Role

View as Markdown

Role represents a Postgres role within a Branch.

Get a Postgres Role for a BranchGET /api/2.0/postgres/{name=projects/*/branches/*/roles/*}List Postgres Roles for a BranchGET /api/2.0/postgres/{parent=projects/*/branches/*}/rolesCreate a Postgres Role for a BranchPOST /api/2.0/postgres/{parent=projects/*/branches/*}/rolesUpdate a Postgres Role for a BranchPATCH /api/2.0/postgres/{name=projects/*/branches/*/roles/*}Delete a Postgres Role from a BranchDELETE /api/2.0/postgres/{name=projects/*/branches/*/roles/*}

Role object

Role represents a Postgres role within a Branch.

namestringIDImmutable

Output only. The full resource path of the role. Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}

parentstringOutput only

The Branch where this Role exists. Format: projects/{project_id}/branches/{branch_id}

create_timestringOutput only

update_timestringOutput only

specobjectInput only

The spec contains the role configuration, including identity type, authentication method, and role attributes.

Show child attributesHide child attributes

membership_rolesarray of string

An enum value for a standard role that this role is a member of.

Values:

• DATABRICKS_SUPERUSER

identity_typestring

The type of role. When specifying a managed-identity, the chosen role_id must be a valid:

• application ID for SERVICE_PRINCIPAL
• user email for USER
• group name for GROUP

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Values:

• USER
• SERVICE_PRINCIPAL
• GROUP

attributesobject

The desired API-exposed Postgres role attribute to associate with the role. Optional.

Show child attributesHide child attributes

createdbboolean

createroleboolean

bypassrlsboolean

auth_methodstring

Controls how the Postgres role authenticates when a client opens a database connection. Supported values:

• LAKEBASE_OAUTH_V1: the role authenticates by presenting a Databricks OAuth access token derived from the backing managed identity (the <Databricks> user, service principal, or group named by the role's postgres_role). No static password exists for roles using this method.
• PG_PASSWORD_SCRAM_SHA_256: the role authenticates with a Postgres password verified server-side using the SCRAM-SHA-256 mechanism. Lakebase generates a password for the role.
• NO_LOGIN: the role cannot open a Postgres session at all. Useful for roles that exist only to own objects or to aggregate privileges that are then granted to other, loginable roles.

If auth_method is left unspecified, a meaningful authentication method is derived from the identity_type:

• For the managed identities, OAUTH is used.
• For the regular postgres roles, authentication based on postgres passwords is used.

NOTE: for the <Databricks> identity type GROUP, LAKEBASE_OAUTH_V1 is the default auth method (group can login as well).

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Values:

• NO_LOGIN
• PG_PASSWORD_SCRAM_SHA_256
• LAKEBASE_OAUTH_V1

postgres_rolestring

The name of the Postgres role.

This expects a valid Postgres identifier as specified in the link below. https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS

Required when creating the Role.

If you wish to create a Postgres Role backed by a managed <Databricks> identity, then postgres_role must be one of the following:

1. user email for IdentityType.USER
2. app ID for IdentityType.SERVICE_PRINCIPAL
2. group name for IdentityType.GROUP

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

statusobjectOutput only

Current status of the role, including its identity type, authentication method, and role attributes.

Show child attributesHide child attributes

membership_rolesarray of string

An enum value for a standard role that this role is a member of.

Values:

• DATABRICKS_SUPERUSER

identity_typestring

The type of the role.

Values:

• USER
• SERVICE_PRINCIPAL
• GROUP

attributesobject

The PG role attributes associated with the role.

Show child attributesHide child attributes

createdbboolean

createroleboolean

bypassrlsboolean

auth_methodstring

How the role is authenticated when connecting to Postgres.

Values:

• NO_LOGIN
• PG_PASSWORD_SCRAM_SHA_256
• LAKEBASE_OAUTH_V1

postgres_rolestring

The name of the Postgres role.

role_idstringOutput only

Part of the resource name.

role_idstringOutput only

The part of the name, chosen by the user when the resource was created.

View as Markdown

The Role object

{
  "name": "string",
  "parent": "string",
  "create_time": "string",
  "update_time": "string",
  "spec": {
    "membership_roles": [
      "DATABRICKS_SUPERUSER"
    ],
    "identity_type": "USER",
    "attributes": {},
    "auth_method": "NO_LOGIN",
    "postgres_role": "string"
  },
  "status": {
    "membership_roles": [
      "DATABRICKS_SUPERUSER"
    ],
    "identity_type": "USER",
    "attributes": {},
    "auth_method": "NO_LOGIN",
    "postgres_role": "string",
    "role_id": "string"
  },
  "role_id": "string"
}

Get a Postgres Role for a Branch GA

GET /api/2.0/postgres/{name=projects/*/branches/*/roles/*}

Retrieves information about the specified Postgres role, including its authentication method and permissions.

API scopes: postgres

Parameters

namestringRequiredpath

The full resource path of the role to retrieve. Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}

Response

Returns the Role object.

View as Markdown

Response

{
  "name": "string",
  "parent": "string",
  "create_time": "string",
  "update_time": "string",
  "status": {
    "membership_roles": [
      "DATABRICKS_SUPERUSER"
    ],
    "identity_type": "USER",
    "attributes": {},
    "auth_method": "NO_LOGIN",
    "postgres_role": "string",
    "role_id": "string"
  },
  "role_id": "string"
}

List Postgres Roles for a Branch GA

GET /api/2.0/postgres/{parent=projects/*/branches/*}/roles

Returns a paginated list of Postgres roles in the branch.

API scopes: postgres

Parameters

parentstringRequiredpath

The Branch that owns this collection of roles. Format: projects/{project_id}/branches/{branch_id}

page_tokenstringquery

Page token from a previous response. If not provided, returns the first page.

page_sizeint32query

Upper bound for items returned. Cannot be negative.

Response

Returns a list of Role objects.

View as Markdown

Response

{
  "roles": [
    {
      "name": "string",
      "parent": "string",
      "create_time": "string",
      "update_time": "string",
      "status": {},
      "role_id": "string"
    }
  ],
  "next_page_token": "string"
}

Create a Postgres Role for a Branch GA

POST /api/2.0/postgres/{parent=projects/*/branches/*}/roles

Creates a new Postgres role in the branch.

API scopes: postgres

Parameters

parentstringRequiredpath

The Branch where this Role is created. Format: projects/{project_id}/branches/{branch_id}

role_idstringquery

The ID to use for the Role, which will become the final component of the role's resource name. This ID becomes the role in Postgres.

This value should be 4-63 characters, and valid characters are lowercase letters, numbers, and hyphens, as defined by RFC 1123.

If role_id is not specified in the request, it is generated automatically.

replace_existingbooleanInput onlyquery

If true, update the role if it already exists instead of returning an error. This requires role_id to be set. Without role_id, the request follows the normal create path and fails if the role name already exists.

When the role already exists, only mutable fields are updated. Attributes omitted from the request retain their current values. Set an attribute explicitly to false to disable it. identity_type, auth_method, and postgres_role retain their existing values; supplied values for these fields are ignored. membership_roles is overwritten, not merged. Leaving membership_roles empty clears all of the role's existing memberships, including DATABRICKS_SUPERUSER. Always send the complete desired list of memberships when using this field.

Request body

The desired specification of a Role.

namestringIDImmutable

Output only. The full resource path of the role. Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}

specobjectInput only

The spec contains the role configuration, including identity type, authentication method, and role attributes.

Show child attributesHide child attributes

membership_rolesarray of string

An enum value for a standard role that this role is a member of.

Values:

• DATABRICKS_SUPERUSER

identity_typestring

The type of role. When specifying a managed-identity, the chosen role_id must be a valid:

• application ID for SERVICE_PRINCIPAL
• user email for USER
• group name for GROUP

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Values:

• USER
• SERVICE_PRINCIPAL
• GROUP

attributesobject

The desired API-exposed Postgres role attribute to associate with the role. Optional.

Show child attributesHide child attributes

createdbboolean

createroleboolean

bypassrlsboolean

auth_methodstring

Controls how the Postgres role authenticates when a client opens a database connection. Supported values:

• LAKEBASE_OAUTH_V1: the role authenticates by presenting a Databricks OAuth access token derived from the backing managed identity (the <Databricks> user, service principal, or group named by the role's postgres_role). No static password exists for roles using this method.
• PG_PASSWORD_SCRAM_SHA_256: the role authenticates with a Postgres password verified server-side using the SCRAM-SHA-256 mechanism. Lakebase generates a password for the role.
• NO_LOGIN: the role cannot open a Postgres session at all. Useful for roles that exist only to own objects or to aggregate privileges that are then granted to other, loginable roles.

If auth_method is left unspecified, a meaningful authentication method is derived from the identity_type:

• For the managed identities, OAUTH is used.
• For the regular postgres roles, authentication based on postgres passwords is used.

NOTE: for the <Databricks> identity type GROUP, LAKEBASE_OAUTH_V1 is the default auth method (group can login as well).

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Values:

• NO_LOGIN
• PG_PASSWORD_SCRAM_SHA_256
• LAKEBASE_OAUTH_V1

postgres_rolestring

The name of the Postgres role.

This expects a valid Postgres identifier as specified in the link below. https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS

Required when creating the Role.

If you wish to create a Postgres Role backed by a managed <Databricks> identity, then postgres_role must be one of the following:

1. user email for IdentityType.USER
2. app ID for IdentityType.SERVICE_PRINCIPAL
2. group name for IdentityType.GROUP

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Response

namestring

The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the name should be a resource name ending with operations/{unique_id}.

metadataobject

Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata.

doneboolean

If the value is false, it means the operation is still in progress. If true, the operation is completed, and either error or response is available.

errorobject

The error result of the operation in case of failure or cancellation.

Show child attributesHide child attributes

error_codestring

Error codes returned by Databricks APIs to indicate specific failure conditions.

Values:

Show 81 possible values

• UNKNOWN
• INTERNAL_ERROR
• TEMPORARILY_UNAVAILABLE
• IO_ERROR
• BAD_REQUEST
• SERVICE_UNDER_MAINTENANCE
• WORKSPACE_TEMPORARILY_UNAVAILABLE
• DEADLINE_EXCEEDED
• CANCELLED
• RESOURCE_EXHAUSTED
• ABORTED
• NOT_FOUND
• ALREADY_EXISTS
• UNAUTHENTICATED
• UNAVAILABLE
• INVALID_PARAMETER_VALUE
• ENDPOINT_NOT_FOUND
• MALFORMED_REQUEST
• INVALID_STATE
• PERMISSION_DENIED
• FEATURE_DISABLED
• CUSTOMER_UNAUTHORIZED
• REQUEST_LIMIT_EXCEEDED
• RESOURCE_CONFLICT
• UNPARSEABLE_HTTP_ERROR
• NOT_IMPLEMENTED
• DATA_LOSS
• INVALID_STATE_TRANSITION
• COULD_NOT_ACQUIRE_LOCK
• RESOURCE_ALREADY_EXISTS
• RESOURCE_DOES_NOT_EXIST
• QUOTA_EXCEEDED
• MAX_BLOCK_SIZE_EXCEEDED
• MAX_READ_SIZE_EXCEEDED
• PARTIAL_DELETE
• MAX_LIST_SIZE_EXCEEDED
• DRY_RUN_FAILED
• RESOURCE_LIMIT_EXCEEDED
• DIRECTORY_NOT_EMPTY
• DIRECTORY_PROTECTED
• MAX_NOTEBOOK_SIZE_EXCEEDED
• MAX_CHILD_NODE_SIZE_EXCEEDED
• SEARCH_QUERY_TOO_LONG
• SEARCH_QUERY_TOO_SHORT
• MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST
• PERMISSION_NOT_PROPAGATED
• DEPLOYMENT_TIMEOUT
• GIT_CONFLICT
• GIT_UNKNOWN_REF
• GIT_SENSITIVE_TOKEN_DETECTED
• GIT_URL_NOT_ON_ALLOW_LIST
• GIT_REMOTE_ERROR
• PROJECTS_OPERATION_TIMEOUT
• IPYNB_FILE_IN_REPO
• INSECURE_PARTNER_RESPONSE
• MALFORMED_PARTNER_RESPONSE
• METASTORE_DOES_NOT_EXIST
• DAC_DOES_NOT_EXIST
• CATALOG_DOES_NOT_EXIST
• SCHEMA_DOES_NOT_EXIST
• TABLE_DOES_NOT_EXIST
• SHARE_DOES_NOT_EXIST
• RECIPIENT_DOES_NOT_EXIST
• STORAGE_CREDENTIAL_DOES_NOT_EXIST
• EXTERNAL_LOCATION_DOES_NOT_EXIST
• PRINCIPAL_DOES_NOT_EXIST
• PROVIDER_DOES_NOT_EXIST
• METASTORE_ALREADY_EXISTS
• DAC_ALREADY_EXISTS
• CATALOG_ALREADY_EXISTS
• SCHEMA_ALREADY_EXISTS
• TABLE_ALREADY_EXISTS
• SHARE_ALREADY_EXISTS
• RECIPIENT_ALREADY_EXISTS
• STORAGE_CREDENTIAL_ALREADY_EXISTS
• EXTERNAL_LOCATION_ALREADY_EXISTS
• PROVIDER_ALREADY_EXISTS
• CATALOG_NOT_EMPTY
• SCHEMA_NOT_EMPTY
• METASTORE_NOT_EMPTY
• PROVIDER_SHARE_NOT_ACCESSIBLE

messagestring

stack_tracestring

detailsarray of object

responseobject

The normal, successful response of the operation.

View as Markdown

Request

{
  "name": "string",
  "spec": {
    "membership_roles": [
      "DATABRICKS_SUPERUSER"
    ],
    "identity_type": "USER",
    "attributes": {},
    "auth_method": "NO_LOGIN",
    "postgres_role": "string"
  }
}

Response

{
  "name": "string",
  "metadata": {},
  "done": true,
  "error": {
    "error_code": "UNKNOWN",
    "message": "string",
    "stack_trace": "string",
    "details": [
      {}
    ]
  },
  "response": {}
}

Update a Postgres Role for a Branch GA

PATCH /api/2.0/postgres/{name=projects/*/branches/*/roles/*}

Updates the mutable fields of a Postgres role for a branch.

The fields spec.identity_type, spec.auth_method, and spec.postgres_role are fixed when the role is created. UpdateRole ignores values supplied for these fields in the request body and retains their existing values. Explicitly naming one of these fields in update_mask returns an INVALID_PARAMETER_VALUE error.

API scopes: postgres

Parameters

namestringRequiredIDImmutablepath

Output only. The full resource path of the role. Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}

update_maskstringRequiredquery

The list of fields to update. Supported fields are spec.membership_roles, spec.attributes.createdb, spec.attributes.createrole, and spec.attributes.bypassrls.

spec.identity_type, spec.auth_method, and spec.postgres_role cannot be changed. Values supplied for these fields in the request body are ignored. Including one of these fields as an explicit path in update_mask returns an INVALID_PARAMETER_VALUE error. When spec is the only path in the mask, only the supplied mutable attributes are updated. * by itself, or spec combined with other supported paths, selects all supported mutable fields. For these masks, all three attributes (createdb, createrole, and bypassrls) must be supplied; omitting any returns an INVALID_PARAMETER_VALUE error. Each of these mask forms replaces membership_roles. Omitting it or supplying an empty list clears all memberships, including DATABRICKS_SUPERUSER.

Request body

The Postgres Role to update.

The role's name field is used to identify the role to update. Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}

specobjectInput only

The spec contains the role configuration, including identity type, authentication method, and role attributes.

Show child attributesHide child attributes

membership_rolesarray of string

An enum value for a standard role that this role is a member of.

Values:

• DATABRICKS_SUPERUSER

identity_typestring

The type of role. When specifying a managed-identity, the chosen role_id must be a valid:

• application ID for SERVICE_PRINCIPAL
• user email for USER
• group name for GROUP

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Values:

• USER
• SERVICE_PRINCIPAL
• GROUP

attributesobject

The desired API-exposed Postgres role attribute to associate with the role. Optional.

Show child attributesHide child attributes

createdbboolean

createroleboolean

bypassrlsboolean

auth_methodstring

Controls how the Postgres role authenticates when a client opens a database connection. Supported values:

• LAKEBASE_OAUTH_V1: the role authenticates by presenting a Databricks OAuth access token derived from the backing managed identity (the <Databricks> user, service principal, or group named by the role's postgres_role). No static password exists for roles using this method.
• PG_PASSWORD_SCRAM_SHA_256: the role authenticates with a Postgres password verified server-side using the SCRAM-SHA-256 mechanism. Lakebase generates a password for the role.
• NO_LOGIN: the role cannot open a Postgres session at all. Useful for roles that exist only to own objects or to aggregate privileges that are then granted to other, loginable roles.

If auth_method is left unspecified, a meaningful authentication method is derived from the identity_type:

• For the managed identities, OAUTH is used.
• For the regular postgres roles, authentication based on postgres passwords is used.

NOTE: for the <Databricks> identity type GROUP, LAKEBASE_OAUTH_V1 is the default auth method (group can login as well).

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Values:

• NO_LOGIN
• PG_PASSWORD_SCRAM_SHA_256
• LAKEBASE_OAUTH_V1

postgres_rolestring

The name of the Postgres role.

This expects a valid Postgres identifier as specified in the link below. https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS

Required when creating the Role.

If you wish to create a Postgres Role backed by a managed <Databricks> identity, then postgres_role must be one of the following:

1. user email for IdentityType.USER
2. app ID for IdentityType.SERVICE_PRINCIPAL
2. group name for IdentityType.GROUP

This field is set when the role is created and cannot be changed by UpdateRole. If provided in an UpdateRole request body, its value is ignored and the existing value is retained. Do not include this field as an explicit path in update_mask.

Response

namestring

The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the name should be a resource name ending with operations/{unique_id}.

metadataobject

Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata.

doneboolean

If the value is false, it means the operation is still in progress. If true, the operation is completed, and either error or response is available.

errorobject

The error result of the operation in case of failure or cancellation.

Show child attributesHide child attributes

error_codestring

Error codes returned by Databricks APIs to indicate specific failure conditions.

Values:

Show 81 possible values

• UNKNOWN
• INTERNAL_ERROR
• TEMPORARILY_UNAVAILABLE
• IO_ERROR
• BAD_REQUEST
• SERVICE_UNDER_MAINTENANCE
• WORKSPACE_TEMPORARILY_UNAVAILABLE
• DEADLINE_EXCEEDED
• CANCELLED
• RESOURCE_EXHAUSTED
• ABORTED
• NOT_FOUND
• ALREADY_EXISTS
• UNAUTHENTICATED
• UNAVAILABLE
• INVALID_PARAMETER_VALUE
• ENDPOINT_NOT_FOUND
• MALFORMED_REQUEST
• INVALID_STATE
• PERMISSION_DENIED
• FEATURE_DISABLED
• CUSTOMER_UNAUTHORIZED
• REQUEST_LIMIT_EXCEEDED
• RESOURCE_CONFLICT
• UNPARSEABLE_HTTP_ERROR
• NOT_IMPLEMENTED
• DATA_LOSS
• INVALID_STATE_TRANSITION
• COULD_NOT_ACQUIRE_LOCK
• RESOURCE_ALREADY_EXISTS
• RESOURCE_DOES_NOT_EXIST
• QUOTA_EXCEEDED
• MAX_BLOCK_SIZE_EXCEEDED
• MAX_READ_SIZE_EXCEEDED
• PARTIAL_DELETE
• MAX_LIST_SIZE_EXCEEDED
• DRY_RUN_FAILED
• RESOURCE_LIMIT_EXCEEDED
• DIRECTORY_NOT_EMPTY
• DIRECTORY_PROTECTED
• MAX_NOTEBOOK_SIZE_EXCEEDED
• MAX_CHILD_NODE_SIZE_EXCEEDED
• SEARCH_QUERY_TOO_LONG
• SEARCH_QUERY_TOO_SHORT
• MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST
• PERMISSION_NOT_PROPAGATED
• DEPLOYMENT_TIMEOUT
• GIT_CONFLICT
• GIT_UNKNOWN_REF
• GIT_SENSITIVE_TOKEN_DETECTED
• GIT_URL_NOT_ON_ALLOW_LIST
• GIT_REMOTE_ERROR
• PROJECTS_OPERATION_TIMEOUT
• IPYNB_FILE_IN_REPO
• INSECURE_PARTNER_RESPONSE
• MALFORMED_PARTNER_RESPONSE
• METASTORE_DOES_NOT_EXIST
• DAC_DOES_NOT_EXIST
• CATALOG_DOES_NOT_EXIST
• SCHEMA_DOES_NOT_EXIST
• TABLE_DOES_NOT_EXIST
• SHARE_DOES_NOT_EXIST
• RECIPIENT_DOES_NOT_EXIST
• STORAGE_CREDENTIAL_DOES_NOT_EXIST
• EXTERNAL_LOCATION_DOES_NOT_EXIST
• PRINCIPAL_DOES_NOT_EXIST
• PROVIDER_DOES_NOT_EXIST
• METASTORE_ALREADY_EXISTS
• DAC_ALREADY_EXISTS
• CATALOG_ALREADY_EXISTS
• SCHEMA_ALREADY_EXISTS
• TABLE_ALREADY_EXISTS
• SHARE_ALREADY_EXISTS
• RECIPIENT_ALREADY_EXISTS
• STORAGE_CREDENTIAL_ALREADY_EXISTS
• EXTERNAL_LOCATION_ALREADY_EXISTS
• PROVIDER_ALREADY_EXISTS
• CATALOG_NOT_EMPTY
• SCHEMA_NOT_EMPTY
• METASTORE_NOT_EMPTY
• PROVIDER_SHARE_NOT_ACCESSIBLE

messagestring

stack_tracestring

detailsarray of object

responseobject

The normal, successful response of the operation.

View as Markdown

Request

{
  "spec": {
    "membership_roles": [
      "DATABRICKS_SUPERUSER"
    ],
    "identity_type": "USER",
    "attributes": {},
    "auth_method": "NO_LOGIN",
    "postgres_role": "string"
  }
}

Response

{
  "name": "string",
  "metadata": {},
  "done": true,
  "error": {
    "error_code": "UNKNOWN",
    "message": "string",
    "stack_trace": "string",
    "details": [
      {}
    ]
  },
  "response": {}
}

Delete a Postgres Role from a Branch GA

DELETE /api/2.0/postgres/{name=projects/*/branches/*/roles/*}

Deletes the specified Postgres role.

API scopes: postgres

Parameters

namestringRequiredIDImmutablepath

The full resource path of the role to delete. Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}

reassign_owned_tostringquery

Reassign objects. If this is set, all objects owned by the role are reassigned to the role specified in this parameter.

NOTE: setting this requires spinning up a compute to succeed, since it involves running SQL queries.

Response

namestring

The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the name should be a resource name ending with operations/{unique_id}.

metadataobject

Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata.

doneboolean

If the value is false, it means the operation is still in progress. If true, the operation is completed, and either error or response is available.

errorobject

The error result of the operation in case of failure or cancellation.

Show child attributesHide child attributes

error_codestring

Error codes returned by Databricks APIs to indicate specific failure conditions.

Values:

Show 81 possible values

• UNKNOWN
• INTERNAL_ERROR
• TEMPORARILY_UNAVAILABLE
• IO_ERROR
• BAD_REQUEST
• SERVICE_UNDER_MAINTENANCE
• WORKSPACE_TEMPORARILY_UNAVAILABLE
• DEADLINE_EXCEEDED
• CANCELLED
• RESOURCE_EXHAUSTED
• ABORTED
• NOT_FOUND
• ALREADY_EXISTS
• UNAUTHENTICATED
• UNAVAILABLE
• INVALID_PARAMETER_VALUE
• ENDPOINT_NOT_FOUND
• MALFORMED_REQUEST
• INVALID_STATE
• PERMISSION_DENIED
• FEATURE_DISABLED
• CUSTOMER_UNAUTHORIZED
• REQUEST_LIMIT_EXCEEDED
• RESOURCE_CONFLICT
• UNPARSEABLE_HTTP_ERROR
• NOT_IMPLEMENTED
• DATA_LOSS
• INVALID_STATE_TRANSITION
• COULD_NOT_ACQUIRE_LOCK
• RESOURCE_ALREADY_EXISTS
• RESOURCE_DOES_NOT_EXIST
• QUOTA_EXCEEDED
• MAX_BLOCK_SIZE_EXCEEDED
• MAX_READ_SIZE_EXCEEDED
• PARTIAL_DELETE
• MAX_LIST_SIZE_EXCEEDED
• DRY_RUN_FAILED
• RESOURCE_LIMIT_EXCEEDED
• DIRECTORY_NOT_EMPTY
• DIRECTORY_PROTECTED
• MAX_NOTEBOOK_SIZE_EXCEEDED
• MAX_CHILD_NODE_SIZE_EXCEEDED
• SEARCH_QUERY_TOO_LONG
• SEARCH_QUERY_TOO_SHORT
• MANAGED_RESOURCE_GROUP_DOES_NOT_EXIST
• PERMISSION_NOT_PROPAGATED
• DEPLOYMENT_TIMEOUT
• GIT_CONFLICT
• GIT_UNKNOWN_REF
• GIT_SENSITIVE_TOKEN_DETECTED
• GIT_URL_NOT_ON_ALLOW_LIST
• GIT_REMOTE_ERROR
• PROJECTS_OPERATION_TIMEOUT
• IPYNB_FILE_IN_REPO
• INSECURE_PARTNER_RESPONSE
• MALFORMED_PARTNER_RESPONSE
• METASTORE_DOES_NOT_EXIST
• DAC_DOES_NOT_EXIST
• CATALOG_DOES_NOT_EXIST
• SCHEMA_DOES_NOT_EXIST
• TABLE_DOES_NOT_EXIST
• SHARE_DOES_NOT_EXIST
• RECIPIENT_DOES_NOT_EXIST
• STORAGE_CREDENTIAL_DOES_NOT_EXIST
• EXTERNAL_LOCATION_DOES_NOT_EXIST
• PRINCIPAL_DOES_NOT_EXIST
• PROVIDER_DOES_NOT_EXIST
• METASTORE_ALREADY_EXISTS
• DAC_ALREADY_EXISTS
• CATALOG_ALREADY_EXISTS
• SCHEMA_ALREADY_EXISTS
• TABLE_ALREADY_EXISTS
• SHARE_ALREADY_EXISTS
• RECIPIENT_ALREADY_EXISTS
• STORAGE_CREDENTIAL_ALREADY_EXISTS
• EXTERNAL_LOCATION_ALREADY_EXISTS
• PROVIDER_ALREADY_EXISTS
• CATALOG_NOT_EMPTY
• SCHEMA_NOT_EMPTY
• METASTORE_NOT_EMPTY
• PROVIDER_SHARE_NOT_ACCESSIBLE

messagestring

stack_tracestring

detailsarray of object

responseobject

The normal, successful response of the operation.

View as Markdown

Response

{
  "name": "string",
  "metadata": {},
  "done": true,
  "error": {
    "error_code": "UNKNOWN",
    "message": "string",
    "stack_trace": "string",
    "details": [
      {}
    ]
  },
  "response": {}
}