> ## Documentation Index > Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Preview a grant: the policies it writes and whose access changes > Compiles the grant into Ranger policies (access, plus a mask policy per masked column and a row-filter policy), marks those that merge into an existing policy, and shows each named group or user's level before and after, with warnings. A tag target compiles to tag-service policies (409 when no tag service is linked). Writes nothing. ## OpenAPI ````yaml post /api/govern/data-access/grants/preview openapi: 3.1.0 info: title: Nx1 AI API description: | AI API for Nx1 Data Platform Management and Automated Data Tasks. Authentication is required via PSK in Authorization header. Default PSK is | [ask a friend] | version: 0.10.2 servers: [] security: [] paths: /api/govern/data-access/grants/preview: post: tags: - Data access summary: 'Preview a grant: the policies it writes and whose access changes' description: >- Compiles the grant into Ranger policies (access, plus a mask policy per masked column and a row-filter policy), marks those that merge into an existing policy, and shows each named group or user's level before and after, with warnings. A tag target compiles to tag-service policies (409 when no tag service is linked). Writes nothing. operationId: preview_grant_api_govern_data_access_grants_preview_post requestBody: content: application/json: schema: $ref: '#/components/schemas/GrantRequest' required: true responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/GrantPreviewResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Conflict '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unprocessable Content '502': description: Bad Gateway content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: Service Unavailable content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - OAuth2AuthorizationCodeBearer: [] - APIKeyHeader: [] components: schemas: GrantRequest: properties: groups: items: type: string type: array title: Groups users: items: type: string type: array title: Users level: $ref: '#/components/schemas/AccessLevel' target: oneOf: - $ref: '#/components/schemas/DataTarget' - $ref: '#/components/schemas/StorageTarget' - $ref: '#/components/schemas/TagTarget' title: Target discriminator: propertyName: kind mapping: data: '#/components/schemas/DataTarget' storage: '#/components/schemas/StorageTarget' tag: '#/components/schemas/TagTarget' masks: items: $ref: '#/components/schemas/ColumnMask' type: array title: Masks description: Data targets on one table only. Not allowed on storage. row_filter: anyOf: - type: string - type: 'null' title: Row Filter description: SQL predicate appended as WHERE. Data targets on one table only. tag_mask_type: anyOf: - type: string - type: 'null' title: Tag Mask Type description: >- Tag targets only: hide every column carrying the tag with this mask type (e.g. MASK, MASK_HASH). description: type: string title: Description default: '' type: object required: - level - target title: GrantRequest description: Who gets what access on what, with optional conditions. GrantPreviewResponse: properties: target_label: type: string title: Target Label description: e.g. lakehouse.sales.* or s3a://lake/raw/ policies: items: $ref: '#/components/schemas/PolicyDraft' type: array title: Policies changes: items: $ref: '#/components/schemas/AccessChange' type: array title: Changes warnings: items: type: string type: array title: Warnings type: object required: - target_label - policies - changes title: GrantPreviewResponse ErrorResponse: properties: error: type: string title: Error description: A brief description of the error that occurred. code: type: integer title: Code description: The HTTP status code associated with the error. default: 500 type: object required: - error title: ErrorResponse AccessLevel: type: string enum: - read - write - manage - owner title: AccessLevel description: |- A named bundle of Ranger access types. Data targets use all four. Storage locations (``url``) use only READ and WRITE. The access types behind each level are resolved against the live service-def, so a level never sends a type Ranger doesn't know. DataTarget: properties: kind: type: string const: data title: Kind default: data catalog: type: string minLength: 1 title: Catalog description: Catalog (or database). schema: anyOf: - type: string - type: 'null' title: Schema description: Schema; blank or '*' for every schema in the catalog. table: anyOf: - type: string - type: 'null' title: Table description: Table; blank or '*' for every table. columns: items: type: string type: array title: Columns description: Columns; empty for every column. type: object required: - catalog title: DataTarget description: A catalog, schema, table or set of columns. Blank levels mean all. StorageTarget: properties: kind: type: string const: storage title: Kind default: storage url: type: string minLength: 1 title: Url description: Storage URL. recursive: type: boolean title: Recursive description: Include everything under this path. default: true type: object required: - url title: StorageTarget description: An object-storage location, e.g. ``s3a://lake/raw/sales/``. TagTarget: properties: kind: type: string const: tag title: Kind default: tag tag: type: string minLength: 1 title: Tag description: Tag name, as in DataHub. type: object required: - tag title: TagTarget description: |- Everything carrying a DataHub tag, through Ranger's tag service. Tags reach Ranger from DataHub via ranger-sync, so a tag grant covers every table and column carrying the tag — now and later. ColumnMask: properties: column: type: string minLength: 1 title: Column mask_type: type: string title: Mask Type description: >- A mask type name from the service-def (e.g. MASK, MASK_SHOW_LAST_4, MASK_HASH, MASK_NULL). default: MASK type: object required: - column title: ColumnMask description: Hide one column's values from the grantees. PolicyDraft: properties: policy_type: type: string enum: - access - mask - row_filter title: Policy Type name: type: string title: Name resources: additionalProperties: items: type: string type: array type: object title: Resources access_types: items: type: string type: array title: Access Types merges_into_existing: type: boolean title: Merges Into Existing default: false type: object required: - policy_type - name - resources - access_types title: PolicyDraft description: One Ranger policy a grant compiles to. AccessChange: properties: principal: type: string title: Principal principal_type: type: string enum: - group - user title: Principal Type before: type: string title: Before description: Effective level before, or 'none'. after: type: string title: After summary: type: string title: Summary description: One plain sentence. type: object required: - principal - principal_type - before - after - summary title: AccessChange description: One line of 'what will change', per principal. securitySchemes: OAuth2AuthorizationCodeBearer: type: oauth2 flows: authorizationCode: scopes: {} authorizationUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth tokenUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token APIKeyHeader: type: apiKey in: header name: Authorization-PSK ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.