Skip to main content

Override role privileges

PUT 
/metalakes/:metalake/permissions/roles/:role

Replaces all securable objects and privileges of a role with the given list and returns the updated role. Securable objects of the role that are not in the list are removed from it.

Sign in with a bearer token or a local user's password; see Authentication.

Request​

Path Parameters

    metalake stringrequired

    The name of the metalake

    role stringrequired

    The name of the role

Body

    overrides

    object[]

    A list of securable objects to update

  • Array [

    • fullName stringrequired

    The full name of the securable object

    type stringrequired

    Possible values: [metalake, catalog, schema, fileset, table, view, topic, model, tag, policy, job_template, function]

    The type of the securable object. Only types that at least one privilege can be bound to are accepted, and each privilege in privileges must support the type. Responses return the value in lowercase; requests accept any case.

    privileges

    object[]

    A list of privileges

  • Array [

    • name stringrequired

    Possible values: [create_catalog, use_catalog, create_schema, use_schema, create_table, modify_table, select_table, create_fileset, write_fileset, read_fileset, create_topic, produce_topic, consume_topic, manage_users, manage_groups, create_role, manage_grants, register_model, create_model, link_model_version, create_model_version, use_model, create_tag, apply_tag, create_policy, apply_policy, register_job_template, use_job_template, run_job, create_view, select_view, register_function, execute_function, modify_function, use_secrets, include_credential_secrets]

    The name of the privilege, one of the values of Privilege.Name. Responses return the name in lowercase; requests accept any case. create_model and create_model_version are deprecated: the server still accepts them as aliases of register_model and link_model_version, and new requests should use the new names.

    condition stringrequired

    Possible values: [allow, deny]

    The condition of the privilege, allow or deny. Responses return the value in lowercase; requests accept any case.

  • ]

  • ]

Responses​

The role, with its securable objects and privileges replaced by the given list.

Schema

    code int32

    Possible values: [0]

    Status code of the response

    role

    object

    name stringrequired

    The name of the role

    properties

    object

    nullable

    A map of properties for the role

    property name* string

    securableObjects

    object[]

    A list of securable objects

  • Array [

    • fullName stringrequired

    The full name of the securable object

    type stringrequired

    Possible values: [metalake, catalog, schema, fileset, table, view, topic, model, tag, policy, job_template, function]

    The type of the securable object. Only types that at least one privilege can be bound to are accepted, and each privilege in privileges must support the type. Responses return the value in lowercase; requests accept any case.

    privileges

    object[]

    A list of privileges

  • Array [

    • name stringrequired

    Possible values: [create_catalog, use_catalog, create_schema, use_schema, create_table, modify_table, select_table, create_fileset, write_fileset, read_fileset, create_topic, produce_topic, consume_topic, manage_users, manage_groups, create_role, manage_grants, register_model, create_model, link_model_version, create_model_version, use_model, create_tag, apply_tag, create_policy, apply_policy, register_job_template, use_job_template, run_job, create_view, select_view, register_function, execute_function, modify_function, use_secrets, include_credential_secrets]

    The name of the privilege, one of the values of Privilege.Name. Responses return the name in lowercase; requests accept any case. create_model and create_model_version are deprecated: the server still accepts them as aliases of register_model and link_model_version, and new requests should use the new names.

    condition stringrequired

    Possible values: [allow, deny]

    The condition of the privilege, allow or deny. Responses return the value in lowercase; requests accept any case.

  • ]

  • ]

    • audit

    object

    Audit information for a Gravitino resource.

    creator string

    The user who created the resource

    createTime date-time

    The time the resource was created

    lastModifier string

    The user who last modified the resource

    lastModifiedTime date-time

    The time the resource was last modified

Loading...
Last updated on