{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Database-Level Access Control for Iceberg Catalog","description":"Learn how to manage database-level permissions for the Iceberg Catalog using the Permission Management API.","siteUrl":"https://docs.treasure.ai","lang":"en-US","jsonLd":{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.treasure.ai/","name":"Treasure AI","url":"https://www.treasure.ai/","logo":"https://www.treasure.ai/hubfs/assets/images/logos/primary-logo.svg"},{"@type":"WebSite","@id":"https://docs.treasure.ai/#website","name":"Treasure AI Documentation","url":"https://docs.treasure.ai/","inLanguage":["en","ja"],"publisher":{"@id":"https://www.treasure.ai/"}}]},"llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"database-level-access-control-for-iceberg-catalog","__idx":0},"children":["Database-Level Access Control for Iceberg Catalog"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This feature is not enabled on accounts by default. Contact Technical Support or your Customer Success representative to enable it."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide explains how to manage database-level permissions for the Iceberg Catalog using the Permission Management API."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Permission Management API controls which users can access Iceberg catalog databases when querying from ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.treasure.ai/products/customer-data-platform/data-workbench"},"children":["Data Workbench"]},". Permissions are managed per-user and are scoped to databases within your TD account."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Scope:"]}," This access control applies only to queries executed via Data Workbench. It does not apply to access from cloud data warehouses (e.g., Databricks, Snowflake) or to Data Workbench databases."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Only ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["admin users"]}," can manage permissions. Regular users can view their own permissions but cannot modify them."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your account must have Iceberg catalog resources provisioned (status: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["active"]},")"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"authentication","__idx":3},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For authentication details and API endpoints by site, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/customer-data-platform/composable-publish/use-iceberg-catalog-api"},"children":["Use Iceberg Catalog Management API"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"permission-model","__idx":4},"children":["Permission Model"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each permission entry has three components:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Values"},"children":["Values"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resource_type"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The type of resource"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DATABASE"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resource_names"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["List of database names"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["td{account_id}_{site}_..."]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]}," (wildcard)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["operation"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access level granted"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FULL"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["WRITE"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"operations","__idx":5},"children":["Operations"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Operation"},"children":["Operation"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"SQL Commands Allowed"},"children":["SQL Commands Allowed"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FULL"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["All operations (SELECT, CREATE TABLE, DML, SHOW, etc.)"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["SELECT, SHOW, information_schema access"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["WRITE"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["CREATE TABLE, CREATE TABLE AS, INSERT, UPDATE, DELETE, SHOW"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"database-naming","__idx":6},"children":["Database Naming"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Example: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["td10000_us01_export"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]}," to grant access to all databases in the account"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can only assign permissions for databases that belong to your own account. Cross-account database names are rejected."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-endpoints","__idx":7},"children":["API Endpoints"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"update-permissions-admin-only","__idx":8},"children":["Update Permissions (Admin Only)"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"PUT /v1/iceberg/catalog/permissions\nAuthorization: TD1 <admin_api_key>\nAccept: application/json\nContent-Type: application/json\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This endpoint ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["replaces"]}," all existing permissions for the target user. To add a permission, you must include all existing permissions in the request along with the new one."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"curl-example","__idx":9},"children":["curl Example"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X PUT \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": 12345,\n    \"permissions\": [\n      {\n        \"resource_type\": \"DATABASE\",\n        \"resource_names\": [\"td10000_us01_export\"],\n        \"operation\": \"READ\"\n      }\n    ]\n  }'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"request-body","__idx":10},"children":["Request Body"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"user_id\": 12345,\n  \"permissions\": [\n    {\n      \"resource_type\": \"DATABASE\",\n      \"resource_names\": [\"td10000_us01_export\"],\n      \"operation\": \"READ\"\n    }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_id"]}," (optional): Target user. Omit to update your own permissions.",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You can find the user ID using the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/apis/td-api/user-api#get-userlist"},"children":["get user list API"]},", for example:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -s -X GET https://api.treasuredata.com/v3/user/list -H \"Authorization: TD1 <api_key>\" | jq -cM '.users[] | [.id, .name]'\n","lang":"sh"},"children":[]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions"]}," (required): Full list of permissions to set."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"response","__idx":11},"children":["Response"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"permissions\": [\n    {\n      \"resource_type\": \"DATABASE\",\n      \"resource_names\": [\"td10000_us01_export\"],\n      \"operation\": \"READ\"\n    }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The response shows permissions after automatic compaction (duplicate/redundant entries are merged)."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"get-permissions","__idx":12},"children":["Get Permissions"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"GET /v1/iceberg/catalog/permissions\nAuthorization: TD1 <your_api_key>\nAccept: application/json\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"curl-example-1","__idx":13},"children":["curl Example"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"# Get your own permissions\ncurl \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <your_api_key>\" \\\n  -H \"Accept: application/json\"\n\n# Get another user's permissions (admin only)\ncurl \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions?user_id=12345\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\"\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"query-parameters","__idx":14},"children":["Query Parameters"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Parameter"},"children":["Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required"},"children":["Required"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["user_id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["No"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Target user ID. Omit to view your own permissions. Admins can view any user."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"response-1","__idx":15},"children":["Response"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"permissions\": [\n    {\n      \"resource_type\": \"DATABASE\",\n      \"resource_names\": [\"td10000_us01_export\"],\n      \"operation\": \"READ\"\n    }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Returns an empty list if the user has no permissions configured."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"common-tasks","__idx":16},"children":["Common Tasks"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"grant-full-access-to-the-export-database","__idx":17},"children":["Grant full access to the export database"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X PUT \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": 12345,\n    \"permissions\": [\n      {\n        \"resource_type\": \"DATABASE\",\n        \"resource_names\": [\"td10000_us01_export\"],\n        \"operation\": \"FULL\"\n      }\n    ]\n  }'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"grant-full-access-using-wildcard","__idx":18},"children":["Grant full access using wildcard"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X PUT \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": 12345,\n    \"permissions\": [\n      {\n        \"resource_type\": \"DATABASE\",\n        \"resource_names\": [\"*\"],\n        \"operation\": \"FULL\"\n      }\n    ]\n  }'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"grant-read-only-access","__idx":19},"children":["Grant read-only access"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X PUT \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": 12345,\n    \"permissions\": [\n      {\n        \"resource_type\": \"DATABASE\",\n        \"resource_names\": [\"td10000_us01_export\"],\n        \"operation\": \"READ\"\n      }\n    ]\n  }'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"grant-write-only-access","__idx":20},"children":["Grant write-only access"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X PUT \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": 12345,\n    \"permissions\": [\n      {\n        \"resource_type\": \"DATABASE\",\n        \"resource_names\": [\"td10000_us01_export\"],\n        \"operation\": \"WRITE\"\n      }\n    ]\n  }'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"revoke-all-permissions","__idx":21},"children":["Revoke all permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send an update with an empty permissions list. This removes all access for the user."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X PUT \"https://api-iceberg-mng.us01.treasuredata.com/v1/iceberg/catalog/permissions\" \\\n  -H \"Authorization: TD1 <admin_api_key>\" \\\n  -H \"Accept: application/json\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"user_id\": 12345,\n    \"permissions\": []\n  }'\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"add-a-permission-without-removing-existing-ones","__idx":22},"children":["Add a permission without removing existing ones"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["First, GET the user's current permissions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add the new permission entry to the list."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["PUT the combined list back."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"automatic-permission-compaction","__idx":23},"children":["Automatic Permission Compaction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The API automatically merges redundant permissions on write:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Input"},"children":["Input"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Result"},"children":["Result"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FULL(*)"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ(td10000_us01_export)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FULL(*)"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ(*)"]}," + ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ(td10000_us01_export)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ(*)"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"error-responses","__idx":24},"children":["Error Responses"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Status"},"children":["Status"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Meaning"},"children":["Meaning"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["400"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Invalid database name format"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["403"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Non-admin attempting to manage permissions, or write-only API key"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["404"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Target user not found or does not belong to your account"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["422"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Validation error (e.g., empty ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["resource_names"]}," array)"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"permission-evaluation","__idx":25},"children":["Permission Evaluation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When a user runs a query, their permissions are evaluated as follows:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permissions are combined disjunctively (union/OR logic)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If any permission grants access to the requested database and operation, access is allowed"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Wildcard (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]},") matches all databases in the account"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FULL"]}," permission implies both ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["READ"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["WRITE"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Users with no permissions have no access to any database"]}]}]},"headings":[{"value":"Database-Level Access Control for Iceberg Catalog","id":"database-level-access-control-for-iceberg-catalog","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Authentication","id":"authentication","depth":2},{"value":"Permission Model","id":"permission-model","depth":2},{"value":"Operations","id":"operations","depth":3},{"value":"Database Naming","id":"database-naming","depth":3},{"value":"API Endpoints","id":"api-endpoints","depth":2},{"value":"Update Permissions (Admin Only)","id":"update-permissions-admin-only","depth":3},{"value":"curl Example","id":"curl-example","depth":4},{"value":"Request Body","id":"request-body","depth":4},{"value":"Response","id":"response","depth":4},{"value":"Get Permissions","id":"get-permissions","depth":3},{"value":"curl Example","id":"curl-example-1","depth":4},{"value":"Query Parameters","id":"query-parameters","depth":4},{"value":"Response","id":"response-1","depth":4},{"value":"Common Tasks","id":"common-tasks","depth":2},{"value":"Grant full access to the export database","id":"grant-full-access-to-the-export-database","depth":3},{"value":"Grant full access using wildcard","id":"grant-full-access-using-wildcard","depth":3},{"value":"Grant read-only access","id":"grant-read-only-access","depth":3},{"value":"Grant write-only access","id":"grant-write-only-access","depth":3},{"value":"Revoke all permissions","id":"revoke-all-permissions","depth":3},{"value":"Add a permission without removing existing ones","id":"add-a-permission-without-removing-existing-ones","depth":3},{"value":"Automatic Permission Compaction","id":"automatic-permission-compaction","depth":2},{"value":"Error Responses","id":"error-responses","depth":2},{"value":"Permission Evaluation","id":"permission-evaluation","depth":2}],"frontmatter":{"seo":{"title":"Database-Level Access Control for Iceberg Catalog","description":"Learn how to manage database-level permissions for the Iceberg Catalog using the Permission Management API."}},"lastModified":"2026-07-27T01:39:14.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/customer-data-platform/composable-publish/permission-management","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}