curl --request POST \
--url https://api.example.com/api/govern/data-access/grants \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": [
"<string>"
]
},
"groups": [
"<string>"
],
"users": [
"<string>"
],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
'import requests
url = "https://api.example.com/api/govern/data-access/grants"
payload = {
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": ["<string>"]
},
"groups": ["<string>"],
"users": ["<string>"],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
target: {
catalog: '<string>',
kind: 'data',
schema: '<string>',
table: '<string>',
columns: ['<string>']
},
groups: ['<string>'],
users: ['<string>'],
masks: [{column: '<string>', mask_type: 'MASK'}],
row_filter: '<string>',
tag_mask_type: '<string>',
description: ''
})
};
fetch('https://api.example.com/api/govern/data-access/grants', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/grants",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'target' => [
'catalog' => '<string>',
'kind' => 'data',
'schema' => '<string>',
'table' => '<string>',
'columns' => [
'<string>'
]
],
'groups' => [
'<string>'
],
'users' => [
'<string>'
],
'masks' => [
[
'column' => '<string>',
'mask_type' => 'MASK'
]
],
'row_filter' => '<string>',
'tag_mask_type' => '<string>',
'description' => ''
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/grants"
payload := strings.NewReader("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/govern/data-access/grants")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/grants")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}"
response = http.request(request)
puts response.read_body{
"target_label": "<string>",
"policies": [
{}
]
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Apply a grant
Writes the grant’s Ranger policies, merging into an existing policy on the same resources (items are only added to). Mask and row-filter policies are written before the access policy. Groups must be Keycloak realm roles and users Keycloak users. If a write fails after others succeeded, detail is {error, written: [{policy_id, policy_name, policy_type}]}; otherwise it is a string.
curl --request POST \
--url https://api.example.com/api/govern/data-access/grants \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": [
"<string>"
]
},
"groups": [
"<string>"
],
"users": [
"<string>"
],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
'import requests
url = "https://api.example.com/api/govern/data-access/grants"
payload = {
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": ["<string>"]
},
"groups": ["<string>"],
"users": ["<string>"],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
target: {
catalog: '<string>',
kind: 'data',
schema: '<string>',
table: '<string>',
columns: ['<string>']
},
groups: ['<string>'],
users: ['<string>'],
masks: [{column: '<string>', mask_type: 'MASK'}],
row_filter: '<string>',
tag_mask_type: '<string>',
description: ''
})
};
fetch('https://api.example.com/api/govern/data-access/grants', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/grants",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'target' => [
'catalog' => '<string>',
'kind' => 'data',
'schema' => '<string>',
'table' => '<string>',
'columns' => [
'<string>'
]
],
'groups' => [
'<string>'
],
'users' => [
'<string>'
],
'masks' => [
[
'column' => '<string>',
'mask_type' => 'MASK'
]
],
'row_filter' => '<string>',
'tag_mask_type' => '<string>',
'description' => ''
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/grants"
payload := strings.NewReader("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/govern/data-access/grants")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/grants")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}"
response = http.request(request)
puts response.read_body{
"target_label": "<string>",
"policies": [
{}
]
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Body
Who gets what access on what, with optional conditions.
A named bundle of Ranger access types.
Data targets use all four. Storage locations (url) use only READ
and WRITE. The access types behind each level are resolved against the
live service-def, so a level never sends a type Ranger doesn't know.
read, write, manage, owner A catalog, schema, table or set of columns. Blank levels mean all.
- DataTarget
- StorageTarget
- TagTarget
Show child attributes
Show child attributes
Data targets on one table only. Not allowed on storage.
Show child attributes
Show child attributes
SQL predicate appended as WHERE. Data targets on one table only.
Tag targets only: hide every column carrying the tag with this mask type (e.g. MASK, MASK_HASH).
Was this page helpful?

