the table CNSIM1:

PROJECT <- "CNSIM"
TABLES <- "CNSIM1"
USER <- "dsuser"

crate <- audit(con, project = PROJECT, tables = TABLES, user = USER)
#>  Found 195 records... Imported 195 records. Simplifying...

print(crate)
#> {
#>   "@context": "https://w3id.org/ro/crate/1.2/context",
#>   "@graph": [
#>     {
#>       "@id": "ro-crate-metadata.json",
#>       "@type": "CreativeWork",
#>       "about": {
#>         "@id": "./"
#>       },
#>       "conformsTo": {
#>         "@id": "https://w3id.org/ro/crate/1.2"
#>       }
#>     },
#>     {
#>       "@id": "./",
#>       "@type": "Dataset",
#>       "name": "",
#>       "description": "",
#>       "datePublished": "2026-10-15",
#>       "license": {
#>         "@id": "http://spdx.org/licenses/CC-BY-4.0"
#>       },
#>       "conformsTo": {
#>         "@id": "https://w3id.org/5s-crate/0.4"
#>       },
#>       "hasPart": [
#>         {
#>           "@id": "20261015T061405-dslogs-dsuser.log"
#>         },
#>         {
#>           "@id": "20261015T061405-dslogs-dsuser_mappings.csv"
#>         }
#>       ]
#>     },
#>     {
#>       "@id": "https://w3id.org/5s-crate/0.4",
#>       "@type": ["CreativeWork", "Profile"],
#>       "name": "Five Safes RO-Crate profile"
#>     },
#>     {
#>       "@id": "#person:a0af2a94926db1b49ad7a812eef509d2",
#>       "@type": "Person",
#>       "name": "dsuser"
#>     },
#>     {
#>       "@id": "#project:7ba189863f9f641196596cb28e04aa14",
#>       "@type": "Project",
#>       "name": "CNSIM",
#>       "dateCreated": "2026-10-15T04:36:56.200Z",
#>       "dateModified": "2026-10-15T04:37:01.258Z",
#>       "hasPart": [
#>         {
#>           "@id": "#asset:fad6faf661584d53e58f9730b14c5aae"
#>         }
#>       ]
#>     },
#>     {
#>       "@id": "#perm:9bf7f75b6c5b07d02830b95652cd39a0-dict-summary-read",
#>       "@type": "ReadAction",
#>       "agent": {
#>         "@id": "#person:a0af2a94926db1b49ad7a812eef509d2"
#>       },
#>       "object": {
#>         "@id": "#asset:fad6faf661584d53e58f9730b14c5aae"
#>       },
#>       "actionStatus": "PotentialActionStatus",
#>       "description": "User may view table dictionary and summary statistics only; access to individual values is restricted."
#>     },
#>     {
#>       "@id": "#asset:fad6faf661584d53e58f9730b14c5aae",
#>       "@type": "Dataset",
#>       "name": "CNSIM1",
#>       "description": "",
#>       "url": "/datasource/CNSIM/table/CNSIM1",
#>       "dateCreated": "2026-10-15T04:00:00Z",
#>       "dateModified": "2026-10-15T04:00:00Z",
#>       "isPartOf": {
#>         "@id": "#project:7ba189863f9f641196596cb28e04aa14"
#>       }
#>     },
#>     {
#>       "@id": "#disc:27d8c1d2233ecb654a24b635fd4dbd78",
#>       "@type": "PropertyValue",
#>       "name": "datashield.privacyLevel",
#>       "value": "5"
#>     },
#>     {
#>       "@id": "#disc:46b65707a6b998f3b1364bc10e6d9b4b",
#>       "@type": "PropertyValue",
#>       "name": "default.datashield.privacyControlLevel",
#>       "value": "banana"
#>     },
#>     {
#>       "@id": "#disc:7769282e7b0a1cb8887f60886c7b56ae",
#>       "@type": "PropertyValue",
#>       "name": "default.nfilter.glm",
#>       "value": "0.33"
#>     },
#>   ❗ <file truncated, set `options(max_lines = Inf)` to display all>
#>   ]
#> }

Useful arguments:

4. Create a report

report() summarises the crate. First, we generate only the contents of the report and display the overview:

report_file <- tempfile(fileext = ".Rmd")

report_parts <- crate |>
  report(filepath = report_file, render = FALSE)
#> 1 'Author' entity was found!
#> 1 asset entity was found!
#> 1 'Project' entity was found!
#> 22 'CreativeWork', 'PropertyValue' OR 'SoftwareApplication' entities were found!
#> 2 'File' entities were found!

# overview diagram
report_parts$overview_diagram

# overview table (Safe People, Safe Project and Safe Data)
knitr::kable(report_parts$overview_data)
Project Data Access Level People Function Timestamp
CNSIM CNSIM1 read dsuser 2026-10-15T08:51:51Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T08:51:52Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T08:51:54Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T08:51:54Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T08:51:54Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T08:51:55Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T08:51:55Z
CNSIM CNSIM1 read dsuser 2026-10-15T08:53:43Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T08:53:43Z
CNSIM CNSIM1 read dsuser 2026-10-15T08:56:16Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T08:56:16Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T08:56:18Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T08:56:18Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T08:56:18Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T08:56:18Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T08:56:18Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:32:39Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:32:40Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T09:32:41Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T09:32:41Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T09:32:41Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T09:32:42Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T09:32:42Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:34:37Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:34:38Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:36:43Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:36:44Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T09:36:45Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T09:36:45Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T09:36:45Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T09:36:45Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T09:36:46Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:39:33Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:39:34Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T09:39:35Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T09:39:35Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T09:39:35Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T09:39:36Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T09:39:36Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:43:10Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:43:11Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T09:43:12Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T09:43:13Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T09:43:13Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T09:43:13Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T09:43:13Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:45:36Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:45:36Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:47:38Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:47:38Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T09:47:39Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T09:47:39Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T09:47:39Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T09:47:40Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T09:47:40Z
CNSIM CNSIM1 read dsuser 2026-10-15T09:49:05Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T09:49:05Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T09:49:07Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T09:49:07Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T09:49:07Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T09:49:07Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T09:49:07Z
CNSIM CNSIM1 read dsuser 2026-10-15T10:13:54Z
CNSIM CNSIM1 read dsuser DSI::datashield.assign.table 2026-10-15T10:13:55Z
CNSIM CNSIM1 read dsuser base::exists 2026-10-15T10:13:56Z
CNSIM CNSIM1 read dsuser dsBase::classDS 2026-10-15T10:13:56Z
CNSIM CNSIM1 read dsuser dsBase::isValidDS 2026-10-15T10:13:56Z
CNSIM CNSIM1 read dsuser dsBase::dimDS 2026-10-15T10:13:57Z
CNSIM CNSIM1 read dsuser dsBase::colnamesDS 2026-10-15T10:13:57Z

To render the full report as an HTML document, run:

crate |>
  report(
    filepath = report_file,
    title = "DataSHIELD Five Safes report",
    render = TRUE,
    overwrite = TRUE
  )

5. Close the connection

opalr::opal.logout(con)