> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Check whether a user has a level of access to a target

> Looks up the user's effective realm roles in Keycloak (ranger-sync turns them into Ranger groups) and evaluates the policies that apply. Returns a one-sentence answer, the masks and row filter that would apply, and the deciding policies.



## OpenAPI

````yaml post /api/govern/data-access/access/check
openapi: 3.1.0
info:
  title: Nx1 AI API
  description: |

    AI API for Nx1 Data Platform Management and Automated Data Tasks.

    Authentication is required via PSK in Authorization header.

    Default PSK is | [ask a friend] |
  version: 0.10.2
servers: []
security: []
paths:
  /api/govern/data-access/access/check:
    post:
      tags:
        - Data access
      summary: Check whether a user has a level of access to a target
      description: >-
        Looks up the user's effective realm roles in Keycloak (ranger-sync turns
        them into Ranger groups) and evaluates the policies that apply. Returns
        a one-sentence answer, the masks and row filter that would apply, and
        the deciding policies.
      operationId: check_access_api_govern_data_access_access_check_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessCheckRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessCheckResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Conflict
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
          description: Unprocessable Content
        '502':
          description: Bad Gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '503':
          description: Service Unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - OAuth2AuthorizationCodeBearer: []
        - APIKeyHeader: []
components:
  schemas:
    AccessCheckRequest:
      properties:
        username:
          type: string
          minLength: 1
          title: Username
        level:
          $ref: '#/components/schemas/AccessLevel'
          default: read
        target:
          oneOf:
            - $ref: '#/components/schemas/DataTarget'
            - $ref: '#/components/schemas/StorageTarget'
            - $ref: '#/components/schemas/TagTarget'
          title: Target
          discriminator:
            propertyName: kind
            mapping:
              data: '#/components/schemas/DataTarget'
              storage: '#/components/schemas/StorageTarget'
              tag: '#/components/schemas/TagTarget'
      type: object
      required:
        - username
        - target
      title: AccessCheckRequest
    AccessCheckResponse:
      properties:
        allowed:
          type: boolean
          title: Allowed
        answer:
          type: string
          title: Answer
          description: One plain sentence.
        username:
          type: string
          title: Username
        super_admin:
          anyOf:
            - type: string
            - type: 'null'
          title: Super Admin
          description: >-
            The super user or group (e.g. trino-admin) that makes this user a
            super admin of the Ranger service: every permission, everywhere.
            Null for everyone else.
        groups:
          items:
            type: string
          type: array
          title: Groups
          description: >-
            The user's realm roles that the applying policies name, plus public.
            Their other roles aren't shown.
        masked_columns:
          items:
            type: string
          type: array
          title: Masked Columns
        masks:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Masks
          description: column and mask_type for each column that would be masked.
        row_filter:
          anyOf:
            - type: string
            - type: 'null'
          title: Row Filter
        deciding_policies:
          items:
            additionalProperties: true
            type: object
          type: array
          title: Deciding Policies
        warnings:
          items:
            type: string
          type: array
          title: Warnings
        evaluated_by:
          type: string
          enum:
            - ranger
            - policies
          title: Evaluated By
          description: >-
            'ranger': decided by Ranger's evaluator (nx1-ranger-authz-api), as a
            real query would be. 'policies': worked out here from the policies
            (tag targets, or the evaluator was unavailable).
          default: policies
        audit_filters:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Audit Filters
          description: >-
            A ready POST /api/audit/search body ({source, filters}) for this
            user's real past decisions on this resource in Ranger's audit
            stream.
        explanation:
          anyOf:
            - $ref: '#/components/schemas/AccessExplanation'
            - type: 'null'
          description: >-
            Why not, who has it, and what would fix it. Null when allowed with
            nothing denied.
        caveat:
          type: string
          title: Caveat
          default: >-
            Worked out from the policies, not by Ranger's own evaluator: policy
            priority and conditions are not considered.
      type: object
      required:
        - allowed
        - answer
        - username
        - groups
      title: AccessCheckResponse
    ErrorResponse:
      properties:
        error:
          type: string
          title: Error
          description: A brief description of the error that occurred.
        code:
          type: integer
          title: Code
          description: The HTTP status code associated with the error.
          default: 500
      type: object
      required:
        - error
      title: ErrorResponse
    AccessLevel:
      type: string
      enum:
        - read
        - write
        - manage
        - owner
      title: AccessLevel
      description: |-
        A named bundle of Ranger access types.

        Data targets use all four. Storage locations (``url``) use only READ
        and WRITE. The access types behind each level are resolved against the
        live service-def, so a level never sends a type Ranger doesn't know.
    DataTarget:
      properties:
        kind:
          type: string
          const: data
          title: Kind
          default: data
        catalog:
          type: string
          minLength: 1
          title: Catalog
          description: Catalog (or database).
        schema:
          anyOf:
            - type: string
            - type: 'null'
          title: Schema
          description: Schema; blank or '*' for every schema in the catalog.
        table:
          anyOf:
            - type: string
            - type: 'null'
          title: Table
          description: Table; blank or '*' for every table.
        columns:
          items:
            type: string
          type: array
          title: Columns
          description: Columns; empty for every column.
      type: object
      required:
        - catalog
      title: DataTarget
      description: A catalog, schema, table or set of columns. Blank levels mean all.
    StorageTarget:
      properties:
        kind:
          type: string
          const: storage
          title: Kind
          default: storage
        url:
          type: string
          minLength: 1
          title: Url
          description: Storage URL.
        recursive:
          type: boolean
          title: Recursive
          description: Include everything under this path.
          default: true
      type: object
      required:
        - url
      title: StorageTarget
      description: An object-storage location, e.g. ``s3a://lake/raw/sales/``.
    TagTarget:
      properties:
        kind:
          type: string
          const: tag
          title: Kind
          default: tag
        tag:
          type: string
          minLength: 1
          title: Tag
          description: Tag name, as in DataHub.
      type: object
      required:
        - tag
      title: TagTarget
      description: |-
        Everything carrying a DataHub tag, through Ranger's tag service.

        Tags reach Ranger from DataHub via ranger-sync, so a tag grant covers
        every table and column carrying the tag — now and later.
    AccessExplanation:
      properties:
        reasons:
          items:
            $ref: '#/components/schemas/AccessReason'
          type: array
          title: Reasons
        grantees:
          items:
            $ref: '#/components/schemas/AccessGrantee'
          type: array
          title: Grantees
        fixes:
          items:
            $ref: '#/components/schemas/AccessFix'
          type: array
          title: Fixes
        audit_hint:
          type: string
          title: Audit Hint
          default: ''
      type: object
      title: AccessExplanation
      description: >-
        Why a check isn't a plain yes, who does have the access, what would fix
        it.
    AccessReason:
      properties:
        access_types:
          items:
            type: string
          type: array
          title: Access Types
        kind:
          type: string
          enum:
            - denied_by_policy
            - no_policy
            - column_denied
            - policy_disabled
            - excepted
          title: Kind
        policy_id:
          anyOf:
            - type: integer
            - type: 'null'
          title: Policy Id
        policy_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Policy Name
        'on':
          items:
            type: string
          type: array
          title: 'On'
          description: Columns, for column_denied.
        detail:
          type: string
          title: Detail
          description: One plain sentence.
      type: object
      required:
        - kind
        - detail
      title: AccessReason
      description: One reason the check isn't a plain yes.
    AccessGrantee:
      properties:
        principal:
          type: string
          title: Principal
        principal_type:
          type: string
          enum:
            - group
            - user
            - role
          title: Principal Type
        level:
          type: string
          title: Level
        user_is_member:
          type: boolean
          title: User Is Member
          description: The checked user is this principal, or holds this role.
      type: object
      required:
        - principal
        - principal_type
        - level
        - user_is_member
      title: AccessGrantee
      description: Someone who already has the checked level on the checked target.
    AccessFix:
      properties:
        kind:
          type: string
          enum:
            - join_group
            - grant_user
            - grant_group
          title: Kind
        principal:
          anyOf:
            - type: string
            - type: 'null'
          title: Principal
        principal_type:
          anyOf:
            - type: string
              enum:
                - group
                - user
                - role
            - type: 'null'
          title: Principal Type
        detail:
          type: string
          title: Detail
          description: One plain sentence.
        grant:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Grant
          description: >-
            For grant_*: a GrantRequest body, ready for POST /grants/preview (or
            fill_access_grant).
      type: object
      required:
        - kind
        - detail
      title: AccessFix
      description: One thing that would give the user the access.
  securitySchemes:
    OAuth2AuthorizationCodeBearer:
      type: oauth2
      flows:
        authorizationCode:
          scopes: {}
          authorizationUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth
          tokenUrl: >-
            https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token
    APIKeyHeader:
      type: apiKey
      in: header
      name: Authorization-PSK

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.