Skip to content
Developer Edition runs on one host and does not require a product license file. Need multi-host deployment or performance testing at scale? Explore Enterprise Edition

REVOKE

REVOKE removes privileges granted to a user or role in the current service group.

Prerequisites

First connect to the Graph service. Run the command in a GQL client.

To revoke privileges from a user or role, you must be the owner of the involved resource objects or the user with the role ADMIN in the service group.

Limitations

  • The role that you want to revoke privileges from must not be the role ADMIN.
  • The resource object on which you want to revoke privileges must not be a temporary graph.
  • USAGE on /default_schema cannot be revoked.
  • A schema owner cannot revoke their own implicit USAGE on the schema.

REVOKE removes only the privilege records on the user or role specified in the command. The user might still be able to perform the operation if another role, a direct grant, ownership, or a privilege on a parent resource provides the same privilege.

A user with ADMIN always has every privilege in the current service group. Revoking an ordinary direct privilege from that user does not reduce the user's effective access.

Syntax

revoke_privileges_command
REVOKE action , ON resource_object_type resource_object_reference , FROM USER user_name ROLE role_name 

revoke_privileges_command ::=
    'REVOKE' action (',' action )* ('ON' resource_object_type resource_object_reference (',' resource_object_reference)* )? 'FROM' ( ('USER' user_name) | ( 'ROLE' role_name) )

Parameters

action

The action to grant or revoke. For the actions supported by each resource type, see Grantable actions.

If the action is on a service group or catalog, you do not need to specify resource_object_type or resource_object_reference.

resource_object_type

The type of resource object whose privileges you want to revoke. Valid values include SCHEMA, GRAPH TYPE, GRAPH, NODE TYPE, EDGE TYPE, NODE PROPERTY, EDGE PROPERTY, and PROCEDURE. For the resource types supported by each action, see Privilege reference.

For more information, see Resource objects.

resource_object_reference

A reference identifies the target resource. Use a name in the current schema or a reference that includes the schema path:

Resource type Reference in the current schema Reference with a schema path
SCHEMA schema_reference schema_reference
GRAPH TYPE and GRAPH graph_type_name
graph_name		 schema_reference/graph_type_name
schema_reference/graph_name
PROCEDURE procedure_name(parameter_type, ...) `schema_reference/procedure_name`(parameter_type, ...)
NODE TYPE and EDGE TYPE graph_name.node_type_name
graph_name.edge_type_name		 schema_reference/graph_name.node_type_name
schema_reference/graph_name.edge_type_name
NODE PROPERTY and EDGE PROPERTY graph_name.node_type_name.node_property_name
graph_name.edge_type_name.edge_property_name		 schema_reference/graph_name.node_type_name.node_property_name
schema_reference/graph_name.edge_type_name.edge_property_name

If multiple UDP signatures have the same name, specify the parameter types. For example:

REVOKE EXECUTE ON PROCEDURE `/default_schema/ufoo`(INT) FROM ROLE role1
  • Always use schema_reference for a SCHEMA object.
  • For other objects, omit the schema path only when the object is in the current schema. Include schema_reference for objects in another schema. To set or view the current schema, see SESSION SET SCHEMA and SHOW CURRENT_SCHEMA.
  • schema_reference can be the absolute or relative path of the schema. For more information, see CREATE SCHEMA.

user_name

The username whose privileges are revoked.

role_name

The role whose privileges are revoked.

Examples

  • Role role1 must exist and user user1 must have joined the service group. See CREATE ROLE to create a role.
  • Current-schema examples use movie from the example dataset. Select the schema where it was loaded first.
  • Before using /my_schema examples, prepare the corresponding objects there or replace the paths with existing object paths.

Revoke access to a schema

Revoke USAGE from a user:

REVOKE USAGE ON SCHEMA /my_schema FROM USER user1

Alternatively, revoke it from a role:

REVOKE USAGE ON SCHEMA /my_schema FROM ROLE role1

Revoking USAGE prevents the affected user from accessing the schema but does not remove privileges or ownership on objects in the schema. If USAGE is granted again, unchanged object privileges become usable again. For more information, see Schema access control.

Revoke query access to a graph in the current schema

REVOKE MATCH ON GRAPH movie FROM ROLE role1

Revoke query access to a graph in another schema

REVOKE MATCH ON GRAPH /my_schema/movie FROM ROLE role1

Revoke insert and query access to a node type

REVOKE MATCH, INSERT ON NODE TYPE movie.Actor FROM ROLE role1

Revoke query access to a node property

REVOKE MATCH ON NODE PROPERTY movie.Actor.name FROM ROLE role1