Virtuoso SPARQL Document Generation & Cloud Storage Access Control

Dynamically generating documents from SPARQL queries and mediating fine-grained access to third-party cloud storage through ODS-Briefcase with WebID-based ACLs.

By Kingsley Uyi Idehen & Ted Thibodeau Jr · OpenLink Virtuoso Weblog

Virtuoso · SPARQL · ODS-Briefcase · WebID · ACL
About

About This Knowledge Graph

At its core, Virtuoso offers a universal filesystem interface as one of its various options for open standards-based I/O operations. A SPARQL query result saved to a DET folder becomes a file you can create, share via WebDAV, open in Excel or Tableau, and delete — while the underlying RDF data stays live and in sync. A Google Drive folder mounted through ODS-Briefcase becomes the same: a file hierarchy you share, protect with WebID ACLs, and access from any WebDAV client — without the underlying storage service knowing or caring that it's part of a knowledge graph pipeline.

This mesh-up of two articles by Ted Thibodeau Jr and Kingsley Uyi Idehen demonstrates how Virtuoso's DET (Dynamic Extended Type) mechanism and ODS-Briefcase together form a knowledge graph management layer built on the familiar create → share → delete file pattern. SPARQL-driven documents stay synchronized with their source data; cloud storage folders become graph-aware mount points; and WebID-based ACLs enforce decentralized access control across both — all through standards-based HTTP and WebDAV interfaces that any desktop tool or browser can consume.

7+
SPARQL Result Formats
HTML, CSV, JSON, XML, Turtle, JSON-LD, RDF/XML
5
Cloud Services Supported
Google Drive, Dropbox, OneDrive, Box, Amazon S3
10
FAQ Questions
Covering SPARQL, ODS-Briefcase, WebID, ACLs, and Sponger
12
Glossary Terms
SPARQL, WebID, WebDAV, DET, Named Graph, and more
SPARQL Queries

Dynamically Generating Documents

Virtuoso SPARQL queries produce dynamic documents in multiple formats for follow-your-nose exploration of data access drivers and product portfolios.

DESCRIBE/CONSTRUCT Result Types

SPARQL DESCRIBE and CONSTRUCT queries produce RDF statement graphs in RDF-Turtle, N-Triples, JSON-LD, and RDF/XML formats.

RDF Output

SELECT Result Types

SELECT queries return tabular solutions in HTML, HTML with Faceted Browsing Links, CSV, SPARQL Results JSON, SPARQL Results XML, and Excel formats.

Tabular Output

HTTP Content Negotiation

Virtuoso SPARQL endpoints support HTTP content negotiation for result format selection via Accept headers, though browser support beyond text/html is limited.

HTTP Protocol

Structured Data Islands

HTML documents can embed SPARQL DESCRIBE results as structured data islands using script tags in JSON-LD, HTML5 Microdata, RDFa, or HTML+Turtle formats.

Embedded RDF
Access Control

Cloud Storage via ODS-Briefcase

ODS-Briefcase mounts third-party cloud storage as WebDAV DET folders with WebID-based ACLs, enabling fine-grained access control independent of provider permissions.

Google Drive

15GB default free storage. API limit: 500,000 requests/day. Mountable as a WebDAV DET folder through ODS-Briefcase with WebID ACLs.

15GB Free

Dropbox

2GB default free storage. Default app limit: 5 users. Full Dropbox access with Sponger integration for RDF extraction.

2GB Free

Microsoft OneDrive

5GB default free storage. Formerly SkyDrive. Configurable through Microsoft Graph API with WebID-based access control.

5GB Free

WebID Authentication

Decentralized identity verification using WebIDs from LinkedIn, Twitter, Facebook, WordPress, Yahoo, Mozilla Persona, and other providers via Virtuoso VAL.

Decentralized ID

ACL Configuration

WebID-based ACLs grant READ or WRITE access at folder, sub-folder, or individual document level. Applied via ODS UI or RESTful ACL API using Turtle.

Fine-Grained

Virtuoso Sponger

RDF transformation middleware with Extractor and Meta Cartridges. Processes files in Briefcase folders and saves extracted RDF to named graphs.

RDF Extraction
Standards

Technologies & Standards

Key technologies and standards referenced across both articles.

SPARQL

W3C standard query language for RDF, supporting SELECT, DESCRIBE, CONSTRUCT, and ASK query types.

W3C Standard

WebDAV

Web Distributed Authoring and Versioning — HTTP extension for collaborative file management.

RFC 4918

WebID

Decentralized identification protocol using HTTP URIs and RDF profiles for authentication.

W3C Incubator

OpenLink Virtuoso

Multi-model data management platform combining SQL RDBMS, RDF quad store, SPARQL endpoint, and WebDAV server.

Platform
FAQ

Frequently Asked Questions

Key questions about SPARQL document generation and cloud storage access control.

SPARQL DESCRIBE and CONSTRUCT queries in Virtuoso can produce results in RDF-Turtle (text/turtle), RDF N-Triples (application/n-triples), JSON-LD (application/ld+json), and RDF/XML (application/rdf+xml) formats.

SELECT queries return results as HTML (text/html), HTML with Faceted Browsing Links (text/x-html+tr), CSV (text/csv), SPARQL Results JSON (application/sparql-results+json), SPARQL Results XML (application/sparql-results+xml), Microsoft Excel (application/vnd.ms-excel), and JavaScript (application/javascript) formats.

ODS-Briefcase (formerly ODrive) is a personal data space manager within the OpenLink Data Spaces framework. It provides WebDAV-based mount points for both local Virtuoso DAV storage and third-party cloud storage services like Google Drive, Dropbox, OneDrive, Box, and Amazon S3.

ODS-Briefcase uses WebID-based ACLs (Access Control Lists) to grant READ or WRITE access to specific individuals or groups. ACLs can be applied at the folder level, sub-folder level, or individual document level, independent of the cloud provider's native permissions model.

A WebID is an HTTP URI that identifies a person or agent, with an associated RDF profile document describing their attributes. Virtuoso VAL supports WebIDs from LinkedIn, Twitter, Facebook, WordPress, Yahoo, Mozilla Persona, and other identity providers for decentralized authentication.

A DET is a Virtuoso mechanism that generates dynamic hypermedia resources from queries, exposed as files in WebDAV folders. It functions like a materialized view — the content is generated at request time rather than stored statically. Cloud storage mounts in ODS-Briefcase are implemented as DETs.

The Virtuoso Sponger is RDF transformation middleware that extracts structured data from various document formats (Office documents, spreadsheets, presentations, etc.) using Extractor Cartridges and Meta Cartridges. When enabled on an ODS-Briefcase folder, it processes files and saves extracted RDF to a named graph.

The default named graph is constructed from the host ODS instance, the ODS username, and the Briefcase folder name: http://<host>[:<port>]/DAV/home/<user-name>/<folder-name>#this. Expert users may customize this graph name.

ACL scopes group rules by resource type. Common scopes include 'DAV Resources' for WebDAV-stored files and folders, 'Private Graphs' for named graphs in the quad store, and 'Query' for SPARQL query access. Scopes enable or disable ACL enforcement for specific resource categories.

Virtuoso SPARQL endpoints support HTTP content negotiation for result format selection. Clients can request specific MIME types via Accept headers. However, browser support beyond plain/text and text/html is limited, so the web UI provides a format dropdown for manual selection.

Glossary

Defined Terms

Key terms from both articles.

SPARQL
SPARQL Protocol and RDF Query Language — the W3C standard query language for RDF data, supporting SELECT, DESCRIBE, CONSTRUCT, and ASK query forms. See also: DBpedia · Wikidata
DESCRIBE Query
A SPARQL query form that returns an RDF description of a resource, including all known triples about the resource and related entities.
CONSTRUCT Query
A SPARQL query form that builds a new RDF graph by instantiating a template with variable bindings from the query solution.
SELECT Query
A SPARQL query form that returns a table of variable bindings (a query solution set) matching the query pattern.
WebID
A decentralized identification protocol using HTTP URIs and RDF profile documents for authentication, controlled by users rather than service providers. See also: DBpedia · Wikidata
ACL (Access Control List)
A list of permissions attached to a resource specifying which authenticated agents or agent classes can access the resource and what operations they can perform. See also: DBpedia · Wikidata
DET (Dynamic Extension Type)
A Virtuoso feature that generates dynamic hypermedia resources from queries, exposed as files in WebDAV folders — analogous to materialized views.
WebDAV
Web Distributed Authoring and Versioning — an extension of HTTP that allows clients to perform operations on remote web servers, enabling collaborative file management. See also: DBpedia · Wikidata
Virtuoso Sponger
RDF transformation middleware that extracts structured data from documents using Extractor and Meta Cartridges, converting various formats to RDF.
ODS (OpenLink Data Spaces)
A personal data space framework providing identity management, storage, and application hosting built on top of Virtuoso.
HTTP Content Negotiation
An HTTP mechanism that allows a client to specify preferred media types, languages, or encodings, and the server to select the most appropriate representation. See also: DBpedia · Wikidata
Named Graph
An RDF graph identified by a URI, enabling grouping and access control of triples within a quad store (subject, predicate, object, graph). See also: DBpedia · Wikidata
How-To

Set Up Cloud Storage Access Control with ODS-Briefcase

Step-by-step guide to mounting cloud storage and configuring WebID-based ACLs.

Get API Credentials from Your Cloud Provider

Register an application with your cloud storage provider (Google Drive, Dropbox, OneDrive, Box) through their developer console. Obtain the Client ID/API Key and Client Secret pair.

Configure ODS Login Authentication Keys

Log into your Virtuoso+ODS instance as an administrator. Navigate to Site Settings > Login Authentication Keys. Select the appropriate API, enter the credentials, and click Add.

Create a New Briefcase Folder

In ODS-Briefcase, click New Folder. Specify a folder name and set the folder type to match your cloud service (Google Drive, Dropbox, OneDrive, Box, or S3).

Configure Sponger Cartridges (Optional)

Enable the Virtuoso Sponger for your folder. Select which Extractor and Meta Cartridges to run against your files. Enable only applicable cartridges to minimize processing overhead.

Authenticate with Your Cloud Provider

Click Authenticate. You will be prompted to enter your cloud provider credentials and authorize the ODS application to access your storage.

Set Up WebID-Based ACLs

Apply ACL rules to your Briefcase folder, sub-folders, or individual documents. Grant READ or WRITE access to specific WebIDs (e.g., LinkedIn profiles) or agent classes.

Test Access Through DET Mount Points

Access your cloud storage through the ODS-Briefcase WebDAV mount point. Visitors with valid WebIDs matching your ACL rules will be granted access.

Knowledge Graph

KG Explorer

RDF Graph Workbench

0 nodes / 0 links
Classes
Properties
Instances

Explore Knowledge Graph using SPARQL

Choose a named graph and query recipe, edit the SPARQL if needed, then open the encoded URIBurner query.

Run live query

SELECT uses text/x-html+tr. DESCRIBE and CONSTRUCT use text/x-html-nice-turtle, matching the SPARQL format guidance in the skill contract.