Modify role permissions and find matching existing roles.
Early Access: This API is provided in Early Access. Please contact our customer support team for more information and to enable this feature.
Overview
The Role Maintenance API allows you to simulate modifications to an existing role's permissions and check if other roles with the resulting permission set already exist. This API is particularly useful for role rationalization and consolidation in Snowflake environments.
Use cases and features
This API enables effective role maintenance and governance with several key capabilities:
Role Rationalization: Find existing roles that match a desired permission set after modifications
Role Consolidation: Identify opportunities to consolidate roles by checking for existing roles with similar permissions
Permission Planning: Plan permission changes and identify existing alternatives before implementation
Access Governance: Maintain a minimal set of roles by identifying functionally equivalent roles
The API accepts a request object with the following parameters:
Parameter
Type
Required
Description
grantee_type
string
Yes
The type of grantee (currently only supports SnowflakeRole)
grantee_id
string
Yes
Veza node ID of the grantee (role) to be modified
modifications
GranteeModification[]
Yes
A list of resource permission modifications to apply to the role
GranteeModification Structure
Each GranteeModification object contains:
Field
Type
Required
Description
from_resource_permissions
ResourcePermissions
No
Permissions to remove from the role
to_resource_permissions
ResourcePermissions
No
Permissions to add to the role
Note: You can specify either or both of these fields:
If only from_resource_permissions is set, those permissions will be removed
If only to_resource_permissions is set, those permissions will be added
If both are set, the permissions will be updated accordingly
This flexibility allows you to model different types of permission changes within a single API call. For example, you can simultaneously remove access to one resource while adding access to another, or modify permission levels on the same resource.
ResourcePermissions Structure
Each ResourcePermissions object contains:
Field
Type
Required
Description
node_type
string
Yes
The type of resource node (supported types are SnowflakeDatabase, SnowflakeTable, SnowflakeView, and SnowflakeSchema)
node_id
string
Yes
Veza node ID of the resource (ID property in graph and query builder)
raw_permissions
string[]
Yes
A list of permissions (e.g., USAGE, SELECT, etc.)
Request and Response Protocol
Proto Message Definitions
The API uses the following protocol buffer message definitions:
Response Structure
The API returns a response object with the following field:
Field
Type
Description
grantee_ids
string[]
A list of existing role IDs that match the permission set after the requested modifications
Usage Example
Request
This example simulates removing database and schema permissions from one role while adding database permissions to another:
Response
The response indicates that a role with the resulting permission set exists:
Example: Adding permissions only
This example shows adding permissions to a role:
Request
Response
Example: Removing permissions only
This example shows removing permissions from a role:
