Docs

RDS for MySQL

Managing accounts

GrantDBAccountPrivilege

Call the GrantDBAccountPrivilege API to grant database privileges to a specified database account.

Request type

Synchronous request.

Request parameters

Name	Type	Required	Example	Description
InstanceId	String	Yes	mysql-62e07c2c****	Instance ID.
AccountName	String	Yes	testuser	Account name.
Host	String	No	%	The IP address from which the account accesses the database. Default value: `%`.
AccountPrivileges	Object[]	Yes	[ { "DBName":"db1", "AccountPrivilege":"ReadWrite" } ]	Reset account authorization information.
AccountPrivilege	String	Yes	ReadWrite	The type of database privilege. Valid values: `ReadWrite`: Read and write privileges. `ReadOnly`: Read-only privileges. `DDLOnly`: DDL privileges only. `DMLOnly`: DML privileges only. `Custom`: Custom privileges. `Global`: Global privileges. `None`: Clear account privileges. tip When used as a request parameter, note the following: Only `Global` and `None` are allowed as values when used as a request parameter. The privilege type is single-select; passing multiple values will result in an error. Only the GrantDBAccountPrivilege API supports setting AccountPrivilege to `None`. When AccountPrivilege is set to `None`: If DBName is an empty string, all global privileges of the account are cleared. If DBName is a specified database, all privileges of the account on that database are cleared.
AccountPrivilegeDetail	String	No	SELECT,INSERT,UPDATE	The privilege information of the account. When AccountPrivilege is set to `Custom`, the valid values for this field are: `SELECT` `INSERT` `UPDATE` `DELETE` `CREATE` `DROP` `REFERENCES` `INDEX` `ALTER` `CREATE TEMPORARY TABLES` `LOCK TABLES` `EXECUTE` `CREATE VIEW` `SHOW VIEW` `EVENT` `TRIGGER` `CREATE ROUTINE` `ALTER ROUTINE` When AccountPrivilege is set to `Global`, the valid values for this field are: `PROCESS` `REPLICATION SLAVE` `REPLICATION CLIENT` `SELECT` `INSERT` `UPDATE` `DELETE` `CREATE` `DROP` `RELOAD` `REFERENCES` `INDEX` `ALTER` `LOCK TABLES` `EXECUTE` `CREATE VIEW` `SHOW VIEW` `CREATE ROUTINE` `ALTER ROUTINE` `CREATE USER` `EVENT` `TRIGGER` `SHOW DATABASES` `CREATE TEMPORARY TABLES` tip When used as a request parameter, this field is required if AccountPrivilege is set to `Custom`. In the CreateDBAccount API, the account is automatically granted the global privileges `REPLICATION SLAVE`, `PROCESS`, and `REPLICATION CLIENT`. Multiple values are allowed. Separate multiple privileges with commas (,). The write method is overwrite.
DBName	String	Yes	testdb1	The name of the database for which the account authorization needs to be modified or for which the account already has permissions. tip When used as a request parameter in the CreateDBAccount and GrantDBAccountPrivilege APIs, ensure that the database corresponding to DBName already exists. When modifying global authorization, pass an empty string for DBName.
DryRun	Boolean	No	true	Whether to retrieve the SQL statements for granting privileges to the account. Valid values: `true`: Yes. `false`: No. Default value. tip When the value is `true`, the `GrantPrivilegeSQL` field will be returned (the account will not actually be granted privileges). When the value is `false` or not provided, it returns null.
TableColumnPrivileges	Object[]	No	Refer to the request example.	Column-level privilege settings for the account.
DBName	String	Yes	TestDatabase	The name of the database to which the table for account permission settings belongs.
TablePrivileges	Object[]	No	Please refer to the request example.	The table permission information of the account.
TableName	String	Yes	TestTable	The name of the table for setting account permissions.
AccountPrivilegeDetail	String	No	"ALTER,CREATE"	Table permissions for the account. Valid values (multiple selections allowed): `ALTER` `CREATE` `DELETE` `DROP` `INDEX` `INSERT` `SELECT` `SHOW VIEW` `TRIGGER` `UPDATE` `CREATE VIEW` `REFERENCES` tip Separate multiple permissions with English commas (,).
ColumnPrivileges	Object[]	No	Please refer to the request example.	The column permission information of the account.
TableName	String	Yes	Table1	The name of the database to which the table with column-level permissions for the account belongs.
ColumnName	String	Yes	Column1	The name of the column for which column-level permissions are set for the account.
AccountPrivilegeDetail	String	No	"UPDATE,INSERT"	The permission information for column-level permissions set for the account. Valid values (multiple selections allowed): `INSERT` `REFERENCES` `SELECT` `UPDATE` tip Separate multiple permissions with English commas (,).

Response parameters

Name	Type	Example	Description
GrantPrivilegeSQL	String[]	[ "REVOKE ALL PRIVILEGES ON `t1`.* FROM TestAccount@'%';", "GRANT SELECT,LOCK TABLES,SHOW VIEW ON `t1`.* TO TestAccount@'%';" ]	The SQL statement used to grant privileges to the account based on the request parameters. Returned when `DryRun` is set to `true`.

Sample request

POST /?Action=GrantDBAccountPrivilege&Version=2022-01-01 HTTP/1.1
Content-Type: application/json
Host: rds-mysql.cn-beijing.volcengineapi.com
X-Date: 20211202T101010Z
Authorization: HMAC-SHA256 Credential=AKLTN2I0MmFiNzMxNWE5NDgzMzk4MmVjMTVkODlkZTZ****/20211202/cn-beijing/rds_mysql/request,SignedHeaders=x-date, Signature=71d31fc7bcf990142851c9833c5656391486cda0ae2e0b8ada733b7c6458****
{
    "InstanceId": "mysql-62e07c2c****",
    "AccountName": "test",
    "AccountPrivileges": [
        {
            "DBName": "testdb",
            "AccountPrivilege": "DDLOnly",
            "AccountPrivilegeDetail": ""
        },
        {
            "DBName": "testdb1",
            "AccountPrivilege": "ReadOnly",
            "AccountPrivilegeDetail": ""
        }
    ]
}

Sample response

{
    "ResponseMetadata": {
        "RequestId": "20230116115015A96C208EE46C00F7D56B",
        "Action": "GrantDBAccountPrivilege",
        "Version": "2022-01-01",
        "Service": "rds_mysql",
        "Region": "cn-beijing"
    },
    "Result": null
}

Error codes

For more details, refer to Error codes.

Last updated: 2025.07.07 15:52:02

RDS for MySQL

Request type #

Request parameters #

Response parameters #

Sample request #