For AI agents: the complete documentation index is at llms.txt. Every page is also available as markdown by appending .md to its URL, or by sending an Accept: text/markdown request header.

QuestDB permissions reference

Every permission QuestDB Enterprise supports, and the level each one can be granted at. To see the same list from a running instance, including any permission added after this page was written:

SELECT * FROM all_permissions();

Database permissions​

PermissionLevelDescription
ADD COLUMNDatabase | TableAdd columns to tables
ADD INDEXDatabase | Table | ColumnAdd index on symbol columns
ALTER COLUMN CACHEDatabase | Table | ColumnEnable/disable symbol caching
ALTER COLUMN TYPEDatabase | Table | ColumnChange column types
ALTER SYMBOL CAPACITYDatabase | Table | ColumnChange the capacity of a symbol column
ALTER VIEWDatabase | TableChange a view definition
ATTACH PARTITIONDatabase | TableAttach partitions
BACKUP DATABASEDatabaseCreate database backups
BACKUP TABLEDatabase | TableLegacy, grants nothing: there is no BACKUP TABLE statement
CANCEL ANY COPYDatabaseCancel COPY operations
COMPILE VIEWDatabase | TableRecompile a view against the current schema
CONVERT PARTITION TO NATIVEDatabase | TableConvert Parquet partitions back to native format
CONVERT PARTITION TO PARQUETDatabase | TableConvert partitions to Parquet in place
CREATE LIVE VIEWDatabaseCreate live views
CREATE MATERIALIZED VIEWDatabaseCreate materialized views
CREATE TABLEDatabaseCreate tables
CREATE VIEWDatabaseCreate views
DEDUP DISABLEDatabase | TableDisable deduplication
DEDUP ENABLEDatabase | TableEnable deduplication
DETACH PARTITIONDatabase | TableDetach partitions
DISABLE STORAGE POLICYDatabase | TableDisable storage policies
DROP COLUMNDatabase | Table | ColumnDrop columns
DROP INDEXDatabase | Table | ColumnDrop indexes
DROP LIVE VIEWDatabase | TableDrop live views
DROP MATERIALIZED VIEWDatabase | TableDrop materialized views
DROP PARTITIONDatabase | TableDrop partitions
DROP TABLEDatabase | TableDrop tables
DROP VIEWDatabase | TableDrop views
ENABLE STORAGE POLICYDatabase | TableEnable storage policies
INSERTDatabase | TableInsert data
REFRESH MATERIALIZED VIEWDatabase | TableRefresh materialized views
REINDEXDatabase | Table | ColumnReindex columns
REMOVE STORAGE POLICYDatabase | TableRemove storage policies
RENAME COLUMNDatabase | Table | ColumnRename columns
RENAME TABLEDatabase | TableRename tables
RESUME WALDatabase | TableResume WAL processing
SELECTDatabase | Table | ColumnRead data
SET PARQUET SETTINGSDatabase | TableSet per-column Parquet encoding, compression and bloom filters
SET REFRESH LIMITDatabase | TableSet a materialized view's refresh limit
SET REFRESH TYPEDatabase | TableChange a materialized view's refresh strategy
SET STORAGE POLICYDatabase | TableSet storage policies
SET TABLE FORMATDatabase | TableSwitch a table's partition format between native and Parquet
SET TABLE PARAMDatabase | TableSet table parameters
SET TABLE TYPEDatabase | TableChange table type
SETTINGSDatabaseChange instance settings in Web Console
SNAPSHOTDatabaseCreate snapshots
SQL ENGINE ADMINDatabaseList/cancel running queries
SWITCH ROLEDatabaseSwitch the replication role, read SWITCH STATUS
SYSTEM ADMINDatabaseSystem functions (reload_tls, etc.)
TRUNCATE TABLEDatabase | TableTruncate tables
UPDATEDatabase | Table | ColumnUpdate data
VACUUM TABLEDatabase | TableReclaim storage

Endpoint permissions​

These control which protocol a principal may connect on. They are covered in detail under authentication and endpoint access.

PermissionLevelDescription
HTTPDatabaseREST API, Web Console, QWP, ILP over HTTP
ILPDatabaseInfluxDB Line Protocol TCP (port 9009)
PGWIREDatabasePostgreSQL Wire Protocol (port 8812)

User management permissions​

PermissionDescription
ADD EXTERNAL ALIASCreate external group mappings
ADD PASSWORDSet user passwords
ADD USERAdd users to groups
CREATE GROUPCreate groups
CREATE JWKCreate JWK tokens
CREATE REST TOKENCreate REST API tokens
CREATE SERVICE ACCOUNTCreate service accounts
CREATE USERCreate users
DISABLE USERDisable users
DROP GROUPDrop groups
DROP JWKDrop JWK tokens
DROP REST TOKENDrop REST API tokens
DROP SERVICE ACCOUNTDrop service accounts
DROP USERDrop users
ENABLE USEREnable users
LIST USERSList users/groups/service accounts
REMOVE EXTERNAL ALIASRemove external group mappings
REMOVE PASSWORDRemove passwords
REMOVE USERRemove users from groups
SET MEMORY LIMITSet memory limits on users, groups, and service accounts
USER DETAILSView user/group/service account details

Special permissions​

PermissionDescription
ALLAll permissions at the granted level (database/table/column). At the database level this includes DATABASE ADMIN - see granting ALL
DATABASE ADMINAll permissions including future ones; can assume any service account

A few destructive operations have no permission of their own. They are gated by SYSTEM ADMIN, so the only way to grant them is to grant SYSTEM ADMIN, which also carries every other system function:

OperationGated byNotes
ALTER TABLE REBASE WALSYSTEM ADMINRebuilds a suspended WAL table under a fresh sequencer. A table-level RESUME WAL grant is not enough
SWITCH COLD STORAGE ROLESYSTEM ADMINMoves the cold storage manager role, including with FORCE

By contrast, SWITCH ROLE, which moves the replication role, has its own dedicated permission that can be granted without handing over the rest of SYSTEM ADMIN.

See also​