Skip to content
Developer Edition runs on one host and does not require a product license file. Need multi-host deployment or performance testing at scale? Explore Enterprise Edition

GRANT

GRANT adds privileges to a user or role in the current service group.

Prerequisites

First connect to the Graph service. Run the command in a GQL client.

  • To grant privileges, you must be the owner of the involved resource objects or the user with the role ADMIN in the service group.
  • When granting to a role, that role must already exist. For more information, see CREATE ROLE.
  • When granting to a user, that user must exist and have joined the current service group. For more information, see Create users and INVITE USER.

Limitations

  • The role that you want to grant privileges to must not be the role ADMIN.
  • The resource object on which you want to grant privileges must not be a temporary graph.
  • USAGE on /default_schema cannot be granted. Every user already has implicit access to this schema.

Direct privileges and role privileges are combined. Prefer grants to roles when managing multiple users. For a complete example, see Configure user access.

A user with ADMIN already has every privilege in the current service group. Directly granting an ordinary privilege to that user does not expand the user's effective access.

Syntax

grant_privileges_command
GRANT action , ON resource_object_type resource_object_reference , TO USER user_name ROLE role_name 

grant_privileges_command ::=
    'GRANT' action (',' action )* ('ON' resource_object_type resource_object_reference (',' resource_object_reference)* )? 'TO'  ( ('USER' user_name) | ( 'ROLE' role_name) )

Parameters

action

The action to grant or revoke. For the actions supported by each resource type, see Grantable actions.

If the action is on a service group or catalog, the action can be granted to users or roles, and you do not need to specify resource_object_type or resource_object_reference in the command.

resource_object_type

The type of resource object that the privilege applies to. Valid values include SCHEMA, GRAPH TYPE, GRAPH, NODE TYPE, EDGE TYPE, NODE PROPERTY, EDGE PROPERTY, and PROCEDURE. For the resource types supported by each action, see Privilege reference.

For more information, see Resource objects.

resource_object_reference

A reference identifies the target resource. Use a name in the current schema or a reference that includes the schema path:

Resource type Reference in the current schema Reference with a schema path
SCHEMA schema_reference schema_reference
GRAPH TYPE and GRAPH graph_type_name
graph_name		 schema_reference/graph_type_name
schema_reference/graph_name
PROCEDURE procedure_name(parameter_type, ...) `schema_reference/procedure_name`(parameter_type, ...)
NODE TYPE and EDGE TYPE graph_name.node_type_name
graph_name.edge_type_name		 schema_reference/graph_name.node_type_name
schema_reference/graph_name.edge_type_name
NODE PROPERTY and EDGE PROPERTY graph_name.node_type_name.node_property_name
graph_name.edge_type_name.edge_property_name		 schema_reference/graph_name.node_type_name.node_property_name
schema_reference/graph_name.edge_type_name.edge_property_name

If multiple UDP signatures have the same name, specify the parameter types. For example:

GRANT EXECUTE ON PROCEDURE `/default_schema/ufoo`(INT) TO ROLE role1
  • Always use schema_reference for a SCHEMA object.
  • For other objects, omit the schema path only when the object is in the current schema. Include schema_reference for objects in another schema. To set or view the current schema, see SESSION SET SCHEMA and SHOW CURRENT_SCHEMA.
  • schema_reference can be the absolute or relative path of the schema. For more information, see CREATE SCHEMA.

user_name

The username receiving the privileges.

role_name

The role receiving the privileges.

Examples

  • Role role1 must exist and user user1 must have joined the service group. See CREATE ROLE to create a role.
  • Current-schema examples use movie from the example dataset. Select the schema where it was loaded first.
  • Before using /my_schema examples, prepare the corresponding objects there or replace the paths with existing object paths.

Grant access to a schema

Grant USAGE directly to a user:

GRANT USAGE ON SCHEMA /my_schema TO USER user1

Alternatively, grant USAGE to a role:

GRANT USAGE ON SCHEMA /my_schema TO ROLE role1

USAGE does not grant privileges on objects in the schema. For example, to allow user1 to query a graph in /my_schema, grant both privileges:

'''
GRANT USAGE ON SCHEMA /my_schema TO USER user1
'''

'''
GRANT MATCH ON GRAPH /my_schema/movie TO USER user1
'''

For more information, see Schema access control.

Grant query access to a graph in the current schema

GRANT MATCH ON GRAPH movie TO ROLE role1

Grant query access to a graph in another schema

GRANT MATCH ON GRAPH /my_schema/movie TO ROLE role1

To access the graph, the role must also have USAGE on /my_schema.

Grant insert and query access to a node type

GRANT INSERT, MATCH ON NODE TYPE movie.Actor TO ROLE role1

Grant query access to a node property

GRANT MATCH ON NODE PROPERTY movie.Actor.name TO ROLE role1