curl --request POST \
--url https://api.example.com/api/govern/data-access/grants/preview \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": [
"<string>"
]
},
"groups": [
"<string>"
],
"users": [
"<string>"
],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
'import requests
url = "https://api.example.com/api/govern/data-access/grants/preview"
payload = {
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": ["<string>"]
},
"groups": ["<string>"],
"users": ["<string>"],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
target: {
catalog: '<string>',
kind: 'data',
schema: '<string>',
table: '<string>',
columns: ['<string>']
},
groups: ['<string>'],
users: ['<string>'],
masks: [{column: '<string>', mask_type: 'MASK'}],
row_filter: '<string>',
tag_mask_type: '<string>',
description: ''
})
};
fetch('https://api.example.com/api/govern/data-access/grants/preview', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/grants/preview",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'target' => [
'catalog' => '<string>',
'kind' => 'data',
'schema' => '<string>',
'table' => '<string>',
'columns' => [
'<string>'
]
],
'groups' => [
'<string>'
],
'users' => [
'<string>'
],
'masks' => [
[
'column' => '<string>',
'mask_type' => 'MASK'
]
],
'row_filter' => '<string>',
'tag_mask_type' => '<string>',
'description' => ''
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/grants/preview"
payload := strings.NewReader("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/govern/data-access/grants/preview")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/grants/preview")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}"
response = http.request(request)
puts response.read_body{
"target_label": "<string>",
"policies": [
{
"policy_type": "access",
"name": "<string>",
"resources": {},
"access_types": [
"<string>"
],
"merges_into_existing": false
}
],
"changes": [
{
"principal": "<string>",
"principal_type": "group",
"before": "<string>",
"after": "<string>",
"summary": "<string>"
}
],
"warnings": [
"<string>"
]
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Preview a grant: the policies it writes and whose access changes
Compiles the grant into Ranger policies (access, plus a mask policy per masked column and a row-filter policy), marks those that merge into an existing policy, and shows each named group or user’s level before and after, with warnings. A tag target compiles to tag-service policies (409 when no tag service is linked). Writes nothing.
curl --request POST \
--url https://api.example.com/api/govern/data-access/grants/preview \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": [
"<string>"
]
},
"groups": [
"<string>"
],
"users": [
"<string>"
],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
'import requests
url = "https://api.example.com/api/govern/data-access/grants/preview"
payload = {
"target": {
"catalog": "<string>",
"kind": "data",
"schema": "<string>",
"table": "<string>",
"columns": ["<string>"]
},
"groups": ["<string>"],
"users": ["<string>"],
"masks": [
{
"column": "<string>",
"mask_type": "MASK"
}
],
"row_filter": "<string>",
"tag_mask_type": "<string>",
"description": ""
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
target: {
catalog: '<string>',
kind: 'data',
schema: '<string>',
table: '<string>',
columns: ['<string>']
},
groups: ['<string>'],
users: ['<string>'],
masks: [{column: '<string>', mask_type: 'MASK'}],
row_filter: '<string>',
tag_mask_type: '<string>',
description: ''
})
};
fetch('https://api.example.com/api/govern/data-access/grants/preview', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/grants/preview",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'target' => [
'catalog' => '<string>',
'kind' => 'data',
'schema' => '<string>',
'table' => '<string>',
'columns' => [
'<string>'
]
],
'groups' => [
'<string>'
],
'users' => [
'<string>'
],
'masks' => [
[
'column' => '<string>',
'mask_type' => 'MASK'
]
],
'row_filter' => '<string>',
'tag_mask_type' => '<string>',
'description' => ''
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/grants/preview"
payload := strings.NewReader("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/govern/data-access/grants/preview")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/grants/preview")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"target\": {\n \"catalog\": \"<string>\",\n \"kind\": \"data\",\n \"schema\": \"<string>\",\n \"table\": \"<string>\",\n \"columns\": [\n \"<string>\"\n ]\n },\n \"groups\": [\n \"<string>\"\n ],\n \"users\": [\n \"<string>\"\n ],\n \"masks\": [\n {\n \"column\": \"<string>\",\n \"mask_type\": \"MASK\"\n }\n ],\n \"row_filter\": \"<string>\",\n \"tag_mask_type\": \"<string>\",\n \"description\": \"\"\n}"
response = http.request(request)
puts response.read_body{
"target_label": "<string>",
"policies": [
{
"policy_type": "access",
"name": "<string>",
"resources": {},
"access_types": [
"<string>"
],
"merges_into_existing": false
}
],
"changes": [
{
"principal": "<string>",
"principal_type": "group",
"before": "<string>",
"after": "<string>",
"summary": "<string>"
}
],
"warnings": [
"<string>"
]
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Body
Who gets what access on what, with optional conditions.
A named bundle of Ranger access types.
Data targets use all four. Storage locations (url) use only READ
and WRITE. The access types behind each level are resolved against the
live service-def, so a level never sends a type Ranger doesn't know.
read, write, manage, owner A catalog, schema, table or set of columns. Blank levels mean all.
- DataTarget
- StorageTarget
- TagTarget
Show child attributes
Show child attributes
Data targets on one table only. Not allowed on storage.
Show child attributes
Show child attributes
SQL predicate appended as WHERE. Data targets on one table only.
Tag targets only: hide every column carrying the tag with this mask type (e.g. MASK, MASK_HASH).
Was this page helpful?

