Skip to main content

Grant privileges to a role

PUT 
/metalakes/:metalake/permissions/roles/:role/:metadataObjectType/:metadataObjectFullName/grant

Grants privileges on a metadata object to a role and returns the updated role. The object must exist, and each privilege must be one that the object's type supports.

Sign in with a bearer token or a local user's password; see Authentication.

Request​

Path Parameters

    metalake stringrequired

    The name of the metalake

    role stringrequired

    The name of the role

    metadataObjectType stringrequired

    Possible values: [METALAKE, CATALOG, SCHEMA, FILESET, TABLE, VIEW, TOPIC, MODEL, TAG, POLICY, JOB_TEMPLATE, FUNCTION]

    The type of the metadata object. The list is the set of types that at least one privilege can be bound to; granting or revoking a privilege on any other type fails with IllegalPrivilegeException. The server matches the value case-insensitively.

    metadataObjectFullName stringrequired

    The full name of the metadata object

Body

    privileges

    object[]

    required

    The privileges need to grant

  • Array [

    • name stringrequired

    Possible values: [create_catalog, use_catalog, create_schema, use_schema, create_table, modify_table, select_table, create_fileset, write_fileset, read_fileset, create_topic, produce_topic, consume_topic, manage_users, manage_groups, create_role, manage_grants, register_model, create_model, link_model_version, create_model_version, use_model, create_tag, apply_tag, create_policy, apply_policy, register_job_template, use_job_template, run_job, create_view, select_view, register_function, execute_function, modify_function, use_secrets, include_credential_secrets]

    The name of the privilege, one of the values of Privilege.Name. Responses return the name in lowercase; requests accept any case. create_model and create_model_version are deprecated: the server still accepts them as aliases of register_model and link_model_version, and new requests should use the new names.

    condition stringrequired

    Possible values: [allow, deny]

    The condition of the privilege, allow or deny. Responses return the value in lowercase; requests accept any case.

  • ]

Responses​

The role, with its securable objects and privileges after the grant.

Schema

    code int32

    Possible values: [0]

    Status code of the response

    role

    object

    name stringrequired

    The name of the role

    properties

    object

    nullable

    A map of properties for the role

    property name* string

    securableObjects

    object[]

    A list of securable objects

  • Array [

    • fullName stringrequired

    The full name of the securable object

    type stringrequired

    Possible values: [metalake, catalog, schema, fileset, table, view, topic, model, tag, policy, job_template, function]

    The type of the securable object. Only types that at least one privilege can be bound to are accepted, and each privilege in privileges must support the type. Responses return the value in lowercase; requests accept any case.

    privileges

    object[]

    A list of privileges

  • Array [

    • name stringrequired

    Possible values: [create_catalog, use_catalog, create_schema, use_schema, create_table, modify_table, select_table, create_fileset, write_fileset, read_fileset, create_topic, produce_topic, consume_topic, manage_users, manage_groups, create_role, manage_grants, register_model, create_model, link_model_version, create_model_version, use_model, create_tag, apply_tag, create_policy, apply_policy, register_job_template, use_job_template, run_job, create_view, select_view, register_function, execute_function, modify_function, use_secrets, include_credential_secrets]

    The name of the privilege, one of the values of Privilege.Name. Responses return the name in lowercase; requests accept any case. create_model and create_model_version are deprecated: the server still accepts them as aliases of register_model and link_model_version, and new requests should use the new names.

    condition stringrequired

    Possible values: [allow, deny]

    The condition of the privilege, allow or deny. Responses return the value in lowercase; requests accept any case.

  • ]

  • ]

    • audit

    object

    Audit information for a Gravitino resource.

    creator string

    The user who created the resource

    createTime date-time

    The time the resource was created

    lastModifier string

    The user who last modified the resource

    lastModifiedTime date-time

    The time the resource was last modified

Loading...
Last updated on