Configure data privileges¶
Query data resources that can be granted, validate and apply data privileges, then track or repair related privilege operations. This page does not cover object permissions or application permission policies.
Prerequisites¶
Prepare credentials that can access the target workspace, together with the principals to grant access to and the resource scope. For service endpoints, authentication, and general request formats, see Prepare to call an API.
Before applying changes, query grantable resources and validate the privileges to submit. Do not treat submitting a privilege operation as completion; query the operation to confirm its result.
Call sequence¶
First list grantable resources or batch-describe known resources to confirm the grant target.
Use Validate data privileges to check the privileges to apply.
After validation, apply data privileges and retain the returned privilege-operation information.
Query the privilege operation and current data privileges. If recovery is needed, follow the requirements of the repair action.
API operations¶
Identify grantable resources and validate privileges¶
What you need to do |
API operation |
Use it when |
|---|---|---|
Query grantable resources |
Select the resource scope before granting access. |
|
Batch query grantable resources |
You have a resource scope and need to confirm it in bulk. |
|
Validate data privileges |
Check privileges to submit before applying them. |
Apply and confirm data privileges¶
What you need to do |
API operation |
Use it when |
|---|---|---|
Apply data privileges |
Submit privilege changes after validation. |
|
Query a data-privilege operation |
Track a submitted privilege operation. |
|
Repair a data-privilege operation |
You need to handle a target privilege operation. |
|
Query data privileges |
Confirm the current data-privilege view. |
Confirm the result¶
After applying changes, use Get a data-privilege operation to view the operation, and Get data privileges to confirm the current privilege view.