Skip to main content
POST
Check whether a user has a level of access to a target

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/json
username
string
required
Minimum string length: 1
target
DataTarget · object
required

A catalog, schema, table or set of columns. Blank levels mean all.

level
enum<string>
default:read

A named bundle of Ranger access types.

Data targets use all four. Storage locations (url) use only READ and WRITE. The access types behind each level are resolved against the live service-def, so a level never sends a type Ranger doesn't know.

Available options:
read,
write,
manage,
owner

Response

Successful Response

allowed
boolean
required
answer
string
required

One plain sentence.

username
string
required
groups
string[]
required

The user's realm roles that the applying policies name, plus public. Their other roles aren't shown.

super_admin
string | null

The super user or group (e.g. trino-admin) that makes this user a super admin of the Ranger service: every permission, everywhere. Null for everyone else.

masked_columns
string[]
masks
Masks · object[]

column and mask_type for each column that would be masked.

row_filter
string | null
deciding_policies
Deciding Policies · object[]
warnings
string[]
evaluated_by
enum<string>
default:policies

'ranger': decided by Ranger's evaluator (nx1-ranger-authz-api), as a real query would be. 'policies': worked out here from the policies (tag targets, or the evaluator was unavailable).

Available options:
ranger,
policies
audit_filters
Audit Filters · object | null

A ready POST /api/audit/search body ({source, filters}) for this user's real past decisions on this resource in Ranger's audit stream.

explanation
AccessExplanation · object | null

Why not, who has it, and what would fix it. Null when allowed with nothing denied.

caveat
string
default:Worked out from the policies, not by Ranger's own evaluator: policy priority and conditions are not considered.