Grant statements
Grant table and column privileges to a RawTree database role.
Grant statements
This page describes statements accepted by the Query API in RawTree Cloud and RawTree BYOC. Its restrictions apply to the API, not to all RawTree SQL. See ClickHouse compatibility and API scope.
Syntax
GRANT [ON CLUSTER 'default'] SELECT|INSERT [(<column>, ...)]
ON <database>.<table>|<database>.*|*.* TO <role>Clauses
| Clause | Meaning |
|---|---|
SELECT | Read rows from the target. |
INSERT | Insert rows into the target. |
| Column list | Restrict the grant to named columns. |
ON CLUSTER 'default' | Apply the grant to the default cluster. |
Query API behavior
- Supported: One
GRANTfor one existing role per request, with table, database wildcard, or cluster wildcard targets. - Not exposed by the Query API:
REVOKE, user targets, role inheritance, andWITH GRANT OPTION. - Query API scope: This bounded API grammar accepts one role target and only the default cluster.
Errors
Error: Unsupported role statement.
Hint:
Use CREATE ROLE <name>, DROP ROLE [IF EXISTS] <name>, or GRANT SELECT/INSERT [(columns)] ON <database>.<table> TO <role>. Only the default cluster is supported; delegation options and user grants are not supported.Examples
Create a role for the grant.
CREATE ROLE events_grant_readerGrant SELECT on the event table.
GRANT SELECT ON analytics.events TO events_grant_readerDrop the role when it no longer needs the grant.
DROP ROLE IF EXISTS events_grant_readerThe parser rejects REVOKE.
REVOKE SELECT ON analytics.events FROM events_grant_readerThe parser rejects user grants.
GRANT SELECT ON analytics.events TO USER analytics_userThe parser rejects role inheritance.
GRANT events_parent TO events_grant_readerThe parser rejects grant options.
GRANT SELECT ON analytics.events TO events_grant_reader WITH GRANT OPTIONThe parser rejects clusters other than default.
GRANT ON CLUSTER 'other' SELECT ON analytics.events TO events_grant_reader