# Validate data privileges

```{raw} html
<div class="mo-api-page-show-toc" aria-hidden="true"></div>
```

Check whether data-access privilege changes for a role can be applied without modifying grants. After changing a request from the validation result, apply it separately.

```text
POST https://moi.matrixorigin.cn/newmoi/workspaces/{workspace_id}/iam/roles/{role_id}/data-privileges:validate
```

## Preparation before calling

First [select a role](../roles/list-roles.md#select-a-role), then [view data privileges](get-data-privileges.md#confirm-current-data-privileges) and prepare the change to validate from the latest grant state. Prepare a [personal access token](../../../../../guides/genesis/api-keys.md) with required workspace permissions and the [target workspace ID](../../../../../guides/ai-studio/resource-center/workspace.md#copy-a-workspace-id).

## Request parameters

:::::::{div} mo-api-tabs
::::::{tab-set}
:::::{tab-item} Input example

```bash
curl -X POST "https://moi.matrixorigin.cn/newmoi/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/data-privileges:validate" -H "X-API-Key: $AI_STUDIO_API_KEY" -H "X-Workspace-ID: $WORKSPACE_ID" -H "Content-Type: application/json" -d '{"request_id":"req-001","expected_data_privilege_version":1,"mutations":[{"operation":"grant","action_id":"table.query","resource_type":"table","resource_id":"table-001","privilege":"select","with_grant_option":false}]}'
```

:::::
:::::{tab-item} Parameter description

### Path parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `workspace_id` | string | Yes | Target workspace ID. |
| `role_id` | string | Yes | Role ID whose data privileges are validated. |

### Request body

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `request_id` | string | Yes | Caller-generated request ID. |
| `expected_data_privilege_version` | integer | No | Data-privilege version for concurrency checks; cannot be less than 0. |
| `mutations` | object array | Yes | Privilege changes to validate; must contain at least one item. |
| `mutations[].operation` | string | Yes | Change type: `grant` or `revoke`. |
| `mutations[].action_id` | string | Yes | Data action ID in the permission schema. |
| `mutations[].resource_type` | string | Yes | Resource type: `database` or `table`. |
| `mutations[].resource_id` | string | Yes | Database or table resource ID. |
| `mutations[].privilege` | string | Yes | MatrixOne privilege name. |
| `mutations[].with_grant_option` | boolean | No | Whether the target role can grant this privilege onward. |
| `mutations[].row_column` | object | No | Table row/column rule, submitted only to set, clear, or retain one. |
| `mutations[].row_column.mode` | string | Yes | Rule handling: `keep`, `set`, or `clear`. |
| `mutations[].row_column.draft` | object | No | Rule submitted when `mode` is `set`. |

:::::
::::::
:::::::

## Successful response

Returns the validation conclusion. When request format is valid but the privilege draft is invalid, this endpoint can still return `200`; then `data.valid` is `false` and `data.errors` identifies field paths.

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{"code":"OK","msg":"OK","data":{"valid":true,"errors":[],"warnings":[],"payload_fingerprint":"sha256:example","request_id":"req-001","trace_id":"trace-001"}}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | `OK` on success. |
| `msg` | string | `OK` on success. |
| `data.valid` | boolean | Whether the privilege changes pass validation. |
| `data.errors` | object array | Validation errors, each with an error code and field path. |
| `data.warnings` | string array | Warnings that do not block submission. |
| `data.payload_fingerprint` | string | Fingerprint of normalized request content. |
| `data.request_id` | string | Request correlation ID. |
| `data.trace_id` | string | Trace ID. |

:::::
::::::
:::::::

## Error response

:::::::{div} mo-api-tabs mo-api-response-tabs
::::::{tab-set}
:::::{tab-item} Response example

```json
{"code":"ErrParamInvalid","msg":"Invalid request parameters","data":null}
```

:::::
:::::{tab-item} Field details

| Field | Type | Description |
| --- | --- | --- |
| `code` | string | Error code. |
| `msg` | string | Error message. |
| `data` | null | — |

:::::
::::::
:::::::