Set a role's permissions

Set a role's permissions and optional column masks for a table or all tables. This replaces the role's existing grant on that object.

POST /v1/tenants/{tenant}/db/grants

Replace a role's permissions on an objectInclude every privilege and column mask that this grant should retain.

Choose the role and objectIdentify the table or all-table grant.
Supply the complete grantSet privilege text and optional masked columns.
Confirm granted trueReview effective access after the replacement.

Before you start

Use your database bearer token.

Connection setup

Use an identity allowed to manage grants. Create the role before granting it permissions.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Request body

application/json

Limits and accepted values

privileges is TEXT, not a list: SQL words ALL, SELECT, INSERT, UPDATE, DELETE, REFERENCES, NONE and/or letter sets from S,I,U,D,R (e.g.
SIUDR, SI, "SELECT, INSERT"), separated by commas, spaces, + or |.
An unrecognised token is a 400.
object is a table id namespace.table or *.

Field	Type	Required
`masked_columns`	`string[]`	Optional

Fields in masked_columns

Field	Type	Required
`masked_columns`	`string`	Optional

Field	Type	Required
`object`	`string`	Required
`privileges`	`string`	Required
`role`	`string`	Required

Read the result

granted: true confirms the replacement grant. privileges is text, such as SELECT or SI, not a JSON array. Include every permission and mask you want this grant to retain.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
409	Resolve the conflict before retrying.
413	Split or reduce the request body.
415	Send the required Content-Type.
422	Correct the values or unsupported combination.
429	Honor Retry-After when present; back off.
500	Check the outcome before retrying a write.
501	Check deployment support for this operation.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request POST "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/grants" \
  --header "Authorization: Bearer ${OC_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary '{
  "role": "demo_reader",
  "object": "demo.people",
  "privileges": "SELECT"
}'

Response example

Examples use synthetic values to show the response format.

Response status

{
  "granted": true
}

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

HeadersCopy Anchor Link

Request bodyCopy Anchor Link