> ## Documentation Index > Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Show who has access to a table, schema, catalog, storage location or tag > Pass `catalog` (with optional `schema`, `table` and `columns`) for data, `url` for a storage location, or `tag` for access granted through the Ranger tag service. Returns each group, user and Ranger role's effective level, masked columns, row filter and the policies it comes from. A table also includes tag policies on the tags it and its columns carry in DataHub (`match: "tag"`, `via_tag`). Worked out from the policies, not by Ranger's evaluator; `warnings` says what couldn't be checked. ## OpenAPI ````yaml get /api/govern/data-access/access openapi: 3.1.0 info: title: Nx1 AI API description: | AI API for Nx1 Data Platform Management and Automated Data Tasks. Authentication is required via PSK in Authorization header. Default PSK is | [ask a friend] | version: 0.10.2 servers: [] security: [] paths: /api/govern/data-access/access: get: tags: - Data access summary: Show who has access to a table, schema, catalog, storage location or tag description: >- Pass `catalog` (with optional `schema`, `table` and `columns`) for data, `url` for a storage location, or `tag` for access granted through the Ranger tag service. Returns each group, user and Ranger role's effective level, masked columns, row filter and the policies it comes from. A table also includes tag policies on the tags it and its columns carry in DataHub (`match: "tag"`, `via_tag`). Worked out from the policies, not by Ranger's evaluator; `warnings` says what couldn't be checked. operationId: get_resource_access_api_govern_data_access_access_get parameters: - name: catalog in: query required: false schema: anyOf: - type: string - type: 'null' description: Catalog (or database) for a data target. title: Catalog description: Catalog (or database) for a data target. - name: schema in: query required: false schema: anyOf: - type: string - type: 'null' description: Schema. Omit for the whole catalog. title: Schema description: Schema. Omit for the whole catalog. - name: table in: query required: false schema: anyOf: - type: string - type: 'null' description: Table. Omit for the whole schema. title: Table description: Table. Omit for the whole schema. - name: columns in: query required: false schema: anyOf: - type: string - type: 'null' description: Comma-separated columns. Omit for all. title: Columns description: Comma-separated columns. Omit for all. - name: url in: query required: false schema: anyOf: - type: string - type: 'null' description: Storage URL, e.g. s3a://lake/raw/. title: Url description: Storage URL, e.g. s3a://lake/raw/. - name: recursive in: query required: false schema: type: boolean description: 'For a URL: include everything under it.' default: true title: Recursive description: 'For a URL: include everything under it.' - name: tag in: query required: false schema: anyOf: - type: string - type: 'null' description: 'A tag: access through the tag service.' title: Tag description: 'A tag: access through the tag service.' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ResourceAccessResponse' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Conflict '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unprocessable Content '502': description: Bad Gateway content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '503': description: Service Unavailable content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - OAuth2AuthorizationCodeBearer: [] - APIKeyHeader: [] components: schemas: ResourceAccessResponse: properties: resource_label: type: string title: Resource Label target_kind: type: string enum: - data - storage - tag title: Target Kind principals: items: $ref: '#/components/schemas/PrincipalAccess' type: array title: Principals policy_count: type: integer title: Policy Count warnings: items: type: string type: array title: Warnings description: >- What couldn't be checked, e.g. tag-based access when DataHub is unreachable. super_admins: items: type: string type: array title: Super Admins description: >- The Ranger service's super users and groups (e.g. trino-admin). Ranger gives them every permission everywhere, whatever the policies say, so they aren't listed as principals. type: object required: - resource_label - target_kind - principals - policy_count title: ResourceAccessResponse ErrorResponse: properties: error: type: string title: Error description: A brief description of the error that occurred. code: type: integer title: Code description: The HTTP status code associated with the error. default: 500 type: object required: - error title: ErrorResponse PrincipalAccess: properties: principal: type: string title: Principal principal_type: type: string enum: - group - user - role title: Principal Type level: type: string title: Level access_types: items: type: string type: array title: Access Types denied_access_types: items: type: string type: array title: Denied Access Types description: Types a deny item takes away. partial_denies: items: additionalProperties: true type: object type: array title: Partial Denies description: >- Denies on part of the resource: access_types, on (e.g. 'columns email, ssn'), policy_id, policy_name. masked_columns: items: type: string type: array title: Masked Columns masks: items: additionalProperties: true type: object type: array title: Masks description: column, mask_type, policy_id per mask that applies. row_filter: anyOf: - type: string - type: 'null' title: Row Filter sources: items: additionalProperties: true type: object type: array title: Sources inherited: type: boolean title: Inherited description: Only broader policies grant it. default: false has_exceptions: type: boolean title: Has Exceptions description: >- An exception item names this principal; the level may be narrower in practice. default: false partial: type: boolean title: Partial description: >- The level comes only from policies on part of the resource (some tables, columns or sub-folders), not all of it. default: false delegate_admin: type: boolean title: Delegate Admin description: May grant this access to others. default: false type: object required: - principal - principal_type - level - access_types title: PrincipalAccess description: Effective access of one group or user on a resource. securitySchemes: OAuth2AuthorizationCodeBearer: type: oauth2 flows: authorizationCode: scopes: {} authorizationUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/auth tokenUrl: >- https://sso-rapid.rapid.nx1cloud.com/realms/rapid/protocol/openid-connect/token APIKeyHeader: type: apiKey in: header name: Authorization-PSK ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.