Fabric Commands - Required Permissions
The table below lists every Fabric command and the permission(s) needed to run it. For what each permission actually allows, see the List of Permissions in the Fabric Authorization overview article. For command syntax and usage examples, see Fabric Authorization Commands and Fabric Authorization List Commands.
| # | Fabric command | Required permission |
|---|
| 1 | ACTIVATEKEY | ACTIVATE_KEY |
| 2 | ALTER USER | self → no permissions required; other users → ALL |
| 3 | ASSIGN ROLE | ASSIGN_ROLE / ALL |
| 4 | ASSIGN SECURITY_PROFILE | ASSIGN_SECURITY_PROFILE |
| 5 | BATCH | BATCH on the target LU |
| 6 | BATCH_DETAILS | BATCH or BATCH_READ |
| 7 | BATCH_EDIT | ALL |
| 8 | BATCH_IN_PROCESS | BATCH or BATCH_READ |
| 9 | BATCH_INFO | BATCH or BATCH_READ |
| 10 | BATCH_LIST | BATCH or BATCH_READ |
| 11 | BATCH_PAUSE | BATCH |
| 12 | BATCH_PROCESS_UNIT | none |
| 13 | BATCH_RETRY | BATCH |
| 14 | BATCH_SUMMARY | BATCH or BATCH_READ |
| 15 | BROADWAY | BROADWAY |
| 16 | CANCEL (also BATCH_CANCEL) | BATCH |
| 17 | CDC_REPUBLISH_INSTANCE | ALL |
| 18 | CDC_REPUBLISH_SCHEMA | ALL |
| 19 | CHECK_PERMISSION | ALL |
| 20 | CLUSTERID | ALL |
| 21 | CLUSTERSTATUS | ALL |
| 22 | CQL | READ |
| 23 | CREATE ROLE | ALL |
| 24 | CREATE TOKEN | ALL |
| 25 | CREATE USER | ALL |
| 26 | DEBUG | ALL |
| 27 | DELETE INSTANCE | DELETE_INSTANCE |
| 28 | DELETE INSTANCES IF NOT EXIST | ALL |
| 29 | DEPLOY | DEPLOY, optional granularity - only on dedicated LUs |
| 30 | DEPLOY ENVIRONMENTS FROM FILE | DEPLOY_ENVIRONMENTS |
| 31 | DESCRIBE | READ or READ_WITH_CLAIM |
| 32 | DROP (ROLE / USER / TOKEN / LUTYPE) | no single gate. Varies per DROP type, see breakdown below |
| 33 | GET | READ, optional granularity - only on dedicated LUs/IID; ALL; BATCH if inside a batch process; READ_WITH_CLAIM with claims validation |
| 34 | GETF | same as GET |
| 35 | GRANT | EDIT_ROLE (or ALL), plus per-resource granularity (a role with EDIT_ROLE scoped to one LU cannot grant/revoke permissions on a different LU) |
| 36 | HELP | none |
| 37 | JOBSTATUS | ALL |
| 38 | KILL | ALL |
| 39 | LIST | no single gate. Varies per LIST type, see breakdown below |
| 40 | MDB_EXPORT | READ |
| 41 | MDB_IMPORT | WRITE |
| 42 | MDB_SIZE | none |
| 43 | MEMORY_USAGE | ALL |
| 44 | MIGRATE | BATCH (delegates internally to BATCH) |
| 45 | MIGRATE_DETAILS | BATCH or BATCH_READ (delegates to BATCH_DETAILS) |
| 46 | MIGRATE_IN_PROCESS | BATCH or BATCH_READ (delegates to BATCH_IN_PROCESS) |
| 47 | MIGRATE_LIST | BATCH or BATCH_READ (delegates to BATCH_LIST) |
| 48 | MIGRATE_RESUME | BATCH (delegates to BATCH_RETRY) |
| 49 | MIGRATE_SUMMARY | BATCH or BATCH_READ (delegates to BATCH_SUMMARY) |
| 50 | PARSERSTATUS | ALL |
| 51 | K2PROFILER | ALL |
| 52 | PS | ALL |
| 53 | REF_BACKUP | ALL |
| 54 | REF_BACKUP_DELETE | ALL |
| 55 | REF_BACKUP_DOWNLOAD | ALL |
| 56 | REF_CANCEL | ALL |
| 57 | REF_STATUS | ALL |
| 58 | REF_SYNC | ALL |
| 59 | REF_SYNC_WAIT | ALL |
| 60 | REKEY_ENCRYPTED | ALL |
| 61 | RELEASE | none |
| 62 | RESTARTJOB | ALL |
| 63 | RESTARTPARSER | ALL |
| 64 | RESUMEJOB | ALL |
| 65 | REVOKE | EDIT_ROLE (or ALL), plus per-resource granularity (a role with EDIT_ROLE scoped to one LU cannot grant/revoke permissions on a different LU) |
| 66 | REVOKE ROLE | REVOKE_ROLE |
| 67 | REVOKE SECURITY_PROFILE | REVOKE_SECURITY_PROFILE |
| 68 | SEARCH | READ |
| 69 | SET | no single gate. Varies per option, see breakdown below |
| 70 | SET_GLOBAL |
SET_GLOBAL_GLOBAL - to set a GLOBAL or AFFINITY_RULES value cluster-wide.
SET_GLOBAL_ENVIRONMENT - to set the cluster's active environment.
SET_GLOBAL_CONFIG_OVERRIDES - to apply config overrides (CONFIG_OVERRIDES / _ADD / _REMOVE / _VERSION) cluster-wide.
|
| 71 | SHOW_DELTA | READ, optional granularity - only on dedicated LUs |
| 72 | STARTJOB | ALL |
| 73 | STARTPARSER | ALL |
| 74 | STOPJOB | ALL |
| 75 | STOPPARSER | ALL |
| 76 | STREAM_SYNC | ALL |
| 77 | SYNC_INSTANCE | none |
| 78 | TEST_CONNECTION | ALL |
| 79 | TIME | none |
| 80 | TRACE | ALL |
| 81 | UPDATEJOB | ALL |
| 82 | VERSION | ALL |
LIST per-type breakdown
LIST has no single gate. Permission enforcement is done per LIST type:
| LIST type | Required permission |
|---|
WS | LIST_SETTINGS |
DB_SOURCES | LIST_SETTINGS |
INTERFACES | LIST_SETTINGS |
LU_TYPES | LIST_SETTINGS |
LUT | LIST_SETTINGS |
ENVIRONMENTS | LIST_SETTINGS |
ENVS | LIST_SETTINGS |
INSTANCE_GROUPS | LIST_SETTINGS |
IGS | LIST_SETTINGS |
BROADWAY_FLOWS | LIST_SETTINGS |
BF | LIST_SETTINGS |
SECURITY_PROFILES | LIST_SETTINGS |
REF_BACKUPS | LIST_SETTINGS |
MTABLE | LIST_SETTINGS |
INSTANCES | READ. Can be with granularity of per-LU read |
CONFIG | READ_CONFIG |
CONFIG_OVERRIDES | READ_CONFIG |
CONFIG_OVERRIDES_HISTORY | READ_CONFIG |
AFFINITY_RULES | READ_CONFIG |
ROLES | ALL |
USERS | ALL |
TOKENS | ALL |
ROLE_PERMISSIONS | ALL |
METHODS | ALL |
DROP per-type breakdown
DROP has no single gate. Permission enforcement is done per each DROP type:
DROP <type> | Required permission |
|---|
ROLE | ALL |
USER | ALL |
TOKEN | ALL |
LUTYPE | DROP_LUTYPE, optional granularity per LU |
SET per-option breakdown
SET has no single gate for most options. It has two shapes: setting a global/LU-scoped variable by name and setting a session with a specific task.
SET <option/task> | Required permission |
|---|
SYNC | none |
INSTANCE_TTL | none |
ENVIRONMENT | SET_ENVIRONMENT OR SET_GLOBAL_ENVIRONMENT |
DB_PROXY (i.e. SET DB_INTERFACE_PROXY) | DB_INTERFACE_PROXY |
SYSTEM_DB_PROXY | SYSTEM_DB_PROXY |
CLUSTER_DISTRIBUTE_AFFINITY | any permission except ALL_WS |
OUTPUT | ALL |
LOG_ID, ASYNC_TRX, COMMON_LOCAL_TRX, FROM, CDC_PUBLISH, NODE_AFFINITY, and all other options | none |
SET <name>=<value> | none (a global/LU variable, not a session Option) |
SET (no args — show all) | none for session values; SET_READ to also see globals |
PROJECT_NAME, USERNAME, USER_ROLES, SCOPE, DEFAULT, IS_STUDIO | none (Read-only/unchangeable) |
