# Configure data privileges

Query data resources that can be granted, validate and apply data privileges, then track or repair related privilege operations. This page does not cover object permissions or application permission policies.

## Prerequisites

Prepare credentials that can access the target workspace, together with the principals to grant access to and the resource scope. For service endpoints, authentication, and general request formats, see [Prepare to call an API](../../api-call-basics.md).

Before applying changes, query grantable resources and validate the privileges to submit. Do not treat submitting a privilege operation as completion; query the operation to confirm its result.

## Call sequence

1. First [list grantable resources](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/list-permission-resources.md) or batch-describe known resources to confirm the grant target.
2. Use [Validate data privileges](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/validate-data-privileges.md) to check the privileges to apply.
3. After validation, [apply data privileges](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/apply-data-privileges.md) and retain the returned privilege-operation information.
4. Query the privilege operation and current data privileges. If recovery is needed, follow the requirements of the repair action.

## API operations

### Identify grantable resources and validate privileges

| What you need to do | API operation | Use it when |
| --- | --- | --- |
| Query grantable resources | [List grantable resources](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/list-permission-resources.md) | Select the resource scope before granting access. |
| Batch query grantable resources | [Batch describe grantable resources](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/batch-describe-permission-resources.md) | You have a resource scope and need to confirm it in bulk. |
| Validate data privileges | [Validate data privileges](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/validate-data-privileges.md) | Check privileges to submit before applying them. |

### Apply and confirm data privileges

| What you need to do | API operation | Use it when |
| --- | --- | --- |
| Apply data privileges | [Apply data privileges](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/apply-data-privileges.md) | Submit privilege changes after validation. |
| Query a data-privilege operation | [Get a data-privilege operation](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/get-data-privilege-operation.md) | Track a submitted privilege operation. |
| Repair a data-privilege operation | [Repair a data-privilege operation](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/repair-data-privilege-operation.md) | You need to handle a target privilege operation. |
| Query data privileges | [Get data privileges](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/get-data-privileges.md) | Confirm the current data-privilege view. |

## Confirm the result

After applying changes, use [Get a data-privilege operation](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/get-data-privilege-operation.md) to view the operation, and [Get data privileges](../../../../reference/api/ai-studio/users-and-permissions/data-privileges/get-data-privileges.md) to confirm the current privilege view.

## Next steps

- [Configure object permissions](object-permissions.md)
- [Configure application permissions](application-permissions.md)