Restricting a file in an older published dataset version

[Tutasi]

Hello,

I need to restrict access to a file that belongs to an older published version of a dataset.

The file in the version 1.0 was later replaced in a newer version 2.0, so the old file has a different File ID from the current one. After that, the new file was restricted in a version 2.1, but we realised the file in version 1.0 was still open.

We tried restricting the old file in version 1.0 through the Native API:

curl -H "X-Dataverse-key:$API_TOKEN" \ -X PUT \ -d true \ "$SERVER_URL/api/files/$ID/restrict"

The API returns "status":"OK" and confirms that the file was restricted. However, the file in the older published version still appears to be publicly downloadable.

Is it possible to restrict files that have been replaced or deleted in older versions of a dataset.

Thanks in advanced.

[Julian Gautier]

Hi Tutasi,

This is really interesting! Following your steps, I created the dataset at https://demo.dataverse.org/file.xhtml?persistentId=doi:10.70122/FK2/W3CA7L/MY17NB in Demo Dataverse. Version 1 has an unrestricted file that was replaced in version 2. Then I restricted that second  file in version 2 and published version 2.1.

I didn't try using the API to restrict the file in version 1 like you did. Instead when I used my browser to try to restrict the file in version 1 of the dataset, or tried to make any edits to that file, I got a warning message that "This file has already been deleted (or replaced) in the current version. It may not be edited."

It's not possible to restrict files in older versions of a dataset that have been replaced or deleted subsequent versions of the dataset. I think this is by design, although I don't think I was around when this decision was made and I couldn't find any discussion about this decision specifically after a quick look through GitHub issues.

It sounds like the API should not return an OK status when we try to use the API to restrict a file in one dataset version that has been replaced or deleted from subsequent dataset versions. The API call should return something like what Dataverse tells the user when they try using their browser, right?

Could you share here the version of Dataverse you're using?

Also, did you try using the UI first, then you tried the API?

All best,

Julian

Julian Gautier (he/him)

Product Research Specialist, IQSS

Interested in helping test Dataverse? Sign up for user experience research

[Tutasi]

Hi, 

Thanks for checking this and for reproducing the case in Demo Dataverse. We are currently running Dataverse 6.10.1. In our case, I did not try to restrict the file through the UI first. I went directly to the Native API using the old File ID. The API returned:

status":"OK","data":{"message":"FILENAME.tab restricted."}}
curl: (56) Failure when receiving data from the peer.

Even though the file was restricted in version 2.1, we noticed that file in version 2.0 is also restricted but it does not appear with the icon of restriction.

If restricting an old file that has already been replaced is not supported, I would also expect the API to return an error or warning instead of OK. 

Thanks again for looking into this.

El dia dilluns, 14 de setembre del 2026 a les 21:57:38 UTC+2, Julian Gautier va escriure:

[Philip Durbin]

Hi Tutasi,

Yes, it does sound like the API should return an error or warning in that case. If you are willing to create an issue about this at https://github.com/IQSS/dataverse/issues I'd appreciate it!

Thanks,

Phil

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/dataverse-community/1986a299-8199-4629-a828-42a76355853en%40googlegroups.com.

--

Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin

[Dieuwertje Bloemen]

Hi Tutasi,

From a non-technical perspective, what we do in this situation at KU Leuven is deaccession the previous version. That's the only way as far as I know to make something openly published no longer accessible.

Kind regards,

Dieuwertje

[Julian Gautier]

Hi all,

Tutasi, I saw that you wrote:
"Even though the file was restricted in version 2.1, we noticed that file in version 2.0 is also restricted but it does not appear with the icon of restriction."

I think this point of confusion is described in the GitHub issue at https://github.com/IQSS/dataverse/issues/11628. When I've been in conversations about how this currently works, and someone pitches the idea of changing the access icon on previous versions of the file to indicate that that file is currently restricted, someone in the conversation has always mentioned that it would also be helpful if there was a way for the dataset owner or curator to also know that the file used to be unrestricted in earlier versions of the dataset. I think this is why we haven't told Dataverse to update that file access icon across all dataset versions, because of thinking that dataset owners and curators would see the access icon on files in previous dataset versions and know if the file was public or restricted when the dataset version was published. I'll add this to that GitHub issue so folks consider that aspect of the design.

I'm also wondering what you plan to do since you can't currently restrict that file in version 1 of your dataset. Would deaccessioning work like Dieuwertje wrote?