Set a row policy

Creates or replaces the row-level security policy that limits which rows of a table a role can read.

POST /v1/tenants/{tenant}/db/rls

Store a role's filter for readable rowsHere, select and all policies apply to reads.

Choose the role and tableIdentify whose rows should be restricted.
Define the row predicateSupply the using expression and command.
Confirm the stored policyCheck effective policy selection for the intended user.

Before you start

Use your database bearer token.

Use an identity authorized to manage access. Create the role and table first; the new policy replaces their existing policy.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Request body

application/json

Limits and accepted values

using is a predicate such as "owner = CURRENT_USER AND region IN ('us','eu')" and is validated at create time (invalid = 400).
command defaults to select and is stored lower-cased;
it is not validated, and only select and all policies are applied to reads.
One policy per (table, role);
a new one replaces the old.

Field	Type	Required
`command`	`string`	Optional
`role`	`string`	Required
`table`	`string`	Required
`using`	`string`	Required

Read the result

ok: true confirms the stored policy. using is the row predicate. Only select and all policies apply to reads here; a stored command name is not proof that other operation types are enforced.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
409	Resolve the conflict before retrying.
413	Split or reduce the request body.
415	Send the required Content-Type.
422	Correct the values or unsupported combination.
429	Honor Retry-After when present; back off.
500	Check the outcome before retrying a write.
501	Check deployment support for this operation.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request POST "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/rls" \
  --header "Authorization: Bearer ${OC_TOKEN}" \
  --header "Content-Type: application/json" \
  --data-binary '{
  "table": "demo.people",
  "role": "demo_reader",
  "command": "select",
  "using": "score >= 20"
}'

Response example

Examples use synthetic values to show the response format.

Response status

{
  "ok": true
}

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

HeadersCopy Anchor Link

Request bodyCopy Anchor Link