Source: https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-privileges/
Documentation version: v5.3.2

# SHOW PRIVILEGES command

The SHOW PRIVILEGES command returns information about the privileges that are contained in a specific role or the privileges that are granted to the current user or a specific user.

Important

This command displays stored direct grants and grants from the user's roles. It does not expand capabilities provided implicitly by `ADMIN`, resource ownership, actions on parent resources, or `/default_schema` into privilege records for every resource. Therefore, the result is not a complete list of the user's effective privileges. Verify access by also using [SHOW ROLES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-roles/), [SHOW OBJECTS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-objects/), and actual operations performed as the target user.

The following table describes the returned columns:

 | Column | Description
 | `role` | The name of the role that contains the privilege. This field is empty if the privilege is not contained in any role.
 | `type` | The type of resource object that the privilege applies to.
 | `object` | The parent reference and name of the resource object that the privilege applies to.
 | `actions` | The actions that the privilege allows.

## Prerequisites

- Any user can query their own privileges or the privileges contained in a specified role.
- To query privileges granted to another user, the current user must have `ADMIN`.

## Syntax

diagramsource

 show_privileges_command  

````
show_privileges_command ::=
    'SHOW' 'PRIVILEGES'  ('FOR' ( ('USER' user_name) | ('ROLE' role_name) ) )?

````

## Parameters

### `FOR`

Specifies whether to query the privileges granted to a specific user or the privileges contained in a specific role.

If the FOR clause is not specified, the command queries the privileges granted to the current user by default.

### `user_name`

The name of the user whose privileges you want to query. To list users who have joined the current service group, use [SHOW USERS](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-users/).

If the user has the role `ADMIN` of the current service group, the user has all privileges in that service group. These privileges are not listed in the result of this command.

### `role_name`

The name of the role that contains the privileges you want to query.

To query all roles in the current service group, use [SHOW ALL ROLES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-all-roles/). To query the roles granted to a specific user, use [SHOW ROLES](https://dev-docs.nebula-graph.io/v5.3.2/database-gql-reference/data-admin/show/show-roles/).

## Examples

### Query privileges granted to a specific user

````
SHOW PRIVILEGES FOR USER user1

````

Return:

````
+------+---------+-----------------------+-----------+
| role | type    | object                | actions   |
+------+---------+-----------------------+-----------+
|      | GRAPH   | /default_schema/movie | [MATCH]   |
|      | SVCGRP  | CURRENT_SVCGRP        | [CONNECT] |
+------+---------+-----------------------+-----------+

````

### Query privileges contained in a specific role

````
SHOW PRIVILEGES FOR ROLE role1

````

Return:

````
+-------+-----------+-----------------------------+----------------+
| role  | type      | object                      | actions        |
+-------+-----------+-----------------------------+----------------+
| role1 | NODE_TYPE | /default_schema/movie.Actor | [MATCH,INSERT] |
| role1 | GRAPH     | /default_schema/movie       | [MATCH]        |
+-------+-----------+-----------------------------+----------------+

````