Role statements
CREATE ROLE and DROP ROLE support in the Query API.
Role statements
This page describes statements accepted by the Query API in RawTree Cloud and RawTree BYOC. Its restrictions apply to the API, not to all RawTree SQL. See ClickHouse compatibility and API scope.
Syntax
CREATE ROLE <name> [ON CLUSTER 'default']
DROP ROLE [IF EXISTS] <name> [ON CLUSTER 'default']Clauses
| Clause | Meaning |
|---|---|
IF EXISTS | Make a drop idempotent. |
ON CLUSTER 'default' | Apply the statement to the default cluster. |
Query API behavior
- Supported: Creating and dropping one role per request.
- Not exposed by the Query API:
REVOKE,ALTER ROLE,SET ROLE,CREATE USER, user grants,WITH GRANT OPTION, or role inheritance. - Query API scope: Removing a grant requires dropping and
recreating the role; this API does not expose
REVOKE.
Errors
Error: Unsupported role statement.
Hint:
Use CREATE ROLE <name>, DROP ROLE [IF EXISTS] <name>, or GRANT SELECT/INSERT [(columns)] ON <database>.<table> TO <role>. Only the default cluster is supported; delegation options and user grants are not supported.Examples
Create a role.
CREATE ROLE events_statement_readerDrop the role.
DROP ROLE IF EXISTS events_statement_readerThe parser rejects other clusters.
CREATE ROLE events_other_cluster ON CLUSTER 'other'The parser rejects REVOKE.
REVOKE SELECT ON analytics.events FROM events_statement_readerThe parser rejects ALTER ROLE.
ALTER ROLE events_statement_readerThe parser rejects SET ROLE.
SET ROLE events_statement_readerThe parser rejects CREATE USER.
CREATE USER analytics_userThe parser rejects user grants.
GRANT SELECT ON analytics.events TO USER analytics_userThe parser rejects grant options.
GRANT SELECT ON analytics.events TO events_statement_reader WITH GRANT OPTIONThe parser rejects role inheritance.
GRANT events_parent TO events_statement_reader