curl --request GET \
--url https://api.example.com/api/govern/data-access/access \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.example.com/api/govern/data-access/access"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.example.com/api/govern/data-access/access', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/access",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/access"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/api/govern/data-access/access")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/access")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"resource_label": "<string>",
"target_kind": "data",
"principals": [
{
"principal": "<string>",
"principal_type": "group",
"level": "<string>",
"access_types": [
"<string>"
],
"denied_access_types": [
"<string>"
],
"partial_denies": [
{}
],
"masked_columns": [
"<string>"
],
"masks": [
{}
],
"row_filter": "<string>",
"sources": [
{}
],
"inherited": false,
"has_exceptions": false,
"partial": false,
"delegate_admin": false
}
],
"policy_count": 123,
"warnings": [
"<string>"
],
"super_admins": [
"<string>"
]
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Show who has access to a table, schema, catalog, storage location or tag
Pass catalog (with optional schema, table and columns) for data, url for a storage location, or tag for access granted through the Ranger tag service. Returns each group, user and Ranger role’s effective level, masked columns, row filter and the policies it comes from. A table also includes tag policies on the tags it and its columns carry in DataHub (match: "tag", via_tag). Worked out from the policies, not by Ranger’s evaluator; warnings says what couldn’t be checked.
curl --request GET \
--url https://api.example.com/api/govern/data-access/access \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.example.com/api/govern/data-access/access"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.example.com/api/govern/data-access/access', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/govern/data-access/access",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/govern/data-access/access"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/api/govern/data-access/access")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/govern/data-access/access")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"resource_label": "<string>",
"target_kind": "data",
"principals": [
{
"principal": "<string>",
"principal_type": "group",
"level": "<string>",
"access_types": [
"<string>"
],
"denied_access_types": [
"<string>"
],
"partial_denies": [
{}
],
"masked_columns": [
"<string>"
],
"masks": [
{}
],
"row_filter": "<string>",
"sources": [
{}
],
"inherited": false,
"has_exceptions": false,
"partial": false,
"delegate_admin": false
}
],
"policy_count": 123,
"warnings": [
"<string>"
],
"super_admins": [
"<string>"
]
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}{
"error": "<string>",
"code": 500
}Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Query Parameters
Catalog (or database) for a data target.
Schema. Omit for the whole catalog.
Table. Omit for the whole schema.
Comma-separated columns. Omit for all.
Storage URL, e.g. s3a://lake/raw/.
For a URL: include everything under it.
A tag: access through the tag service.
Response
Successful Response
data, storage, tag Show child attributes
Show child attributes
What couldn't be checked, e.g. tag-based access when DataHub is unreachable.
The Ranger service's super users and groups (e.g. trino-admin). Ranger gives them every permission everywhere, whatever the policies say, so they aren't listed as principals.
Was this page helpful?

