Role-based Access Control (RBAC)

Enterprise—

Role-based Access Control (RBAC) provides fine-grained permissions for your QuestDB instance.

Learn more

QuestDB Enterprise provides fine-grained access control that can restrict access at database, table, column, and even row level (using views).

Quick start

Here's a complete example to create a read-only analyst user in under a minute: It assumes the trades table from the Create your first database guide.

-- 1. Create the user
CREATE USER analyst WITH PASSWORD 'secure_password_here';

-- 2. Grant endpoint access (required to connect)
GRANT HTTP, PGWIRE TO analyst;

-- 3. Grant read access to specific tables
GRANT SELECT ON trades TO analyst;

-- Done! The analyst can now connect and query the trades table

To verify:

SHOW PERMISSIONS analyst;

To cap the native memory each of a user's queries may allocate:

ALTER USER analyst SET MEMORY LIMIT 1G;

See Per-principal query memory limits for how user, group, and service-account limits resolve.

Access control depth

QuestDB's access control operates across two dimensions:

Data access granularity

Control what data users can access:

Level	What you can control	Example
Database	All tables, global operations	GRANT SELECT ON ALL TABLES TO user
Table	Specific tables	GRANT SELECT ON trades TO user
Column	Specific columns within a table	GRANT SELECT ON trades(timestamp, price) TO user
Row	Specific rows via views	Create a view with WHERE clause, grant access to view

Connection access granularity

Control how users can connect:

Permission	Protocol	Use case
HTTP	REST API, Web Console, QWP, ILP/HTTP	Interactive users, web applications
PGWIRE	PostgreSQL Wire Protocol	SQL clients, BI tools, programmatic access
ILP	InfluxDB Line Protocol (TCP)	High-throughput data ingestion

-- User can connect via PostgreSQL protocol only (not web console)
GRANT PGWIRE TO analyst;

-- Service can only ingest via ILP, cannot query
GRANT ILP TO ingest_service;

-- Full interactive access
GRANT HTTP, PGWIRE TO developer;

These dimensions are independent: a user might have SELECT on all tables but only be allowed to connect via PGWIRE, or have INSERT permission but only via ILP.

Where to go next

Page	Covers
Users, service accounts, and groups	The three principal types, and the statements that manage them
Per-principal query memory limits	Set, resolve, and inspect query memory limits for principals
Authentication and endpoint access	Passwords, JWK and REST tokens, OIDC, and the HTTP/PGWIRE/ILP permissions
Granting and revoking permissions	Permission levels, GRANT ALL, the grant option, and level re-adjustment
Permissions reference	Every permission and the level it can be granted at
Common scenarios	Analysts, service accounts, teams, admins, failover operators
OpenID Connect	SSO against an external Identity Provider

SQL commands reference

• ADD USER
• ALTER GROUP
• ALTER SERVICE ACCOUNT
• ALTER USER
• ASSUME SERVICE ACCOUNT
• CREATE GROUP
• CREATE SERVICE ACCOUNT
• CREATE USER
• DROP GROUP
• DROP SERVICE ACCOUNT
• DROP USER
• EXIT SERVICE ACCOUNT
• GRANT
• GRANT ASSUME SERVICE ACCOUNT
• REMOVE USER
• REVOKE
• REVOKE ASSUME SERVICE ACCOUNT
• SHOW GROUPS
• SHOW PERMISSIONS
• SHOW SERVICE ACCOUNT
• SHOW SERVICE ACCOUNTS
• SHOW USER
• SHOW USERS

Where each section moved

These anchors are kept so that existing links keep working. Prefer the pages above when adding new links.

Section	Now at
Column-level access	Granting permissions
Row-level access with views	Granting permissions
Common scenarios	Common scenarios
Read-only analyst	Common scenarios
Application service account	Common scenarios
Team-based access with groups	Common scenarios
Column-level restrictions	Common scenarios
Row-level security	Common scenarios
Database administrator	Common scenarios
Failover operator	Common scenarios
Memory limits	Per-principal query memory limits
Memory limit upgrade	Upgrading
Core concepts	Users, service accounts, and groups
Users and service accounts	Users and groups
Why service accounts?	Users and groups
Groups	Users and groups
Authentication methods	Authentication
Endpoint permissions	Authentication
Built-in admin	Users and groups
Service account assumption	Users and groups
Creating and removing principals	Users and groups
Managing group membership	Users and groups
Viewing information	Users and groups
Managing authentication	Authentication
User management reference	Users and groups
Permission levels	Granting permissions
Granting ALL	Granting permissions
The GRANT option	Granting permissions
Owner permissions	Granting permissions
Advanced topics	Granting permissions
Permission re-adjustment	Granting permissions
Implicit timestamp permissions	Granting permissions
Granting on non-existent objects	Granting permissions
Permissions reference	Permissions reference
Database permissions	Permissions reference
User management permissions	Permissions reference
Special permissions	Permissions reference