Help Center/ GeminiDB/ API Reference/ Permissions and Supported Actions/ Actions Supported by Policy-based Authorization
Updated on 2026-09-22 GMT+08:00
View PDF
Share

Actions Supported by Policy-based Authorization

This section describes the actions supported by GeminiDB in policy-based authorization.

Supported Actions

GeminiDB provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Actions supported by policies are specific to APIs. Common concepts related to policies include:

  • Permissions: statements that allow or deny certain operations
  • APIs: REST APIs that can be called by a user who has been granted specific permissions.
  • Actions: specific operations that are allowed or denied in a custom policy.
  • Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
  • IAM or enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

GeminiDB supports the following actions in custom policies:

"√" indicates that the permission is supported, and "x" indicates that the permission is not supported.

Table 1 Querying API versions

Permission

API

Action

IAM Project

Enterprise Project

Querying API versions

GET /

-

-

-

Querying API version information

GET /{version}

-

-

-
Table 2 API version and specifications

Permission

API

Action

IAM Project

Enterprise Project

Querying database specifications

GET /v3.1/{project_id}/flavors

-

-

-

Querying database version information

GET /v3/{project_id}/datastores/{datastore_name}/versions

-

-

-

Querying dedicated resources

GET /v3/{project_id}/dedicated-resources

-

-

-
Table 3 Instance management

Permission

API

Action

IAM Project

Enterprise Project

Creating an instance

POST /v3/{project_id}/instances

nosql:instance:create

√

√

Deleting an instance

DELETE /v3/{project_id}/instances/{instance_id}

nosql:instance:delete

√

√

Querying instances and details

GET /v3/{project_id}/instances

nosql:instance:list

√

√

Scaling up storage

POST /v3/{project_id}/instances/{instance_id}/extend-volume

nosql:instance:modifyStorageSize

√

√

Adding nodes for a cluster instance

POST /v3/{project_id}/instances/{instance_id}/enlarge-node

nosql:instance:extendNode

√

√

Deleting nodes from a cluster instance

POST /v3/{project_id}/instances/{instance_id}/reduce-node

nosql:instance:reduceNode

√

√

Obtaining node sessions

GET /v3/{project_id}/redis/nodes/{node_id}/sessions

nosql:session:list

√

√

Querying session statistics of an instance node

GET /v3/{project_id}/redis/nodes/{node_id}/session-statistics

nosql:session:list

√

√

Closing sessions on an instance node

DELETE /v3/{project_id}/redis/nodes/{node_id}/sessions

nosql:session:delete

√

√

Querying changeable specifications

GET /v3/{project_id}/instances/{instance_id}/available-flavors

nosql:instance:list

√

√

Changing instance specifications

PUT /v3/{project_id}/instances/{instance_id}/resize

nosql:instance:modifySpecification

√

√

Changing the administrator password

PUT /v3/{project_id}/instances/{instance_id}/password

nosql:instance:modifyPasswd

√

√

Changing an instance name

PUT /v3/{project_id}/instances/{instance_id}/name

nosql:instance:rename

√

√

Changing the security group of an instance

PUT /v3/{project_id}/instances/{instance_id}/security-group

nosql:instance:modifySecurityGroup

√

√

Patching a database

POST /v3/{project_id}/instances/{instance_id}/db-upgrade

nosql:instance:upgradeDatabaseVersion

√

√

Patching databases in batches

POST /v3/{project_id}/instances/db-upgrade

nosql:instance:batchUpgradeDatabaseVersion

√

√

Creating cold storage

POST /v3/{project_id}/instances/{instance_id}/cold-volume

nosql:instance:modifyStorageSize

√

√

Scaling up cold storage

PUT /v3/{project_id}/instances/{instance_id}/cold-volume

nosql:instance:modifyStorageSize

√

√

Binding or unbinding an EIP

POST /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/public-ip

nosql:instance:bindPublicIp

√

√

Enabling or disabling SSL

POST /v3/{project_id}/instances/{instance_id}/ssl-option

nosql:instance:switchSSL

√

√

Restarting an instance or node

POST /v3/{project_id}/instances/{instance_id}/restart

nosql:instance:restart

√

√

Setting an autoscaling policy for storage

PUT /v3/{project_id}/instances/disk-auto-expansion

nosql:instance:modifyStorageSize

√

√

Changing a database port

PUT /v3/{project_id}/instances/{instance_id}/port

nosql:instance:modifyPort

√

√

Checking password strength

POST /v3/{project_id}/weak-password-verification

-

-

-

Configuring access to a replica set across CIDR blocks

POST /v3/{project_id}/instances/{instance_id}/client-network

nosql:instance:setSourceSubnet

√

√

Deleting nodes that failed to be added

DELETE /v3/{project_id}/instances/{instance_id}/enlarge-failed-nodes

nosql:instance:delete

√

√

Querying IP addresses required for creating an instance or adding nodes

GET /v3/{project_id}/ip-num-requirement

-

-

-

Querying the autoscaling policy

GET /v3/{project_id}/instances/{instance_id}/disk-auto-expansion

nosql:instance:list

√

√

Scaling instance storage

PUT /v3/{project_id}/instances/{instance_id}/volume

nosql:instance:modifyStorageSize

√

√

Querying high-risk commands

GET /v3/{project_id}/instances/{instance_id}/high-risk-commands

nosql:command:list

√

√

Modifying high-risk commands

PUT /v3/{project_id}/instances/{instance_id}/high-risk-commands

nosql:instances:modifyHighRiskCommands

√

√

Querying hot keys of a GeminiDB Redis instance

GET /v3/{project_id}/instances/{instance_id}/hot-keys

nosql:instance:getHotKeys

√

√

Setting disabled commands for a GeminiDB Redis instance

POST /v3/{project_id}/redis/instances/{instance_id}/disabled-commands

nosql:instance:setRedisDisabledCommands

√

√

Querying disabled commands for a GeminiDB Redis instance

GET /v3/{project_id}/redis/instances/{instance_id}/disabled-commands

nosql:instance:listRedisDisabledCommands

√

√

Deleting disabled commands for a GeminiDB Redis instance

DELETE /v3/{project_id}/redis/instances/{instance_id}/disabled-commands

nosql:instance:deleteRedisDisabledCommands

√

√

Setting the maintenance period of an instance

PUT /v3/{project_id}/instances/{instance_id}/maintenance-window

nosql:instance:modifyMaintenanceWindow

√

√

Performing a primary/standby switchover for GeminiDB Redis instances

PUT /v3/{project_id}/instance/{instance_id}/switchover

nosql:instance:switchover

√

√

Starting and stopping nodes

PUT /v3/{project_id}/instances/{instance_id}/nodes

nosql:instance:switchNodeStatus

√

√

Querying big keys of a GeminiDB Redis instance

POST /v3/{project_id}/instances/{instance_id}/big-keys

nosql:instance:getBigKeys

√

√

Querying the password-free configuration of a GeminiDB Redis instance

GET /v3/{project_id}/instances/{instance_id}/passwordless-config

nosql:instance:getPasswordlessConfig

√

√

Modifying the password-free configuration of a GeminiDB Redis instance

PUT /v3/{project_id}/instances/{instance_id}/passwordless-config

nosql:instance:setPasswordlessConfig

√

√

Querying memory acceleration mappings and details

GET /v3/{project_id}/dbcache/mappings

nosql:instance:listDBCacheMappings

√

√

Creating a memory acceleration rule

POST /v3/{project_id}/dbcache/rule

nosql:instance:createDBCacheRule

√

√

Deleting a memory mapping

DELETE /v3/{project_id}/dbcache/mapping

nosql:instance:deleteDBCacheMapping

√

√

Creating a memory mapping

POST /v3/{project_id}/dbcache/mapping

nosql:instance:createDBCacheMapping

√

√

Modifying a memory acceleration rule

PUT /v3/{project_id}/dbcache/rule

nosql:instance:updateDBCacheRule

√

√

Querying memory acceleration rules and details

GET /v3/{project_id}/dbcache/rules

nosql:instance:listDBCacheRules

√

√

Deleting a memory acceleration rule

DELETE /v3/{project_id}/dbcache/rule

nosql:instance:deleteDBCacheRule

√

√

Enabling or disabling instance data export

PUT /v3/{project_id}/instances/{instance_id}/data-dump

nosql:instance:operateDataDump

√

√

Enabling or disabling second-level monitoring

PUT /v3/{project_id}/instances/{instance_id}/monitoring-by-seconds/switch

nosql:instance:secondLevelMonitoring

√

√

Querying second-level monitoring configurations

GET /v3/{project_id}/instances/{instance_id}/monitoring-by-seconds/switch

nosql:instance:secondLevelMonitoring

√

√

Configuring an automatic scale-out policy

PUT /v3/{project_id}/instances/{instance_id}/node-auto-expansion-policy

nosql:instance:extendNode

√

√

Querying an automatic scale-out policy

GET /v3/{project_id}/instances/{instance_id}/node-auto-expansion-policy

nosql:instance:list

√

√

Obtaining the SSL certificate download address

GET /v3/{project_id}/instances/{instance_id}/ssl-cert/download-link

nosql:instance:listDBCacheRules

√

√

Changing a load balancer address

PUT /v3/{project_id}/instances/{instance_id}/lb

nosql:instance:modifyInstanceLb

√

√
Table 4 Connection management

Permission

API

Action

IAM Project

Enterprise Project

Obtaining instance sessions

GET /v3/{project_id}/instances/{instance_id}/sessions

nosql:session:list

√

√

Closing all node sessions of an instance

DELETE /v3/{project_id}/instances/{instance_id}/sessions

nosql:session:delete

√

√
Table 5 Backup and restoration

Permission

API

Action

IAM Project

Enterprise Project

Querying backups

GET /v4/{project_id}/backups

nosql:backup:list

√

√

Querying backups

GET /v3.1/{project_id}/backups

nosql:backup:list

√

√

Querying an automated backup policy

GET /v3.1/{project_id}/instances/{instance_id}/backups/policy

nosql:backup:list

√

√

Querying an automated backup policy

GET /v3/{project_id}/instances/{instance_id}/backups/policy

nosql:backup:list

√

√

Setting an automated backup policy

PUT /v3/{project_id}/instances/{instance_id}/backups/policy

nosql:instance:modifyBackupPolicy

√

√

Querying instances that can be restored

GET /v3/{project_id}/backups/{backup_id}/restorable-instances

nosql:instance:list

√

√

Querying the time window when a backup can be restored

GET /v3/{project_id}/instances/{instance_id}/backups/restorable-time-periods

nosql:backup:list

√

√

Creating a manual backup

POST /v3/{project_id}/instances/{instance_id}/backups

nosql:backup:create

√

√

Deleting a manual backup

DELETE /v3/{project_id}/backups/{backup_id}

nosql:backup:delete

√

√

Restoring data to an existing instance

POST /v3/{project_id}/instances/{instance_id}/recovery

nosql:backup:refreshInstanceFromBacku

√

√

Querying a recycling policy

GET /v3/{project_id}/instances/recycle-policy

nosql:instance:list

√

√

Modifying a recycling policy

PUT /v3/{project_id}/instances/recycle-policy

nosql:recyclePolicy:set

√

√

Querying instances in the recycle bin

GET /v3/{project_id}/recycle-instances

nosql:instance:list

√

√

Obtaining GeminiDB Cassandra instance database information restored using tables

GET /v3/{project_id}/instances/{instance_id}/databases

nosql:backup:list

√

√

Obtaining GeminiDB Cassandra instance table information restored using tables

GET /v3/{project_id}/instances/{instance_id}/tables

nosql:backup:list

√

√

Restoring the current GeminiDB Redis instance to a specified point in time

PUT /v3/{project_id}/redis/instances/{instance_id}/pitr

nosql:instance:redisPitrRestore

√

√

Setting the policy for restoring a GeminiDB Redis instance to a specified point in time

PUT /v3/{project_id}/redis/instances/{instance_id}/pitr/policy

nosql:instance:setRedisPitrPolicy

√

√

Querying the policy for restoring a GeminiDB Redis instance to a specified point in time

GET /v3/{project_id}/redis/instances/{instance_id}/pitr/policy

nosql:instance:getRedisPitrPolicy

√

√

Querying the point in time to which a GeminiDB Redis instance can be restored

GET /v3/{project_id}/redis/instances/{instance_id}/pitr/restorable-time-periods

nosql:instance:listRedisPitrRestoreTime

√

√

Querying storage used for restoring a GeminiDB Redis instance to a specified point in time

GET /v3/{project_id}/redis/instances/{instance_id}/pitr

nosql:instance:getRedisPitrInfo

√

√

Stopping a backup

PUT /v3/{project_id}/backups/{backup_id}

nosql:backup:stop

√

√

Deleting manual backups in batches

DELETE /v3/{project_id}/instances/backups

nosql:backup:delete

√

√

Importing a data file to an existing instance

POST /v3/{project_id}/redis/instances/{instance_id}/recovery

nosql:instance:redisDataRestore

√

√
Table 6 Parameter settings

Permission

API

Action

IAM Project

Enterprise Project

Obtaining parameter templates

GET /v3.1/{project_id}/configurations

nosql:param:list

√

√

Applying a parameter template

PUT /v3.1/{project_id}/configurations/{config_id}/apply

nosql:instance:modifyParameter

√

√

Modifying parameters of a specified instance

PUT /v3.1/{project_id}/instances/{instance_id}/configurations

nosql:instance:modifyParameter

√

√

Obtaining parameter templates

GET /v3/{project_id}/configurations

nosql:param:list

√

√

Creating a parameter template

POST

/v3/{project_id}/configurations

nosql:param:create

√

√

Modifying parameters in a parameter template

PUT /v3/{project_id}/configurations/{config_id}

nosql:param:modify

√

√

Resetting a custom parameter template

POST /v3/{project_id}/configurations/{config_id}/reset

nosql:param:modify

√

√

Querying instance parameter settings

GET /v3/{project_id}/instances/{instance_id}/configurations

nosql:param:list

√

√

Applying a parameter template

PUT /v3/{project_id}/configurations/{config_id}/apply

nosql:instance:modifyParameter

√

√

Modifying parameters of a specified instance

PUT /v3/{project_id}/instances/{instance_id}/configurations

nosql:instance:modifyParameter

√

√

Obtaining parameters of a specified instance

GET /v3/{project_id}/instances/{instance_id}/configurations

nosql:param:list

√

√

Obtaining parameters of a specified parameter template

GET /v3/{project_id}/configurations/{config_id}

nosql:param:list

√

√

Deleting a parameter template

DELETE /v3/{project_id}/configurations/{config_id}

nosql:param:delete

√

√

Querying instances that a parameter template can be applied to

GET /v3/{project_id}/configurations/{config_id}/applicable-instances

nosql:instance:list

√

√

Viewing parameter change history of an instance

GET /v3/{project_id}/instances/{instance_id}/configuration-histories

nosql:param:list

√

√

Viewing application records of a parameter template

GET /v3/{project_id}/configurations/{config_id}/applied-histories

nosql:param:list

√

√

Comparing parameter templates

POST /v3/{project_id}/configurations/comparison

nosql:param:list

√

√

Replicating a parameter template

POST /v3/{project_id}/configurations/{config_id}/copy

nosql:param:create

√

√

Querying APIs that support parameter templates

GET /v3/{project_id}/configurations/datastores

-

-

-
Table 7 Managing databases and accounts

Permission

API

Action

IAM Project

Enterprise Project

Creating a database account

POST /v3/{project_id}/redis/instances/{instance_id}/db-users

nosql:instance:createDatabaseUser

√

√

Changing permissions for a database account

PUT /v3/{project_id}/redis/instances/{instance_id}/db-users/privilege

nosql:instance:modifyDbUserPrivilege

√

√

Resetting the password of a database account

PUT /v3/{project_id}/redis/instances/{instance_id}/db-users/password

nosql:instance:resetDatabaseUser

√

√

Deleting a database account

DELETE /v3/{project_id}/redis/instances/{instance_id}/db-users

nosql:instance:deleteDatabaseUser

√

√

Obtaining database accounts and details

GET /v3/{project_id}/redis/instances/{instance_id}/db-users

nosql:dbuser:list

√

√

Obtaining databases in an instance

GET /v3/{project_id}/redis/instances/{instance_id}/databases

nosql:instance:resetDatabaseUser

√

√

Performing operations on GeminiDB instances

PUT /v3/{project_id}/instances/{instance_id}/databases

nosql:instance:operateDatabase

√

√
Table 8 Tag management

Permission

API

Action

IAM Project

Enterprise Project

Querying an instance by tag

POST /v3/{project_id}/instances/resource_instances/action
  • nosql:instance:list
  • nosql:tag:list

√

√

Adding or deleting resource tags in batches

POST /v3/{project_id}/instances/{instance_id}/tags/action

nosql:instance:tag

√

√

Querying tags of an instance

GET /v3/{project_id}/instances/{instance_id}/tags
  • nosql:instance:list
  • nosql:tag:list

√

√

Querying project tags

GET /v3/{project_id}/tags

nosql:tag:list

√

√
Table 9 Log management

Permission

API

Action

IAM Project

Enterprise Project

Querying slow query logs

GET /v3/{project_id}/instances/{instance_id}/slowlog?start_date={start_date}&end_date={end_date}

nosql:instance:list

√

√

Querying slow query logs of GeminiDB Redis instances

POST /v3/{project_id}/redis/instances/{instance_id}/slow-logs

nosql:instance:list

√

√

Querying slow query logs of GeminiDB Influx instances

POST /v3/{project_id}/influxdb/instances/{instance_id}/slow-logs

nosql:instance:list

√

√

Querying slow query logs of GeminiDB Cassandra instances

POST /v3/{project_id}/cassandra/instances/{instance_id}/slow-logs

nosql:instance:list

√

√

Querying slow query logs of GeminiDB Mongo instances

POST /v3/{project_id}/mongodb/instances/{instance_id}/slow-logs

nosql:instance:list

√

√

Querying database error logs

GET /v3/{project_id}/instances/{instance_id}/error-log

nosql:instance:list

√

√

Querying error logs of GeminiDB Mongo instances

POST /v3/{project_id}/mongodb/instances/{instance_id}/error-logs

nosql:instance:list

√

√

Setting the desensitization status of slow query logs

PUT /v3/{project_id}/instances/{instance_id}/slowlog-desensitization

nosql:instance:modifySlowLogPlaintextSwitch

√

√

Querying the desensitization status of slow query logs

GET /v3/{project_id}/instances/{instance_id}/slowlog-desensitization

nosql:instance:list

√

√

Associating instances with an LTS log stream

POST /v3/{project_id}/instances/logs/lts-configs

nosql:instances:saveLtsStreams

√

√

Disassociating instances from an LTS log stream

DELETE /v3/{project_id}/instances/logs/lts-configs

nosql:instances:saveLtsStreams

√

√

Querying LTS log configurations

GET /v3/{project_id}/instances/logs/lts-configs

nosql:instances:saveLtsStreams

√

√
Table 10 Quota management

Permission

API

Action

IAM Project

Enterprise Project

Querying quotas

GET /v3/{project_id}/quotas

nosql:instance:list

√

√
Table 11 DR management

Permission

API

Action

IAM Project

Enterprise Project

Querying the dual-active relationship of an instance

GET /v3/{project_id}/instances/{instance_id}/disaster-recovery/regions

nosql:instance:list

√

√

Configuring conditions for triggering a DR switchover (failover) for an instance

PUT /v3/{project_id}/instances/disaster-recovery/settings

nosql:dr:setDisasterRecoverySettings

√

√

Querying the DR switchover configurations of instances

GET /v3/{project_id}/instances/disaster-recovery/settings

nosql:dr:listDisasterRecoverySettings

√

√

Creating active-active relationship

POST /v3/{project_id}/instances/{instance_id}/dual-active-relationship

nosql:instance:buildBiactiveInstance

√

√

Removing active-active relationship

DELETE /v3/{project_id}/instances/{instance_id}/dual-active-relationship

nosql:instance:releaseBiactiveInstance

√

√
Table 12 Task management

Permission

API

Action

IAM Project

Enterprise Project

Querying tasks and details

GET /v3/{project_id}/jobs

nosql:task:list

√

√

Querying the maintenance period of an instance

GET /v3/{project_id}/instances/{instance_id}/ops-window

nosql:instance:maintenanceWindow

√

√

Querying a scheduled task

GET /v3/{project_id}/scheduled-jobs

nosql:task:list

√

√

Canceling a scheduled task

DELETE /v3/{project_id}/scheduled-jobs/{job_id}

nosql:instance:cancelScheduleJob

√

√
Table 13 Enterprise project management

Permission

API

Action

IAM Project

Enterprise Project

Querying enterprise project quotas

GET /v3/{project_id}/enterprise-projects/quotas

nosql:quota:list

√

√

Modifying enterprise project quotas

PUT /v3/{project_id}/enterprise-projects/quotas

nosql:quota:modify

√

√
Table 14 Instance load balancer management

Permission

API

Action

IAM Project

Enterprise Project

Configuring the blacklist or whitelist of load balancer IP addresses

PUT /v3/{project_id}/instances/{instance_id}/lb/access-control

nosql:instance:modifyInstanceLb

√

√

Querying the blacklist or whitelist of load balancer IP addresses

GET /v3/{project_id}/instances/{instance_id}/lb/access-control

nosql:instance:list

√

√