Configure application permissions

Query current-principal roles and the permission schema, validate an application permission policy, then apply it. This page does not configure data-resource or object grants.

Prerequisites

Prepare credentials that can access the target workspace and the permission policy to apply. For service endpoints, authentication, and general request formats, see Prepare to call an API.

Before applying the policy, confirm the current-principal roles and available permission schema, then validate the policy content.

Call sequence

1. Get current-principal roles to confirm the calling identity.

2. Get the permission schema and prepare a policy that matches it.

3. Use Validate application permission policy to check the policy.

4. After validation, apply the policy and query current-principal roles again to confirm observable role results.

API operations

Query, validate, and apply policies

What you need to do	API operation	Use it when
Query current-principal roles	Get current-principal roles	Confirm roles for the current calling identity before or after applying a policy.
Query the permission schema	Get the permission schema	Learn the available schema before preparing a policy.
Validate an application permission policy	Validate application permission policy	Check a policy to submit before applying it.
Apply a permission policy	Apply application permission policy	Submit an application permission policy after validation.

Confirm the result

After applying the policy, use Get current-principal roles to confirm observable role information for the current calling identity.

Next steps

• Configure data privileges

• Configure object permissions

Last updated on Sep 3, 2026