# Query privileges reference <sup style={{ fontSize: '0.6em', color: '#888' }}>Enterprise</sup>

This comprehensive reference provides detailed information about the privilege system in Memgraph, including which privileges are required for different types of queries and operations.

> **Info**
>
> This page complements the [Role-based access control](https://memgraph.com/docs/database-management/authentication-and-authorization/role-based-access-control) documentation by providing detailed privilege requirements for specific queries and operations.

Memgraph's privilege system controls access to various database operations through a comprehensive set of privileges. The system analyzes queries and determines the required privileges using the `PrivilegeExtractor` class, which implements the visitor pattern to traverse the Abstract Syntax Tree (AST) and extract privilege requirements.

## Cypher query privileges

### Basic operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `CREATE` | `CREATE` | `CREATE (n:Person {name: "Alice"})` |
| `MATCH` | `MATCH` | `MATCH (n:Person) RETURN n` |
| `DELETE` | `DELETE` | `MATCH (n) DELETE n` |
| `MERGE` | `MERGE` | `MERGE (n:Person {id: 1})` |
| `SET` (properties) | `SET` | `MATCH (n) SET n.name = "Bob"` |
| `SET` (labels) | `SET` | `MATCH (n) SET n:Employee` |
| `REMOVE` (properties) | `REMOVE` | `MATCH (n) REMOVE n.temp` |
| `REMOVE` (labels) | `REMOVE` | `MATCH (n) REMOVE n:Temp` |

### Complex queries

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `MATCH` + `DELETE` | `MATCH`, `DELETE` | `MATCH (n) DELETE n` |
| `MATCH` + `CREATE` | `MATCH`, `CREATE` | `MATCH (n) CREATE (m)-[:KNOWS]->(n)` |
| `MATCH` + `SET` | `MATCH`, `SET` | `MATCH (n) SET n.updated = true` |
| `MATCH` + `REMOVE` | `MATCH`, `REMOVE` | `MATCH (n) REMOVE n:Old` |

## Index operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `CREATE INDEX` | `INDEX` | `CREATE INDEX ON :Person(name)` |
| `DROP INDEX` | `INDEX` | `DROP INDEX ON :Person(name)` |
| `CREATE EDGE INDEX` | `INDEX` | `CREATE EDGE INDEX ON :KNOWS` |
| `CREATE TEXT INDEX` | `INDEX` | `CREATE TEXT INDEX ON :Person(name)` |
| `CREATE VECTOR INDEX` | `INDEX` | `CREATE VECTOR INDEX ON :Document(embedding)` |
| `CREATE TEXT EDGE INDEX` | `INDEX` | `CREATE TEXT EDGE INDEX ON :KNOWS(description)` |
| `CREATE VECTOR EDGE INDEX` | `INDEX` | `CREATE VECTOR EDGE INDEX ON :SIMILAR(embedding)` |
| `ANALYZE GRAPH` | `INDEX` | `ANALYZE GRAPH` |
| `DROP ALL INDEXES` | `INDEX` | `DROP ALL INDEXES` |

## Constraint operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `CREATE CONSTRAINT` | `CONSTRAINT` | `CREATE CONSTRAINT ON (n:Person) ASSERT n.id IS UNIQUE` |
| `DROP CONSTRAINT` | `CONSTRAINT` | `DROP CONSTRAINT ON (n:Person) ASSERT n.id IS UNIQUE` |
| `DROP ALL CONSTRAINTS` | `CONSTRAINT` | `DROP ALL CONSTRAINTS` |

## Authentication and authorization

| Query Type | Required Privileges | Special Cases |
|------------|-------------------|---------------|
| `CREATE ROLE` | `AUTH` | |
| `DROP ROLE` | `AUTH` | |
| `SHOW ROLES` | `AUTH` | |
| `CREATE USER` | `AUTH` | |
| `SET PASSWORD` | `AUTH` | |
| `CHANGE PASSWORD` | **None** | Users can change their own password. |
| `DROP USER` | `AUTH` | |
| `SHOW CURRENT USER` | **None** | Users can always see their own info. |
| `SHOW CURRENT ROLE` | **None** | Users can always see their current role. |
| `SHOW USERS` | `AUTH` | |
| `SET ROLE` | `AUTH` | |
| `CLEAR ROLE` | `AUTH` | |
| `GRANT PRIVILEGE` | `AUTH` | |
| `DENY PRIVILEGE` | `AUTH` | |
| `REVOKE PRIVILEGE` | `AUTH` | |
| `SHOW PRIVILEGES` | `AUTH` | |
| `SHOW ROLE FOR USER` | `AUTH` | |
| `SHOW USERS FOR ROLE` | `AUTH` | |
| `GRANT DATABASE TO USER` | `AUTH` | |
| `DENY DATABASE FROM USER` | `AUTH` | |
| `REVOKE DATABASE FROM USER` | `AUTH` | |
| `SHOW DATABASE PRIVILEGES` | `AUTH` | |
| `SET MAIN DATABASE` | `AUTH` | |
| `GRANT IMPERSONATE USER` | `AUTH` | |
| `DENY IMPERSONATE USER` | `AUTH` | |

## Database information queries

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `SHOW INDEX INFO` | `INDEX` | `SHOW INDEX INFO` |
| `SHOW EDGE TYPES` | `INDEX` | `SHOW EDGE_TYPES INFO` |
| `SHOW NODE LABELS` | `INDEX` | `SHOW NODE_LABELS INFO` |
| `SHOW VECTOR INDEX INFO` | `INDEX` | `SHOW VECTOR INDEX INFO` |
| `SHOW CONSTRAINT INFO` | `CONSTRAINT` | `SHOW CONSTRAINT INFO` |
| `SHOW METRICS` | `STATS` | `SHOW METRICS INFO` |

## System information queries

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `SHOW STORAGE INFO` | `STATS` | `SHOW STORAGE INFO` |
| `SHOW BUILD INFO` | `STATS` | `SHOW BUILD INFO` |
| `SHOW ACTIVE USERS` | `STATS` | `SHOW ACTIVE USERS` |
| `SHOW LICENSE INFO` | `CONFIG` | `SHOW LICENSE INFO` |
| `SHOW INSTANCE` | `STATS` | `SHOW INSTANCE` |
| `SHOW INSTANCES` | `STATS` | `SHOW INSTANCES` |

## Administrative operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `DUMP DATABASE` | `DUMP` | `DUMP DATABASE` |
| `LOCK DATA DIRECTORY` | `DURABILITY` | `LOCK DATA DIRECTORY` |
| `UNLOCK DATA DIRECTORY` | `DURABILITY` | `UNLOCK DATA DIRECTORY` |
| `DATA DIRECTORY LOCK STATUS` | `DURABILITY` | `DATA DIRECTORY LOCK STATUS` |
| `FREE MEMORY` | `FREE_MEMORY` | `FREE MEMORY` |
| `SHOW CONFIG` | `CONFIG` | `SHOW CONFIG` |
| `SET [GLOBAL] PARAMETER` | `SERVER_SIDE_PARAMETERS` | `SET GLOBAL PARAMETER x = 'value'` |
| `UNSET [GLOBAL] PARAMETER` | `SERVER_SIDE_PARAMETERS` | `UNSET PARAMETER x` |
| `SHOW PARAMETERS` | `SERVER_SIDE_PARAMETERS` | `SHOW PARAMETERS` |
| `SET DESCRIPTION ON ...` | `SERVER_SIDE_DESCRIPTIONS` | `SET DESCRIPTION ON LABEL :Person "A person node"` |
| `DELETE DESCRIPTION ON ...` | `SERVER_SIDE_DESCRIPTIONS` | `DELETE DESCRIPTION ON LABEL :Person` |
| `SHOW DESCRIPTIONS` | `SERVER_SIDE_DESCRIPTIONS` | `SHOW DESCRIPTIONS` |
| `CREATE TRIGGER` | `TRIGGER` | `CREATE TRIGGER ...` |
| `DROP TRIGGER` | `TRIGGER` | `DROP TRIGGER ...` |
| `SHOW TRIGGERS` | `TRIGGER` | `SHOW TRIGGERS` |
| `SHOW TRIGGER INFO` | `TRIGGER` | `SHOW TRIGGER INFO` |
| `CREATE STREAM` | `STREAM` | `CREATE STREAM ...` |
| `DROP STREAM` | `STREAM` | `DROP STREAM ...` |
| `SET ISOLATION LEVEL` | `CONFIG` | `SET ISOLATION LEVEL ...` |
| `SET STORAGE MODE` | `STORAGE_MODE` | `SET STORAGE MODE ...` |
| `CREATE SNAPSHOT` | `DURABILITY` | `CREATE SNAPSHOT` |
| `RECOVER SNAPSHOT` | `DURABILITY` | `RECOVER SNAPSHOT` |
| `SHOW SNAPSHOTS` | `DURABILITY` | `SHOW SNAPSHOTS` |
| `SHOW NEXT SNAPSHOT` | `DURABILITY` | `SHOW NEXT SNAPSHOT` |
| `SET SETTING` | `CONFIG` | `SET SETTING ...` |
| `SHOW VERSION` | `STATS` | `SHOW VERSION` — on coordinators it requires `COORDINATOR_READ` instead, see [Coordinator operations](#coordinator-operations). |
| `SHOW TRANSACTIONS` | `TRANSACTION_MANAGEMENT` | `SHOW TRANSACTIONS` |
| `TERMINATE TRANSACTIONS` | `TRANSACTION_MANAGEMENT` | `TERMINATE TRANSACTIONS 'transaction_id'` |
| `TERMINATE TRANSACTIONS "*"` | `TRANSACTION_MANAGEMENT` | `TERMINATE TRANSACTIONS "*"` terminates every transaction the user may terminate. Without the privilege, only the user's own transactions are terminated. |
| `RELOAD BOLT_SERVER TLS` | `RELOAD_TLS` | `RELOAD BOLT_SERVER TLS` |
| `RELOAD INTRA_CLUSTER TLS` | `RELOAD_TLS` | `RELOAD INTRA_CLUSTER TLS` |

## Replication operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `REPLICATION` operations | `REPLICATION` | Various replication commands. |
| `SHOW REPLICATION ROLE` | `REPLICATION` | `SHOW REPLICATION ROLE` |
| `SHOW REPLICAS` | `REPLICATION` | `SHOW REPLICAS` |
| `SHOW REPLICATION LAG` | `COORDINATOR_READ` | Coordinators only — see [Coordinator operations](#coordinator-operations). |

## Multi-database operations

| Query Type | Required Privileges | Special Cases |
|------------|-------------------|---------------|
| `CREATE DATABASE` | `MULTI_DATABASE_EDIT` | |
| `DROP DATABASE` | `MULTI_DATABASE_EDIT` | |
| `RENAME DATABASE` | `MULTI_DATABASE_EDIT` | |
| `SUSPEND DATABASE` | `MULTI_DATABASE_EDIT` | Enterprise only. |
| `RESUME DATABASE` | `MULTI_DATABASE_EDIT` | Enterprise only. |
| `DROP DATABASE FORCE` | `MULTI_DATABASE_EDIT`, `TRANSACTION_MANAGEMENT` | Requires both privileges. |
| `USE DATABASE` | `MULTI_DATABASE_USE` | |
| `SHOW DATABASE` | **None** | Users can see current database. |
| `SHOW DATABASES` | `MULTI_DATABASE_USE` | |

## Enum operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `CREATE ENUM` | `CREATE` | `CREATE ENUM ...` |
| `SHOW ENUMS` | `STATS` | `SHOW ENUMS` |
| `ALTER ENUM ADD VALUE` | `CREATE` | `ALTER ENUM ... ADD VALUE ...` |
| `ALTER ENUM UPDATE VALUE` | `CREATE` | `ALTER ENUM ... UPDATE VALUE ...` |
| `ALTER ENUM REMOVE VALUE` | `DELETE` | `ALTER ENUM ... REMOVE VALUE ...` |
| `DROP ENUM` | `DELETE` | `DROP ENUM ...` |

## TTL operations

| Query Type | Required Privileges | Note |
|------------|-------------------|------|
| `TTL` operations | `CONFIG`, `INDEX`, `MATCH`, `DELETE` | Requires multiple privileges. |

## Coordinator operations

These privileges apply **only on [high availability
coordinators](https://memgraph.com/docs/clustering/high-availability/coordinator-authentication)**. They
are granted to roles that live in the coordinators' Raft-replicated cluster
state, not in the data-instance auth store, and are not part of the
data-instance privilege set — `GRANT ALL PRIVILEGES` on a data instance does not
grant them.

`COORDINATOR_WRITE` is a superset of `COORDINATOR_READ`: a `COORDINATOR_WRITE`
grant satisfies a `COORDINATOR_READ` requirement. A session that connected to a
coordinator with basic auth carries both implicitly.

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| Routing table (Bolt `ROUTE` message) | `COORDINATOR_READ` | Any `neo4j://` connection. |
| `SHOW INSTANCE` / `SHOW INSTANCES` | `COORDINATOR_READ` | `SHOW INSTANCES` |
| `SHOW COORDINATOR SETTINGS` | `COORDINATOR_READ` | `SHOW COORDINATOR SETTINGS` |
| `SHOW REPLICATION LAG` | `COORDINATOR_READ` | `SHOW REPLICATION LAG` |
| `SHOW ROLES` / `SHOW PRIVILEGES FOR ROLE` | `COORDINATOR_READ` | `SHOW PRIVILEGES FOR ROLE dba` |
| `SHOW CONFIG`, `SHOW SETTING`, system info queries | `COORDINATOR_READ` | `SHOW CONFIG` |
| `SHOW VERSION` | `COORDINATOR_READ` | `SHOW VERSION` |
| `SHOW CURRENT USER` / `SHOW CURRENT ROLE` | **None** | Self-service identity queries. |
| Cluster management operations | `COORDINATOR_WRITE` | `REGISTER INSTANCE`, `SET INSTANCE ... TO MAIN`, `ADD COORDINATOR`, `YIELD LEADERSHIP`, `FORCE RESET CLUSTER STATE`, … |
| `SET COORDINATOR SETTING` / `SET SETTING` | `COORDINATOR_WRITE` | `SET COORDINATOR SETTING 'sync_failover_only' TO 'true'` |
| `CREATE ROLE` / `DROP ROLE` / `GRANT` / `REVOKE` | `COORDINATOR_WRITE` | `GRANT COORDINATOR_READ TO analyst` |
| `COORDINATOR` operations | `COORDINATOR` | Various coordinator commands. |
| `SHOW COORDINATOR SETTINGS` | `COORDINATOR` | `SHOW COORDINATOR SETTINGS` |
| `SHOW ROUTING TABLE` | `COORDINATOR` | `SHOW ROUTING TABLE` |

> **Warning**
>
> **Breaking change in Memgraph 3.13:** the `COORDINATOR` privilege was removed
> and replaced by `COORDINATOR_READ` and `COORDINATOR_WRITE`. It never gated any
> operation and is no longer accepted in `GRANT` / `DENY` / `REVOKE` statements.

## Schema information

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `SHOW SCHEMA INFO` | `STATS` | `SHOW SCHEMA INFO` |

## User profile operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `USER PROFILE` operations | `PROFILE_RESTRICTION` | User profile management. |
| `TENANT PROFILE` operations | `PROFILE_RESTRICTION` | [Tenant profile](https://memgraph.com/docs/database-management/tenant-profiles) management — covers `CREATE`, `ALTER`, `DROP`, `SHOW`, `SET ON DATABASE`, and `REMOVE FROM DATABASE`. |

## Procedure calls

| Procedure Type | Required Privileges | Example |
|----------------|-------------------|---------|
| `mg.get_module_files` | `MODULE_READ` | `CALL mg.get_module_files()` |
| `mg.create_module_file` | `MODULE_WRITE` | `CALL mg.create_module_file(...)` |
| `mg.update_module_file` | `MODULE_WRITE` | `CALL mg.update_module_file(...)` |
| `mg.get_module_file` | `MODULE_READ` | `CALL mg.get_module_file(...)` |
| `mg.delete_module_file` | `MODULE_WRITE` | `CALL mg.delete_module_file(...)` |
| Other procedures | **Procedure-specific** | Depends on procedure definition. |

## File operations

| Query Type | Required Privileges | Example |
|------------|-------------------|---------|
| `LOAD CSV` | `READ_FILE` | `LOAD CSV FROM "file.csv" AS row` |

## Special cases

| Query Type | Required Privileges | Notes |
|------------|-------------------|-------|
| `EXPLAIN` | **Inherits privileges from inner query** | Privileges depend on the explained query. |
| `PROFILE` | **Inherits privileges from inner query** | Privileges depend on the profiled query. |
| `SET SESSION TRACE` | **None** | No privileges required. |

### Examples

```cypher
-- EXPLAIN inherits privileges from the inner query
EXPLAIN MATCH (n:Person) RETURN n;  -- Requires MATCH privilege

-- PROFILE inherits privileges from the inner query
PROFILE CREATE (n:Person {name: "Alice"});  -- Requires CREATE privilege
```

## Troubleshooting

### Common privilege errors

> **Warning**
>
> If you encounter "Vertex not created due to not having enough permission!" errors, you likely need to grant fine-grained access control privileges to the user.

### Checking privileges

```cypher
-- Show all privileges for a user or role
SHOW PRIVILEGES FOR username;

-- Show privileges in specific database context
SHOW PRIVILEGES FOR username ON DATABASE db_name;

-- Verify the current logged-in user
SHOW CURRENT USER;

-- Show current user's privileges
SHOW PRIVILEGES FOR CURRENT USER;
```

### Privilege inheritance

Remember that:
- **Grants**: If any role grants a permission, the user has that permission
- **Denies**: If any role denies a permission, the user is denied that permission
- **Database Access**: If any role grants access to a database, the user has access
- **Fine-grained Permissions**: Combined using the same grant/deny logic

> **Info**
>
> Privilege changes take effect after the user reconnects to the database.