# Grant statements (/docs/reference/sql/statements/grant)



Grant statements [#grant-statements]

This page describes statements accepted by the Query API in RawTree Cloud
and RawTree BYOC. Its restrictions apply to the API, not to all RawTree SQL.
See [ClickHouse compatibility and API scope](/docs/reference/clickhouse-compatibility).

Syntax [#syntax]

```sql
GRANT [ON CLUSTER 'default'] SELECT|INSERT [(<column>, ...)]
ON <database>.<table>|<database>.*|*.* TO <role>
```

Clauses [#clauses]

| Clause                 | Meaning                                 |
| ---------------------- | --------------------------------------- |
| `SELECT`               | Read rows from the target.              |
| `INSERT`               | Insert rows into the target.            |
| Column list            | Restrict the grant to named columns.    |
| `ON CLUSTER 'default'` | Apply the grant to the default cluster. |

<a id="rawtree-behavior" />

Query API behavior [#query-api-behavior]

* **Supported:** One `GRANT` for one existing role per request, with table,
  database wildcard, or cluster wildcard targets.
* **Not exposed by the Query API:** `REVOKE`, user targets, role inheritance, and `WITH GRANT
  OPTION`.
* **Query API scope:** This bounded API grammar accepts one role
  target and only the default cluster.

Errors [#errors]

Error: `Unsupported role statement.`

Hint:

```text
Use CREATE ROLE <name>, DROP ROLE [IF EXISTS] <name>, or GRANT SELECT/INSERT [(columns)] ON <database>.<table> TO <role>. Only the default cluster is supported; delegation options and user grants are not supported.
```

Examples [#examples]

Create a role for the grant.

```sql test
CREATE ROLE events_grant_reader
```

Grant `SELECT` on the event table.

```sql test known-failure="GRANT returns code 497 after access repair (local stack)"
GRANT SELECT ON analytics.events TO events_grant_reader
```

Drop the role when it no longer needs the grant.

```sql
DROP ROLE IF EXISTS events_grant_reader
```

The parser rejects `REVOKE`.

```sql test expect-error="Unsupported query."
REVOKE SELECT ON analytics.events FROM events_grant_reader
```

The parser rejects user grants.

```sql test expect-error="Unsupported role statement."
GRANT SELECT ON analytics.events TO USER analytics_user
```

The parser rejects role inheritance.

```sql test expect-error="Unsupported role statement."
GRANT events_parent TO events_grant_reader
```

The parser rejects grant options.

```sql test expect-error="Unsupported role statement."
GRANT SELECT ON analytics.events TO events_grant_reader WITH GRANT OPTION
```

The parser rejects clusters other than `default`.

```sql test expect-error="Unsupported role statement."
GRANT ON CLUSTER 'other' SELECT ON analytics.events TO events_grant_reader
```

Related [#related]

* [Role statements](./role)
* [Restrict an API key](/docs/guides/secure/restrict-api-key-access)