> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Check what a user can do

> Find out whether a user can read or change data, a storage location, or a tag, and why not if they can't.

Select one user, one access level, and data, a storage location, or a tag. NexusOne then answers one question
with yes or no, can this user do that?

If the answer is no, then NexusOne explains why and suggests how to fix it. Use this check to find out why
a user can't do something.

> [!NOTE]
>
> In Data Access, **Data** means the catalogs, schemas, tables, and columns in the NexusOne catalog.
> A **storage location** is a path in an object storage bucket, which holds files.

## Prerequisites

Before starting this task, ensure you have the following:

Required roles: `nx1_migration_admin`, `nx1_migration_ops`, or `nx1_migration_user`.

## Check what a user can do

> [tab] Web portal
>
> Perform these steps to check what a user can do.
>
> 1. Log in to NexusOne.
>
> 2. On the top navigation bar, hover your mouse over **Govern** and then select **Data Access**.
>
> 3. Click the **Check access** tab.
>
> 4. In the **User** field, select the user.
>
> 5. In the **Can they** field, select the access level to check. For what each level includes, refer to
>    [Access levels](https://docs.nx1cloud.com/documentation/govern/overview.md#access-levels).
>
> 6. Select what to check:
>
>    * **Data**: Select the catalog, and optionally the schema and table.
>    * **Storage location**: Select a bucket to fill in the **Location** field, or enter the path in the **Location** field.
>    * **Tag**: Select the tag. This option appears only when a Ranger tag service is linked to NexusOne.
>
> 7. Click **Check**. The result shows **Yes** or **No**.
>
> 8. If the result is **No**, then a **Why not** section appears below the **No** result. Review the following:
>
>    * **Why not**: The reasons the user doesn't have the access.
>    * **Who has this access here**: The roles and users that do have it. This appears only when someone has it.
>    * **Ways to fix it**: Suggested fixes. This appears only when NexusOne has a suggestion. If you can grant
>      access, then a fix can open the **Grant access** tab with the grant filled in.
>
> 9. Optional: If you have the `nx1_audit_viewer` role, then a **Recent decisions** section appears below the
>    result. It shows what Ranger decided when the user actually used this resource:
>
>    * **Access**: The access the user asked for.
>    * **Policy**: The policy that decided the result.
>    * **Resource**: The resource the user used.
>    * **Result**: **Allowed** or **Denied**.
>    * **Time**: When the user used the resource.
>
>    To see more, click **Open in Audit**. This opens the **Audit** page under **Govern** in NexusOne, filtered to
>    this user and resource.

> [tab] REST API
>
> Use the following API endpoint to
> [check whether a user has a level of access](https://docs.nx1cloud.com/api-reference/endpoints/data-access/check-whether-a-user-has-a-level-of-access-to-a-target.md)
> to data, a storage location, or a tag.

## Additional resources

* For an overview of the Govern feature, refer to [Govern Overview](https://docs.nx1cloud.com/documentation/govern/overview.md).
* To see the policies that decide the result, refer to [View all policies](https://docs.nx1cloud.com/documentation/govern/tasks/data-access/ranger-policy/view-all-policies.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.