Permissions

Actions

Action	Allows
postgrescluster/read	See clusters, their configuration, status, health, external address, snapshots and recovery window
postgrescluster/write	Create and change clusters; start, stop and restart them. Includes postgrescluster/delete
postgrescluster/delete	Delete clusters
postgrescluster/scale	Set the instance count through the scale route (stsh pg scale)
postgrescluster/createSnapshot	Take a snapshot
postgrescluster/restoreSnapshot	Restore a snapshot, or a point in time
postgrescluster/deleteSnapshot	Delete a snapshot
postgrescluster/readSecrets	Read the connection strings
postgrescluster/writeSecrets	Catalogued; nothing uses it today
postgrescluster/schemaRead	List schemas, tables and columns in the Data Explorer
postgrescluster/schemaWrite	Create and alter objects, VACUUM, REINDEX
postgrescluster/schemaDrop	Drop and truncate objects
postgrescluster/queryExecute	Run statements that read
postgrescluster/queryExecuteWrite	Run statements that change data
postgrescluster/dataRead	Browse rows; open the Data Explorer tab
postgrescluster/dataWrite	Change rows on Browse

readSecrets, writeSecrets and the seven Data Explorer actions are data actions: a role grants them only when it lists them as data actions.

Roles

Role	See	Create, change	Delete	Snapshots	Connection strings	Data Explorer
Reader, Databases Reader, Platform Reader	Yes	No	No	See	No	No
Database Explorer	Yes	No	No	See	No	Yes, without DROP and TRUNCATE
Databases Operator	Yes	Yes, and scale	Yes	Take, restore, delete	Yes	No
Contributor	Yes	Yes, and scale	Yes	Take	Yes	No
Owner, Platform Owner, Platform Contributor	Yes	Yes, and scale	Yes	Take, restore, delete	Yes	No

None of Owner, Contributor, Platform Owner and Platform Contributor holds the Data Explorer actions; only Database Explorer grants them — see Database Explorer. No built-in role holds postgrescluster/schemaDrop; withholding it does not keep someone with Database Explorer from removing data — see What is checked before a statement runs. Assign roles on the boundary, the resource group or the cluster itself — see Role assignments.

The Data Explorer's history — every statement sent, its text and who sent it — is also served by the API to anyone with postgrescluster/read on the cluster.

Data Explorer statements

Each statement in a batch needs the actions of its kind. Rows browsed or changed on Browse also need dataRead or dataWrite.

Statements	Needs
SELECT, EXPLAIN (without ANALYZE), SET, SHOW, PREPARE, DEALLOCATE, DISCARD, cursors, COPY … TO	queryExecute
INSERT, UPDATE, DELETE, MERGE, SELECT … FOR UPDATE, LOCK	queryExecuteWrite
CREATE of tables, schemas, indexes, views, sequences, functions, triggers, policies, domains, rules and statistics; COMMENT; REFRESH MATERIALIZED VIEW; ALTER of objects; VACUUM; REINDEX	schemaWrite
CREATE TABLE … AS, CREATE MATERIALIZED VIEW	schemaWrite and queryExecute
COPY … FROM	schemaWrite and queryExecuteWrite
DROP, TRUNCATE	schemaDrop
EXPLAIN ANALYZE	What the explained statement needs

Refused statements

These are refused whatever your permissions, and refuse the whole batch:

• transaction control — BEGIN, COMMIT, ROLLBACK, savepoints: the Data Explorer runs every batch in a transaction of its own;
• DO, CALL, EXECUTE, SECURITY LABEL;
• LISTEN, NOTIFY, UNLISTEN;
• extensions, foreign data wrappers, foreign servers and user mappings, access methods, event triggers and procedural languages;
• roles and privileges — CREATE, ALTER and DROP ROLE, GRANT, REVOKE, default privileges, REASSIGN OWNED, DROP OWNED;
• databases and tablespaces;
• publications and subscriptions;
• ALTER SYSTEM, CHECKPOINT, LOAD, CLUSTER, VACUUM FULL, COPY to or from a program;
• functions in a language other than sql and plpgsql;
• anything that cannot be parsed, and statements the Data Explorer does not classify — among them CREATE TYPE … AS ENUM and composite and range types.