Chelabase
ManagementRoles

Preview a role delete

GET
/v1/databases/{id}/branches/{branch_id}/roles/{role}/delete-preview

What deleting the role to successor would expose: its SECURITY DEFINER routines granted to roles other than the successor, and its views without security_invoker (and materialized views) granted to anyone but the successor, PUBLIC included. After the delete they run with the successor's rights for those roles. Review them, then pass confirm to the delete; a delete to a named successor that exposes something is refused without the current token (exposure_unconfirmed). chelabase_orphaned (the default) never needs one: its preview lists what it finds with confirm: null. Changes nothing. The delete's rules for the role and the successor apply.

Authorization

bearer
AuthorizationBearer <token>

In: header

Path Parameters

id*string

Database id

Formatuuid
branch_id*string

Branch id

Formatuuid
role*string

Role name

Query Parameters

successor?string

The successor the delete would name, with the delete's rules; chelabase_orphaned (the default) when omitted.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/databases/497f6eca-6276-4993-bfeb-53cbbbba6f08/branches/497f6eca-6276-4993-bfeb-53cbbbba6f08/roles/string/delete-preview"
{  "confirm": "string",  "exposures": [    {      "database": "string",      "grantees": [        "string"      ],      "identity": "string",      "kind": "function"    }  ],  "successor": "string"}

Delete a login role DELETE

Deletes a role. Its objects in every database go to `successor` (never the owner): a role the owner can `SET ROLE` to that isn't owner-level, reserved or a personal login, or `chelabase_orphaned` (the default), a powerless role. Databases it owns go to the owner. PUBLIC loses EXECUTE on every routine that moved, and the answer lists the `SECURITY DEFINER` ones for review. Refused while a data API key uses it (`role_in_use`, with the keys in `keys`). The owner can't be deleted. A named successor that would let other roles run the role's `SECURITY DEFINER` routines or read its views without `security_invoker` with the successor's rights needs `confirm`, the current token of the delete's preview (`GET …/roles/{role}/delete-preview`); the grants are kept. `chelabase_orphaned` never needs one.

Reset a role's password POST

Generates a new password for the role. The owner's name resets the owner password, like the branch's reset-password. Read the new password with the connection details and `role`.