curl --request POST \
--url https://api.example.com/api/govern/data-access/access/check \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"username": "<string>",
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": [
"<string>"
]
},
"level": "read"
}
'import requests
url = "https://api.example.com/api/govern/data-access/access/check"
payload = {
"username": "<string>",
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": ["<string>"]
},
"level": "read"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
username: '<string>',
target: {
catalog: '<string>',
kind: 'data',
schema: '<string>',
table: '<string>',
columns: ['<string>']
},
level: 'read'
})
};
fetch('https://api.example.com/api/govern/data-access/access/check', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/access/check",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'username' => '<string>',
'target' => [
'catalog' => '<string>',
'kind' => 'data',
'schema' => '<string>',
'table' => '<string>',
'columns' => [
'<string>'
]
],
'level' => 'read'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/access/check"
payload := strings.NewReader("{\n \"username\": \"<string>\",\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"level\": \"read\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/govern/data-access/access/check")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"username\": \"<string>\",\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"level\": \"read\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/access/check")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"username\": \"<string>\",\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"level\": \"read\"\n}"
response = http.request(request)
puts response.read_body{
"allowed": true,
"answer": "<string>",
"username": "<string>",
"groups": [
"<string>"
],
"super_admin": "<string>",
"masked_columns": [
"<string>"
],
"masks": [
{}
],
"row_filter": "<string>",
"deciding_policies": [
{}
],
"warnings": [
"<string>"
],
"evaluated_by": "policies",
"audit_filters": {},
"explanation": {
"reasons": [
{
"kind": "denied_by_policy",
"detail": "<string>",
"access_types": [
"<string>"
],
"policy_id": 123,
"policy_name": "<string>",
"on": [
"<string>"
]
}
],
"grantees": [
{
"principal": "<string>",
"principal_type": "group",
"level": "<string>",
"user_is_member": true
}
],
"fixes": [
{
"kind": "join_group",
"detail": "<string>",
"principal": "<string>",
"principal_type": "group",
"grant": {}
}
],
"audit_hint": ""
},
"caveat": "Worked out from the policies, not by Ranger's own evaluator: policy priority and conditions are not considered."
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Check whether a user has a level of access to a target
Looks up the user’s effective realm roles in Keycloak (ranger-sync turns them into Ranger groups) and evaluates the policies that apply. Returns a one-sentence answer, the masks and row filter that would apply, and the deciding policies.
curl --request POST \
--url https://api.example.com/api/govern/data-access/access/check \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"username": "<string>",
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": [
"<string>"
]
},
"level": "read"
}
'import requests
url = "https://api.example.com/api/govern/data-access/access/check"
payload = {
"username": "<string>",
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": ["<string>"]
},
"level": "read"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
username: '<string>',
target: {
catalog: '<string>',
kind: 'data',
schema: '<string>',
table: '<string>',
columns: ['<string>']
},
level: 'read'
})
};
fetch('https://api.example.com/api/govern/data-access/access/check', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/access/check",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'username' => '<string>',
'target' => [
'catalog' => '<string>',
'kind' => 'data',
'schema' => '<string>',
'table' => '<string>',
'columns' => [
'<string>'
]
],
'level' => 'read'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/access/check"
payload := strings.NewReader("{\n \"username\": \"<string>\",\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"level\": \"read\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/govern/data-access/access/check")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"username\": \"<string>\",\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"level\": \"read\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/access/check")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"username\": \"<string>\",\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"level\": \"read\"\n}"
response = http.request(request)
puts response.read_body{
"allowed": true,
"answer": "<string>",
"username": "<string>",
"groups": [
"<string>"
],
"super_admin": "<string>",
"masked_columns": [
"<string>"
],
"masks": [
{}
],
"row_filter": "<string>",
"deciding_policies": [
{}
],
"warnings": [
"<string>"
],
"evaluated_by": "policies",
"audit_filters": {},
"explanation": {
"reasons": [
{
"kind": "denied_by_policy",
"detail": "<string>",
"access_types": [
"<string>"
],
"policy_id": 123,
"policy_name": "<string>",
"on": [
"<string>"
]
}
],
"grantees": [
{
"principal": "<string>",
"principal_type": "group",
"level": "<string>",
"user_is_member": true
}
],
"fixes": [
{
"kind": "join_group",
"detail": "<string>",
"principal": "<string>",
"principal_type": "group",
"grant": {}
}
],
"audit_hint": ""
},
"caveat": "Worked out from the policies, not by Ranger's own evaluator: policy priority and conditions are not considered."
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Body
1A catalog, schema, table or set of columns. Blank levels mean all.
- DataTarget
- StorageTarget
- TagTarget
Show child attributes
Show child attributes
A named bundle of Ranger access types.
Data targets use all four. Storage locations (url) use only READ
and WRITE. The access types behind each level are resolved against the
live service-def, so a level never sends a type Ranger doesn't know.
read, write, manage, owner Response
Successful Response
One plain sentence.
The user's realm roles that the applying policies name, plus public. Their other roles aren't shown.
The super user or group (e.g. trino-admin) that makes this user a super admin of the Ranger service: every permission, everywhere. Null for everyone else.
column and mask_type for each column that would be masked.
'ranger': decided by Ranger's evaluator (nx1-ranger-authz-api), as a real query would be. 'policies': worked out here from the policies (tag targets, or the evaluator was unavailable).
ranger, policies A ready POST /api/audit/search body ({source, filters}) for this user's real past decisions on this resource in Ranger's audit stream.
Why not, who has it, and what would fix it. Null when allowed with nothing denied.
Show child attributes
Show child attributes
Was this page helpful?

