# Role statements (/docs/reference/sql/statements/role)



Role statements [#role-statements]

This page describes statements accepted by the Query API in RawTree Cloud
and RawTree BYOC. Its restrictions apply to the API, not to all RawTree SQL.
See [ClickHouse compatibility and API scope](/docs/reference/clickhouse-compatibility).

Syntax [#syntax]

```sql
CREATE ROLE <name> [ON CLUSTER 'default']
DROP ROLE [IF EXISTS] <name> [ON CLUSTER 'default']
```

Clauses [#clauses]

| Clause                 | Meaning                                     |
| ---------------------- | ------------------------------------------- |
| `IF EXISTS`            | Make a drop idempotent.                     |
| `ON CLUSTER 'default'` | Apply the statement to the default cluster. |

<a id="rawtree-behavior" />

Query API behavior [#query-api-behavior]

* **Supported:** Creating and dropping one role per request.
* **Not exposed by the Query API:** `REVOKE`, `ALTER ROLE`, `SET ROLE`, `CREATE USER`, user
  grants, `WITH GRANT OPTION`, or role inheritance.
* **Query API scope:** Removing a grant requires dropping and
  recreating the role; this API does not expose `REVOKE`.

Errors [#errors]

Error: `Unsupported role statement.`

Hint:

```text
Use CREATE ROLE <name>, DROP ROLE [IF EXISTS] <name>, or GRANT SELECT/INSERT [(columns)] ON <database>.<table> TO <role>. Only the default cluster is supported; delegation options and user grants are not supported.
```

Examples [#examples]

Create a role.

```sql test
CREATE ROLE events_statement_reader
```

Drop the role.

```sql
DROP ROLE IF EXISTS events_statement_reader
```

The parser rejects other clusters.

```sql test expect-error="Unsupported role statement."
CREATE ROLE events_other_cluster ON CLUSTER 'other'
```

The parser rejects `REVOKE`.

```sql test expect-error="Unsupported query."
REVOKE SELECT ON analytics.events FROM events_statement_reader
```

The parser rejects `ALTER ROLE`.

```sql test expect-error="Unsupported ALTER statement."
ALTER ROLE events_statement_reader
```

The parser rejects `SET ROLE`.

```sql test expect-error="Unsupported query."
SET ROLE events_statement_reader
```

The parser rejects `CREATE USER`.

```sql test expect-error="Unsupported query."
CREATE USER analytics_user
```

The parser rejects user grants.

```sql test expect-error="Unsupported role statement."
GRANT SELECT ON analytics.events TO USER analytics_user
```

The parser rejects grant options.

```sql test expect-error="Unsupported role statement."
GRANT SELECT ON analytics.events TO events_statement_reader WITH GRANT OPTION
```

The parser rejects role inheritance.

```sql test expect-error="Unsupported role statement."
GRANT events_parent TO events_statement_reader
```

Related [#related]

* [Access control](/docs/concepts/access-control)
* [Grant statements](./grant)