Chelabase
ManagementMembers

Stop narrowing a member's grant on a database

DELETE
/v1/projects/{id}/grants/{member_id}/overrides

Authorization

bearer
AuthorizationBearer <token>

In: header

Path Parameters

id*string

Project id

Formatuuid
member_id*string

Member id

Formatuuid

Query Parameters

database_id*string

The database the override narrows

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/v1/projects/497f6eca-6276-4993-bfeb-53cbbbba6f08/grants/497f6eca-6276-4993-bfeb-53cbbbba6f08/overrides?database_id=497f6eca-6276-4993-bfeb-53cbbbba6f08"
Empty

Grant a member access to a project PUT

Creates or replaces the member's grant. `admin` holds every role on the project, the database owner included (the names in `pg_roles` are checked, then dropped, and it is answered as `"all"`; overrides still narrow it per database), so `owner` (or the owner's name) is never listed. Below `admin`, each role must be a NOLOGIN group whose memberships (every one, whatever its options) reach no owner-level role (the owner, `neon_superuser`, `cloud_admin`, or SUPERUSER, CREATEROLE, CREATEDB, REPLICATION, BYPASSRLS), LOGIN role, reserved role or role that holds the ADMIN option on another role, on any branch. The same holds on each database for what the member's overrides there leave of the grant; a grant that breaks it is refused naming the database. Every branch of the project then reconciles its member roles.

Narrow a member's grant on one database PUT

An override only narrows: its role is at most the grant's, its roles some of the grant's (any roles for an `admin` grant, which holds every role: the member keeps only those there, with the owner while still `admin`). Narrowing below `admin` takes the database owner away there, and the roles left must pass the same checks as a grant below `admin`. Every branch of the project then reconciles its member roles.