Check a user's row policies

See which row policies apply to a user on a table, without running a query as that user.

GET /v1/tenants/{tenant}/db/rls/effective

Explain a user's applicable row policiesThis inspection does not execute a query or return visible rows.

Select user and tableChoose the access combination to investigate.
Evaluate policy selectionInspect restricted, superuser and policy-applies flags.
Read the explanationUse it to understand the applicable row filters.

Before you start

Use your database bearer token.

Connection setup

Use an identity authorized to manage access in this tenant.

Path parameters

Field	Type	Required
`tenant`	`string`	Required

Query parameters

Field	Type	Required
`user`	`string`	Required
`table`	`string`	Required

Headers

Field	Type	Required	Description
`x-oc-db-user`	`string`	Optional	Acting database user (role, grant and row-policy checks). Send with x-oc-db-key.
`x-oc-db-key`	`string`	Optional	API key of the x-oc-db-user user.

Read the result

Check restricted, is_superuser and each policy's applies flag. This explains policy selection for the requested user/table; it does not run a query or return the rows they would see.

Response statuses

HTTP status reference

Status	What to do
200	OK
400	Correct the request before retrying.
401	Check the credential and Authorization header.
402	Check feature access or available credits.
403	Check tenant access, roles and permissions.
404	Check the resource ID and API route.
429	Honor Retry-After when present; back off.
503	Honor Retry-After when present; check write outcomes.

Request example

curl --include --request GET "${OC_BASE_URL}/v1/tenants/${OC_TENANT}/db/rls/effective?user=demo_user&table=demo.people" \
  --header "Authorization: Bearer ${OC_TOKEN}"

Response example

Examples use synthetic values to show the response format.

Response status

{
  "user": "demo_user",
  "table": "demo.people",
  "is_superuser": false,
  "restricted": true,
  "policies": [
    {
      "role": "demo_reader",
      "command": "select",
      "using": "score >= 20",
      "applies": true
    }
  ]
}

Download the OpenAPI specification for the complete response schemas.

Before you startCopy Anchor Link

Path parametersCopy Anchor Link

Query parametersCopy Anchor Link

HeadersCopy Anchor Link