Validate data privileges

Check whether data-access privilege changes for a role can be applied without modifying grants. After changing a request from the validation result, apply it separately.

POST https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/data-privileges:validate

Preparation before calling

First select a role, then view data privileges and prepare the change to validate from the latest grant state. Prepare a personal access token with required workspace permissions and the target workspace ID.

Request parameters

curl -X POST "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/data-privileges:validate" -H "X-API-Key: $AI_STUDIO_API_KEY" -H "X-Workspace-ID: $WORKSPACE_ID" -H "Content-Type: application/json" -d '{"request_id":"req-001","expected_data_privilege_version":1,"mutations":[{"operation":"grant","action_id":"table.query","resource_type":"table","resource_id":"table-001","privilege":"select","with_grant_option":false}]}'

Path parameters

Parameter

Type

Required

Description

workspace_id

string

Yes

Target workspace ID.

role_id

string

Yes

Role ID whose data privileges are validated.

Request body

Parameter

Type

Required

Description

request_id

string

Yes

Caller-generated request ID.

expected_data_privilege_version

integer

No

Data-privilege version for concurrency checks; cannot be less than 0.

mutations

object array

Yes

Privilege changes to validate; must contain at least one item.

mutations[].operation

string

Yes

Change type: grant or revoke.

mutations[].action_id

string

Yes

Data action ID in the permission schema.

mutations[].resource_type

string

Yes

Resource type: database or table.

mutations[].resource_id

string

Yes

Database or table resource ID.

mutations[].privilege

string

Yes

MatrixOne privilege name.

mutations[].with_grant_option

boolean

No

Whether the target role can grant this privilege onward.

mutations[].row_column

object

No

Table row/column rule, submitted only to set, clear, or retain one.

mutations[].row_column.mode

string

Yes

Rule handling: keep, set, or clear.

mutations[].row_column.draft

object

No

Rule submitted when mode is set.

Successful response

Returns the validation conclusion. When request format is valid but the privilege draft is invalid, this endpoint can still return 200; then data.valid is false and data.errors identifies field paths.

{"code":"OK","msg":"OK","data":{"valid":true,"errors":[],"warnings":[],"payload_fingerprint":"sha256:example","request_id":"req-001","trace_id":"trace-001"}}

Field

Type

Description

code

string

OK on success.

msg

string

OK on success.

data.valid

boolean

Whether the privilege changes pass validation.

data.errors

object array

Validation errors, each with an error code and field path.

data.warnings

string array

Warnings that do not block submission.

data.payload_fingerprint

string

Fingerprint of normalized request content.

data.request_id

string

Request correlation ID.

data.trace_id

string

Trace ID.

Error response

{"code":"ErrParamInvalid","msg":"Invalid request parameters","data":null}

Field

Type

Description

code

string

Error code.

msg

string

Error message.

data

null

—
Last updated on