Validate data privileges¶

Check whether data-access privilege changes for a role can be applied without modifying grants. After changing a request from the validation result, apply it separately.

HTTP
POST $CLOUDSIGMA_API_BASE/workspaces/{workspace_id}/iam/roles/{role_id}/data-privileges:validate

Before you call this API¶

Configure the regional API endpoint and authentication, and select the target workspace.

First select a role, then view data privileges and prepare the change to validate from the latest grant state.

Request parameters¶

Input examples

Shell
curl -X POST "$CLOUDSIGMA_API_BASE/workspaces/$WORKSPACE_ID/iam/roles/$ROLE_ID/data-privileges:validate" -H "X-API-Key: $CLOUDSIGMA_API_KEY" -H "X-Workspace-ID: $WORKSPACE_ID" -H "Content-Type: application/json" -d '{"request_id":"req-001","expected_data_privilege_version":1,"mutations":[{"operation":"grant","action_id":"table.query","resource_type":"table","resource_id":"table-001","privilege":"select","with_grant_option":false}]}'

Parameter description

Path parameters

Parameter	Type	Required	Description
`workspace_id`	string	Yes	Target workspace ID.
`role_id`	string	Yes	Role ID whose data privileges are validated.

Request body

Parameter	Type	Required	Description
`request_id`	string	Yes	Caller-generated request ID.
`expected_data_privilege_version`	integer	No	Data-privilege version for concurrency checks; cannot be less than 0.
`mutations`	object array	Yes	Privilege changes to validate; must contain at least one item.
`mutations[].operation`	string	Yes	Change type: `grant` or `revoke`.
`mutations[].action_id`	string	Yes	Data action ID in the permission schema.
`mutations[].resource_type`	string	Yes	Resource type: `database` or `table`.
`mutations[].resource_id`	string	Yes	Database or table resource ID.
`mutations[].privilege`	string	Yes	OmniFabric privilege name.
`mutations[].with_grant_option`	boolean	No	Whether the target role can grant this privilege onward.
`mutations[].row_column`	object	No	Table row/column rule, submitted only to set, clear, or retain one.
`mutations[].row_column.mode`	string	Yes	Rule handling: `keep`, `set`, or `clear`.
`mutations[].row_column.draft`	object	No	Rule submitted when `mode` is `set`.

Successful response¶

Returns the validation conclusion. When request format is valid but the privilege draft is invalid, this endpoint can still return 200; then data.valid is false and data.errors identifies field paths.

Response example

JSON
{"code":"OK","msg":"OK","data":{"valid":true,"errors":[],"warnings":[],"payload_fingerprint":"sha256:example","request_id":"req-001","trace_id":"trace-001"}}

Field details

Field	Type	Description
`code`	string	`OK` on success.
`msg`	string	`OK` on success.
`data.valid`	boolean	Whether the privilege changes pass validation.
`data.errors`	object array	Validation errors, each with an error code and field path.
`data.warnings`	string array	Warnings that do not block submission.
`data.payload_fingerprint`	string	Fingerprint of normalized request content.
`data.request_id`	string	Request correlation ID.
`data.trace_id`	string	Trace ID.

Error response¶

Response example

JSON
{"code":"ErrParamInvalid","msg":"Invalid request parameters","data":null}

Field details

Field	Type	Description
`code`	string	Error code.
`msg`	string	Error message.
`data`	null	—

Last updated on Sep 15, 2026