Skip to main content

Privileges

Privileges are the table-level access control in Centia.io. A sub-user owns its own schema and can do anything there, but has no access to tables in other schemas until a privilege is granted. The super-user can grant read or write on any table, and a sub-user can grant privileges on tables in the schemas it owns, so a team can share a dataset without sharing credentials.

Privileges are enforced everywhere a table is reached: the SQL API, GraphQL, the Feature API, Realtime subscriptions and the OGC services. They answer whether a user may touch a table; to restrict which rows the user sees, combine them with rules. Privileges granted to a group are inherited by its members, as described under groups and inheritance.

Set privileges for a user on a table​

By default, a sub-user has none privilege on tables outside their own schema. Privileges can be set explicitly to none, read, or write.

  • none: The sub-user cannot run statements on the table.
  • read: The sub-user can run select statements on the table.
  • write: The sub-user can run select, insert, update, and delete statements on the table.
Setting a single privilege
PATCH https://api.centia.io/api/v4/schemas/rockhall/inductees/privileges HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

{
    "subuser": "alx",
    "privilege": "write"
}
Setting multiple privileges
PATCH https://api.centia.io/api/v4/schemas/rockhall/inductees/privileges HTTP/1.1
Content-Type: application/json
Authorization: Bearer abc123

[
    {
        "subuser": "alx",
        "privilege": "write"
    },
    {
        "subuser": "slash",
        "privilege": "write"
    }
]

Get privileges​

Request
GET https://api.centia.io/api/v4/schemas/rockhall/inductees/privileges HTTP/1.1
Accept: application/json; charset=utf-8
Authorization: Bearer abc123
Response
[
    {
        "subuser": "alx",
        "privilege": "write"
    },
    {
        "subuser": "slash",
        "privilege": "write"
    }
]