Skip to main content
Version: v5

Operations

Roles​

List Roles​

Restricted to super_user roles.

{
	"operation": "list_roles"
}

Add Role​

Restricted to super_user roles.

  • role (required) — Name for the new role.
  • permission (required) — Permissions object. See Permission Structure.
    • super_user (optional) — If true, grants full access. Defaults to false.
    • structure_user (optional) — Boolean or array of database names. If true, can create/drop databases and tables. If array, limited to specified databases.
    • operations (optional) — Array of operation names and/or permission group names (read_only, standard_user) this role may call. When set, any unlisted operation is denied. See Operation Permissions.
{
	"operation": "add_role",
	"role": "developer",
	"permission": {
		"super_user": false,
		"structure_user": false,
		"dev": {
			"tables": {
				"dog": {
					"read": true,
					"insert": true,
					"update": true,
					"delete": false,
					"attribute_permissions": [
						{
							"attribute_name": "name",
							"read": true,
							"insert": true,
							"update": true
						}
					]
				}
			}
		}
	}
}

Alter Role​

Restricted to super_user roles.

  • id (required) — The id of the role to alter (from list_roles).
  • role (optional) — New name for the role.
  • permission (required) — Updated permissions object.
{
	"operation": "alter_role",
	"id": "f92162e2-cd17-450c-aae0-372a76859038",
	"role": "another_developer",
	"permission": {
		"super_user": false,
		"structure_user": false,
		"dev": {
			"tables": {
				"dog": {
					"read": true,
					"insert": true,
					"update": true,
					"delete": false,
					"attribute_permissions": []
				}
			}
		}
	}
}

Drop Role​

Restricted to super_user roles. Roles with associated users cannot be dropped.

  • id (required) — The id of the role to drop.
{
	"operation": "drop_role",
	"id": "developer"
}

Users​

List Users​

Restricted to super_user roles.

{
	"operation": "list_users"
}

User Info​

Returns user data for the currently authenticated user. Available to all roles.

From v5.4.0, requests trusted by authorizeLocal or the operations API domain socket return username: "local" for the built-in super user.

{
	"operation": "user_info"
}

Add User​

Restricted to super_user roles.

  • role (required) — Role name to assign.
  • username (required) — Username. Cannot be changed after creation.
  • password (required) — Plain-text password. Harper encrypts it on receipt.
  • active (required) — Boolean. If false, user cannot access Harper.
{
	"operation": "add_user",
	"role": "role_name",
	"username": "hdb_user",
	"password": "password",
	"active": true
}
Changed in: v5.4.0

The username local is reserved for requests trusted by their transport. add_user rejects it with HTTP 400: 'local' is a reserved username: it identifies requests trusted by their transport (authorizeLocal, the operations domain socket).

A stored user named local created before this change still authenticates as an ordinary stored user and can be altered or dropped. To avoid confusing it with the built-in identity, create a replacement under another name, update clients to use it, then drop the old user. Usernames cannot be changed in place.

Alter User​

Restricted to super_user roles.

  • username (required) — Username to modify.
  • password (optional) — New password.
  • role (optional) — New role name.
  • active (optional) — Enable/disable user access.
{
	"operation": "alter_user",
	"role": "role_name",
	"username": "hdb_user",
	"password": "new_password",
	"active": true
}

Drop User​

Restricted to super_user roles.

{
	"operation": "drop_user",
	"username": "harper"
}