> ## Documentation Index > Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Apply a grant > Writes the grant's Ranger policies, merging into an existing policy on the same resources (items are only added to). Mask and row-filter policies are written before the access policy. Groups must be Keycloak realm roles and users Keycloak users. If a write fails after others succeeded, `detail` is `{error, written: [{policy_id, policy_name, policy_type}]}`; otherwise it is a string. ## OpenAPI ````yaml post /api/govern/data-access/grants openapi: 3.1.0 info: title: Nx1 AI API description: | AI API for Nx1 Data Platform Management and Automated Data Tasks. Authentication is required via PSK in Authorization header. Default PSK is | [ask a friend] | version: 0.10.2 servers: [] security: [] paths: /api/govern/data-access/grants: post: tags: - Data access summary: Apply a grant description: >- Writes the grant's Ranger policies, merging into an existing policy on the same resources (items are only added to). Mask and row-filter policies are written before the access policy. Groups must be Keycloak realm roles and users Keycloak users. If a write fails after others succeeded, `detail` is `{error, written: [{policy_id, policy_name, policy_type}]}`; otherwise it is a string. operationId: apply_grant_api_govern_data_access_grants_post requestBody: content: application/json: schema: $ref: '#/components/schemas/GrantRequest' required: true responses: '201': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/GrantApplyResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Conflict '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unprocessable Content '502': description: Bad Gateway content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: Service Unavailable content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - OAuth2AuthorizationCodeBearer: [] - APIKeyHeader: [] components: schemas: GrantRequest: properties: groups: items: type: string type: array title: Groups users: items: type: string type: array title: Users level: $ref: '#/components/schemas/AccessLevel' target: oneOf: - $ref: '#/components/schemas/DataTarget' - $ref: '#/components/schemas/StorageTarget' - $ref: '#/components/schemas/TagTarget' title: Target discriminator: propertyName: kind mapping: data: '#/components/schemas/DataTarget' storage: '#/components/schemas/StorageTarget' tag: '#/components/schemas/TagTarget' masks: items: $ref: '#/components/schemas/ColumnMask' type: array title: Masks description: Data targets on one table only. Not allowed on storage. row_filter: anyOf: - type: string - type: 'null' title: Row Filter description: SQL predicate appended as WHERE. Data targets on one table only. tag_mask_type: anyOf: - type: string - type: 'null' title: Tag Mask Type description: >- Tag targets only: hide every column carrying the tag with this mask type (e.g. MASK, MASK_HASH). description: type: string title: Description default: '' type: object required: - level - target title: GrantRequest description: Who gets what access on what, with optional conditions. GrantApplyResponse: properties: target_label: type: string title: Target Label policies: items: additionalProperties: true type: object type: array title: Policies description: >- policy_id, policy_name, status ('created', 'updated' or 'unchanged'), policy_type, service each. type: object required: - target_label - policies title: GrantApplyResponse ErrorResponse: properties: error: type: string title: Error description: A brief description of the error that occurred. code: type: integer title: Code description: The HTTP status code associated with the error. default: 500 type: object required: - error title: ErrorResponse AccessLevel: type: string enum: - read - write - manage - owner title: AccessLevel description: |- A named bundle of Ranger access types. Data targets use all four. Storage locations (``url``) use only READ and WRITE. The access types behind each level are resolved against the live service-def, so a level never sends a type Ranger doesn't know. DataTarget: properties: kind: type: string const: data title: Kind default: data catalog: type: string minLength: 1 title: Catalog description: Catalog (or database). schema: anyOf: - type: string - type: 'null' title: Schema description: Schema; blank or '*' for every schema in the catalog. table: anyOf: - type: string - type: 'null' title: Table description: Table; blank or '*' for every table. columns: items: type: string type: array title: Columns description: Columns; empty for every column. type: object required: - catalog title: DataTarget description: A catalog, schema, table or set of columns. Blank levels mean all. StorageTarget: properties: kind: type: string const: storage title: Kind default: storage url: type: string minLength: 1 title: Url description: Storage URL. recursive: type: boolean title: Recursive description: Include everything under this path. default: true type: object required: - url title: StorageTarget description: An object-storage location, e.g. ``s3a://lake/raw/sales/``. TagTarget: properties: kind: type: string const: tag title: Kind default: tag tag: type: string minLength: 1 title: Tag description: Tag name, as in DataHub. type: object required: - tag title: TagTarget description: |- Everything carrying a DataHub tag, through Ranger's tag service. Tags reach Ranger from DataHub via ranger-sync, so a tag grant covers every table and column carrying the tag — now and later. ColumnMask: properties: column: type: string minLength: 1 title: Column mask_type: type: string title: Mask Type description: >- A mask type name from the service-def (e.g. MASK, MASK_SHOW_LAST_4, MASK_HASH, MASK_NULL). default: MASK type: object required: - column title: ColumnMask description: Hide one column's values from the grantees. securitySchemes: OAuth2AuthorizationCodeBearer: type: oauth2 flows: authorizationCode: scopes: {} authorizationUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth tokenUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token APIKeyHeader: type: apiKey in: header name: Authorization-PSK ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.