kb-cloud-client-typescript 2.4.0-alpha.10 → 2.4.0-alpha.100

package/src/adminapi/apis/rdbms-api.ts

@@ -40,6 +40,20 @@ import type { DmsServiceAccountUpdateRequest } from '../models';
 // @ts-ignore
 import type { DmsSession } from '../models';
 // @ts-ignore
+import type { ObjectPrivilegeCapabilities } from '../models';
+// @ts-ignore
+import type { ObjectPrivilegeChange } from '../models';
+// @ts-ignore
+import type { ObjectPrivilegeEvidence } from '../models';
+// @ts-ignore
+import type { ObjectPrivilegeObjectList } from '../models';
+// @ts-ignore
+import type { ObjectPrivilegeResetStep } from '../models';
+// @ts-ignore
+import type { ObjectPrivilegeSnapshot } from '../models';
+// @ts-ignore
+import type { ObjectPrivilegeSubjectType } from '../models';
+// @ts-ignore
 import type { PrivilegeListItem } from '../models';
 /**
  * RdbmsApi - axios parameter creator
@@ -47,6 +61,80 @@ import type { PrivilegeListItem } from '../models';
  */
 export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration) {
     return {
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Grant or revoke native object and column privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeChange} body 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\"host\":\"%\"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        changeAccountObjectPrivileges: async (engineName: string, orgName: string, clusterName: string, accountName: string, body: ObjectPrivilegeChange, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('changeAccountObjectPrivileges', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('changeAccountObjectPrivileges', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('changeAccountObjectPrivileges', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('changeAccountObjectPrivileges', 'accountName', accountName)
+            // verify required parameter 'body' is not null or undefined
+            assertParamExists('changeAccountObjectPrivileges', 'body', body)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'PATCH', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+
+
+    
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+            localVarRequestOptions.data = serializeDataIfNeeded(body, localVarRequestOptions, configuration)
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * create an account in cluster
          * @summary Create cluster account
@@ -418,6 +506,232 @@ export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration
 
 
     
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary List native object privilege capabilities for the connected server
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivilegeCapabilities: async (engineName: string, orgName: string, clusterName: string, accountName: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('getAccountObjectPrivilegeCapabilities', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('getAccountObjectPrivilegeCapabilities', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('getAccountObjectPrivilegeCapabilities', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('getAccountObjectPrivilegeCapabilities', 'accountName', accountName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/capabilities`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Inspect native object and column privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {string} objectType 
+         * @param {string} [databaseName] 
+         * @param {string} [schemaName] 
+         * @param {string} [objectName] 
+         * @param {string} [objectId] 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [catalogName] 
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivileges: async (engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, objectName?: string, objectId?: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, catalogName?: string, subjectQualifiers?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('getAccountObjectPrivileges', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('getAccountObjectPrivileges', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('getAccountObjectPrivileges', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('getAccountObjectPrivileges', 'accountName', accountName)
+            // verify required parameter 'objectType' is not null or undefined
+            assertParamExists('getAccountObjectPrivileges', 'objectType', objectType)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (objectType !== undefined) {
+                localVarQueryParameter['objectType'] = objectType;
+            }
+
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+
+            if (schemaName !== undefined) {
+                localVarQueryParameter['schemaName'] = schemaName;
+            }
+
+            if (objectName !== undefined) {
+                localVarQueryParameter['objectName'] = objectName;
+            }
+
+            if (objectId !== undefined) {
+                localVarQueryParameter['objectId'] = objectId;
+            }
+
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+
+            if (catalogName !== undefined) {
+                localVarQueryParameter['catalogName'] = catalogName;
+            }
+
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+         * @summary Read native account privilege summary or selected database evidence
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] 
+         * @param {string} [databaseName] PostgreSQL database to inspect on demand. Omit for the global summary.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountPrivilegeOverview: async (engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseName?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('getAccountPrivilegeOverview', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('getAccountPrivilegeOverview', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('getAccountPrivilegeOverview', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('getAccountPrivilegeOverview', 'accountName', accountName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/overview`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+
+
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
@@ -657,25 +971,39 @@ export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration
             };
         },
         /**
-         * list accounts in cluster
-         * @summary List cluster accounts
-         * @param {string} engineName name of the engine
-         * @param {string} orgName name of the organization
-         * @param {string} clusterName name of the cluster
+         * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+         * @summary List exact column names for account object privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {string} objectType Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+         * @param {string} databaseName 
+         * @param {string} objectName 
+         * @param {string} [schemaName] Required for PostgreSQL; not accepted for MySQL
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listAccounts: async (engineName: string, orgName: string, clusterName: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+        listAccountObjectPrivilegeColumns: async (engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName: string, objectName: string, schemaName?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'engineName' is not null or undefined
-            assertParamExists('listAccounts', 'engineName', engineName)
+            assertParamExists('listAccountObjectPrivilegeColumns', 'engineName', engineName)
             // verify required parameter 'orgName' is not null or undefined
-            assertParamExists('listAccounts', 'orgName', orgName)
+            assertParamExists('listAccountObjectPrivilegeColumns', 'orgName', orgName)
             // verify required parameter 'clusterName' is not null or undefined
-            assertParamExists('listAccounts', 'clusterName', clusterName)
-            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts`
+            assertParamExists('listAccountObjectPrivilegeColumns', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('listAccountObjectPrivilegeColumns', 'accountName', accountName)
+            // verify required parameter 'objectType' is not null or undefined
+            assertParamExists('listAccountObjectPrivilegeColumns', 'objectType', objectType)
+            // verify required parameter 'databaseName' is not null or undefined
+            assertParamExists('listAccountObjectPrivilegeColumns', 'databaseName', databaseName)
+            // verify required parameter 'objectName' is not null or undefined
+            assertParamExists('listAccountObjectPrivilegeColumns', 'objectName', objectName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/columns`
                 .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
                 .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
-                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)));
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -694,6 +1022,22 @@ export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration
             // authentication DigestAuth required
             await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
 
+            if (objectType !== undefined) {
+                localVarQueryParameter['objectType'] = objectType;
+            }
+
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+
+            if (objectName !== undefined) {
+                localVarQueryParameter['objectName'] = objectName;
+            }
+
+            if (schemaName !== undefined) {
+                localVarQueryParameter['schemaName'] = schemaName;
+            }
+
 
     
             setSearchParams(localVarUrlObj, localVarQueryParameter);
@@ -706,25 +1050,159 @@ export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration
             };
         },
         /**
-         * list databases for rdbms engine cluster
-         * @summary List cluster databases
-         * @param {string} engineName name of the engine
-         * @param {string} orgName name of the Org
-         * @param {string} clusterName name of the Cluster
+         * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+         * @summary Discover existing native privilege objects with stable routine identities
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {string} objectType 
+         * @param {string} [databaseName] 
+         * @param {string} [schemaName] 
+         * @param {number} [offset] 
+         * @param {number} [limit] 
+         * @param {string} [catalogName] 
          * @param {*} [options] Override http request option.
          * @throws {RequiredError}
          */
-        listDatabases: async (engineName: string, orgName: string, clusterName: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+        listAccountObjectPrivilegeObjects: async (engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, offset?: number, limit?: number, catalogName?: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
             // verify required parameter 'engineName' is not null or undefined
-            assertParamExists('listDatabases', 'engineName', engineName)
+            assertParamExists('listAccountObjectPrivilegeObjects', 'engineName', engineName)
             // verify required parameter 'orgName' is not null or undefined
-            assertParamExists('listDatabases', 'orgName', orgName)
+            assertParamExists('listAccountObjectPrivilegeObjects', 'orgName', orgName)
             // verify required parameter 'clusterName' is not null or undefined
-            assertParamExists('listDatabases', 'clusterName', clusterName)
-            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/databases`
+            assertParamExists('listAccountObjectPrivilegeObjects', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('listAccountObjectPrivilegeObjects', 'accountName', accountName)
+            // verify required parameter 'objectType' is not null or undefined
+            assertParamExists('listAccountObjectPrivilegeObjects', 'objectType', objectType)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/objects`
                 .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
                 .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
-                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)));
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (objectType !== undefined) {
+                localVarQueryParameter['objectType'] = objectType;
+            }
+
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+
+            if (schemaName !== undefined) {
+                localVarQueryParameter['schemaName'] = schemaName;
+            }
+
+            if (offset !== undefined) {
+                localVarQueryParameter['offset'] = offset;
+            }
+
+            if (limit !== undefined) {
+                localVarQueryParameter['limit'] = limit;
+            }
+
+            if (catalogName !== undefined) {
+                localVarQueryParameter['catalogName'] = catalogName;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * list accounts in cluster
+         * @summary List cluster accounts
+         * @param {string} engineName name of the engine
+         * @param {string} orgName name of the organization
+         * @param {string} clusterName name of the cluster
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccounts: async (engineName: string, orgName: string, clusterName: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('listAccounts', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('listAccounts', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('listAccounts', 'clusterName', clusterName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * list databases for rdbms engine cluster
+         * @summary List cluster databases
+         * @param {string} engineName name of the engine
+         * @param {string} orgName name of the Org
+         * @param {string} clusterName name of the Cluster
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listDatabases: async (engineName: string, orgName: string, clusterName: string, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('listDatabases', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('listDatabases', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('listDatabases', 'clusterName', clusterName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/databases`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)));
             // use dummy base URL string because the URL constructor only accepts absolute URLs.
             const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
             let baseOptions;
@@ -906,6 +1384,162 @@ export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration
 
 
     
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Preview clearing explicit account privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        previewAccountPrivilegeReset: async (engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('previewAccountPrivilegeReset', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('previewAccountPrivilegeReset', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('previewAccountPrivilegeReset', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('previewAccountPrivilegeReset', 'accountName', accountName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/reset`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'GET', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+
+            if (databaseNames) {
+                localVarQueryParameter['databaseNames'] = databaseNames;
+            }
+
+            if (allDatabases !== undefined) {
+                localVarQueryParameter['allDatabases'] = allDatabases;
+            }
+
+
+    
+            setSearchParams(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
+
+            return {
+                url: toPathString(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Clear explicit account privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetAccountPrivileges: async (engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options: RawAxiosRequestConfig = {}): Promise<RequestArgs> => {
+            // verify required parameter 'engineName' is not null or undefined
+            assertParamExists('resetAccountPrivileges', 'engineName', engineName)
+            // verify required parameter 'orgName' is not null or undefined
+            assertParamExists('resetAccountPrivileges', 'orgName', orgName)
+            // verify required parameter 'clusterName' is not null or undefined
+            assertParamExists('resetAccountPrivileges', 'clusterName', clusterName)
+            // verify required parameter 'accountName' is not null or undefined
+            assertParamExists('resetAccountPrivileges', 'accountName', accountName)
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/reset`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+
+            const localVarRequestOptions = { method: 'DELETE', ...baseOptions, ...options};
+            const localVarHeaderParameter = {} as any;
+            const localVarQueryParameter = {} as any;
+
+            // authentication BearerToken required
+            // http bearer authentication required
+            await setBearerAuthToObject(localVarHeaderParameter, configuration)
+
+            // authentication DigestAuth required
+            await setApiKeyToObject(localVarHeaderParameter, "Authorization", configuration)
+
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+
+            if (databaseNames) {
+                localVarQueryParameter['databaseNames'] = databaseNames;
+            }
+
+            if (allDatabases !== undefined) {
+                localVarQueryParameter['allDatabases'] = allDatabases;
+            }
+
+
+    
             setSearchParams(localVarUrlObj, localVarQueryParameter);
             let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
             localVarRequestOptions.headers = {...localVarHeaderParameter, ...headersFromBaseOptions, ...options.headers};
@@ -1212,6 +1846,26 @@ export const RdbmsApiAxiosParamCreator = function (configuration?: Configuration
 export const RdbmsApiFp = function(configuration?: Configuration) {
     const localVarAxiosParamCreator = RdbmsApiAxiosParamCreator(configuration)
     return {
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Grant or revoke native object and column privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeChange} body 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async changeAccountObjectPrivileges(engineName: string, orgName: string, clusterName: string, accountName: string, body: ObjectPrivilegeChange, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.changeAccountObjectPrivileges(engineName, orgName, clusterName, accountName, body, subjectType, host, subjectQualifiers, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.changeAccountObjectPrivileges']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * create an account in cluster
          * @summary Create cluster account
@@ -1324,6 +1978,67 @@ export const RdbmsApiFp = function(configuration?: Configuration) {
             const localVarOperationServerBasePath = operationServerMap['RdbmsApi.generateDemoData']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary List native object privilege capabilities for the connected server
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAccountObjectPrivilegeCapabilities(engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ObjectPrivilegeCapabilities>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAccountObjectPrivilegeCapabilities(engineName, orgName, clusterName, accountName, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.getAccountObjectPrivilegeCapabilities']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Inspect native object and column privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {string} objectType 
+         * @param {string} [databaseName] 
+         * @param {string} [schemaName] 
+         * @param {string} [objectName] 
+         * @param {string} [objectId] 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [catalogName] 
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAccountObjectPrivileges(engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, objectName?: string, objectId?: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, catalogName?: string, subjectQualifiers?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ObjectPrivilegeSnapshot>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAccountObjectPrivileges(engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, objectName, objectId, subjectType, host, catalogName, subjectQualifiers, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.getAccountObjectPrivileges']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+         * @summary Read native account privilege summary or selected database evidence
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] 
+         * @param {string} [databaseName] PostgreSQL database to inspect on demand. Omit for the global summary.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAccountPrivilegeOverview(engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<ObjectPrivilegeEvidence>>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAccountPrivilegeOverview(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseName, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.getAccountPrivilegeOverview']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * get a database info in cluster
          * @param {string} engineName name of the engine
@@ -1390,6 +2105,48 @@ export const RdbmsApiFp = function(configuration?: Configuration) {
             const localVarOperationServerBasePath = operationServerMap['RdbmsApi.killSession']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+         * @summary List exact column names for account object privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {string} objectType Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+         * @param {string} databaseName 
+         * @param {string} objectName 
+         * @param {string} [schemaName] Required for PostgreSQL; not accepted for MySQL
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listAccountObjectPrivilegeColumns(engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName: string, objectName: string, schemaName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<string>>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listAccountObjectPrivilegeColumns(engineName, orgName, clusterName, accountName, objectType, databaseName, objectName, schemaName, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.listAccountObjectPrivilegeColumns']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+         * @summary Discover existing native privilege objects with stable routine identities
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {string} objectType 
+         * @param {string} [databaseName] 
+         * @param {string} [schemaName] 
+         * @param {number} [offset] 
+         * @param {number} [limit] 
+         * @param {string} [catalogName] 
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listAccountObjectPrivilegeObjects(engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, offset?: number, limit?: number, catalogName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ObjectPrivilegeObjectList>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listAccountObjectPrivilegeObjects(engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, offset, limit, catalogName, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.listAccountObjectPrivilegeObjects']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * list accounts in cluster
          * @summary List cluster accounts
@@ -1468,6 +2225,48 @@ export const RdbmsApiFp = function(configuration?: Configuration) {
             const localVarOperationServerBasePath = operationServerMap['RdbmsApi.lockAccount']?.[localVarOperationServerIndex]?.url;
             return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Preview clearing explicit account privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async previewAccountPrivilegeReset(engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<ObjectPrivilegeResetStep>>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.previewAccountPrivilegeReset(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.previewAccountPrivilegeReset']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Clear explicit account privileges
+         * @param {string} engineName 
+         * @param {string} orgName 
+         * @param {string} clusterName 
+         * @param {string} accountName 
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async resetAccountPrivileges(engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>> {
+            const localVarAxiosArgs = await localVarAxiosParamCreator.resetAccountPrivileges(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options);
+            const localVarOperationServerIndex = configuration?.serverIndex ?? 0;
+            const localVarOperationServerBasePath = operationServerMap['RdbmsApi.resetAccountPrivileges']?.[localVarOperationServerIndex]?.url;
+            return (axios, basePath) => createRequestFunction(localVarAxiosArgs, globalAxios, BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * unlock an account in cluster
          * @summary Unlock cluster account
@@ -1562,6 +2361,16 @@ export const RdbmsApiFp = function(configuration?: Configuration) {
 export const RdbmsApiFactory = function (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) {
     const localVarFp = RdbmsApiFp(configuration)
     return {
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Grant or revoke native object and column privileges
+         * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        changeAccountObjectPrivileges(requestParameters: RdbmsApiChangeAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.changeAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.body, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, options).then((request) => request(axios, basePath));
+        },
         /**
          * create an account in cluster
          * @summary Create cluster account
@@ -1632,6 +2441,36 @@ export const RdbmsApiFactory = function (configuration?: Configuration, basePath
         generateDemoData(requestParameters: RdbmsApiGenerateDemoDataRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
             return localVarFp.generateDemoData(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary List native object privilege capabilities for the connected server
+         * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivilegeCapabilities(requestParameters: RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeCapabilities> {
+            return localVarFp.getAccountObjectPrivilegeCapabilities(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Inspect native object and column privileges
+         * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivileges(requestParameters: RdbmsApiGetAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeSnapshot> {
+            return localVarFp.getAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.objectName, requestParameters.objectId, requestParameters.subjectType, requestParameters.host, requestParameters.catalogName, requestParameters.subjectQualifiers, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+         * @summary Read native account privilege summary or selected database evidence
+         * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountPrivilegeOverview(requestParameters: RdbmsApiGetAccountPrivilegeOverviewRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeEvidence>> {
+            return localVarFp.getAccountPrivilegeOverview(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseName, options).then((request) => request(axios, basePath));
+        },
         /**
          * get a database info in cluster
          * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -1671,6 +2510,26 @@ export const RdbmsApiFactory = function (configuration?: Configuration, basePath
         killSession(requestParameters: RdbmsApiKillSessionRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
             return localVarFp.killSession(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.session, requestParameters.keep, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+         * @summary List exact column names for account object privileges
+         * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccountObjectPrivilegeColumns(requestParameters: RdbmsApiListAccountObjectPrivilegeColumnsRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<string>> {
+            return localVarFp.listAccountObjectPrivilegeColumns(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.objectName, requestParameters.schemaName, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+         * @summary Discover existing native privilege objects with stable routine identities
+         * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccountObjectPrivilegeObjects(requestParameters: RdbmsApiListAccountObjectPrivilegeObjectsRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeObjectList> {
+            return localVarFp.listAccountObjectPrivilegeObjects(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.offset, requestParameters.limit, requestParameters.catalogName, options).then((request) => request(axios, basePath));
+        },
         /**
          * list accounts in cluster
          * @summary List cluster accounts
@@ -1721,6 +2580,26 @@ export const RdbmsApiFactory = function (configuration?: Configuration, basePath
         lockAccount(requestParameters: RdbmsApiLockAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
             return localVarFp.lockAccount(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(axios, basePath));
         },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Preview clearing explicit account privileges
+         * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        previewAccountPrivilegeReset(requestParameters: RdbmsApiPreviewAccountPrivilegeResetRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeResetStep>> {
+            return localVarFp.previewAccountPrivilegeReset(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Clear explicit account privileges
+         * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetAccountPrivileges(requestParameters: RdbmsApiResetAccountPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void> {
+            return localVarFp.resetAccountPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(axios, basePath));
+        },
         /**
          * unlock an account in cluster
          * @summary Unlock cluster account
@@ -1780,6 +2659,16 @@ export const RdbmsApiFactory = function (configuration?: Configuration, basePath
  * @interface RdbmsApi
  */
 export interface RdbmsApiInterface {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    changeAccountObjectPrivileges(requestParameters: RdbmsApiChangeAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -1850,6 +2739,36 @@ export interface RdbmsApiInterface {
      */
     generateDemoData(requestParameters: RdbmsApiGenerateDemoDataRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
 
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    getAccountObjectPrivilegeCapabilities(requestParameters: RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeCapabilities>;
+
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    getAccountObjectPrivileges(requestParameters: RdbmsApiGetAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeSnapshot>;
+
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    getAccountPrivilegeOverview(requestParameters: RdbmsApiGetAccountPrivilegeOverviewRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeEvidence>>;
+
     /**
      * get a database info in cluster
      * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -1889,6 +2808,26 @@ export interface RdbmsApiInterface {
      */
     killSession(requestParameters: RdbmsApiKillSessionRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
 
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    listAccountObjectPrivilegeColumns(requestParameters: RdbmsApiListAccountObjectPrivilegeColumnsRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<string>>;
+
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    listAccountObjectPrivilegeObjects(requestParameters: RdbmsApiListAccountObjectPrivilegeObjectsRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeObjectList>;
+
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -1939,6 +2878,26 @@ export interface RdbmsApiInterface {
      */
     lockAccount(requestParameters: RdbmsApiLockAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
 
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    previewAccountPrivilegeReset(requestParameters: RdbmsApiPreviewAccountPrivilegeResetRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeResetStep>>;
+
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    resetAccountPrivileges(requestParameters: RdbmsApiResetAccountPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account
@@ -1991,6 +2950,69 @@ export interface RdbmsApiInterface {
 
 }
 
+/**
+ * Request parameters for changeAccountObjectPrivileges operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiChangeAccountObjectPrivilegesRequest
+ */
+export interface RdbmsApiChangeAccountObjectPrivilegesRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly accountName: string
+
+    /**
+     * 
+     * @type {ObjectPrivilegeChange}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly body: ObjectPrivilegeChange
+
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType
+
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly host?: string
+
+    /**
+     * JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly subjectQualifiers?: string
+}
+
 /**
  * Request parameters for createAccount operation in RdbmsApi.
  * @export
@@ -2224,16 +3246,212 @@ export interface RdbmsApiGenerateDemoDataRequest {
     /**
      * name of the Cluster
      * @type {string}
-     * @memberof RdbmsApiGenerateDemoData
+     * @memberof RdbmsApiGenerateDemoData
+     */
+    readonly clusterName: string
+
+    /**
+     * acccount name which owns the database to generate demo data
+     * @type {string}
+     * @memberof RdbmsApiGenerateDemoData
+     */
+    readonly accountName: string
+}
+
+/**
+ * Request parameters for getAccountObjectPrivilegeCapabilities operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest
+ */
+export interface RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly accountName: string
+}
+
+/**
+ * Request parameters for getAccountObjectPrivileges operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiGetAccountObjectPrivilegesRequest
+ */
+export interface RdbmsApiGetAccountObjectPrivilegesRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly accountName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly objectType: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly databaseName?: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly schemaName?: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly objectName?: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly objectId?: string
+
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType
+
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly host?: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly catalogName?: string
+
+    /**
+     * JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly subjectQualifiers?: string
+}
+
+/**
+ * Request parameters for getAccountPrivilegeOverview operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiGetAccountPrivilegeOverviewRequest
+ */
+export interface RdbmsApiGetAccountPrivilegeOverviewRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly accountName: string
+
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType
+
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly host?: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
      */
-    readonly clusterName: string
+    readonly subjectQualifiers?: string
 
     /**
-     * acccount name which owns the database to generate demo data
+     * PostgreSQL database to inspect on demand. Omit for the global summary.
      * @type {string}
-     * @memberof RdbmsApiGenerateDemoData
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
      */
-    readonly accountName: string
+    readonly databaseName?: string
 }
 
 /**
@@ -2397,6 +3615,146 @@ export interface RdbmsApiKillSessionRequest {
     readonly keep?: boolean
 }
 
+/**
+ * Request parameters for listAccountObjectPrivilegeColumns operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiListAccountObjectPrivilegeColumnsRequest
+ */
+export interface RdbmsApiListAccountObjectPrivilegeColumnsRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly accountName: string
+
+    /**
+     * Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly objectType: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly databaseName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly objectName: string
+
+    /**
+     * Required for PostgreSQL; not accepted for MySQL
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly schemaName?: string
+}
+
+/**
+ * Request parameters for listAccountObjectPrivilegeObjects operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiListAccountObjectPrivilegeObjectsRequest
+ */
+export interface RdbmsApiListAccountObjectPrivilegeObjectsRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly accountName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly objectType: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly databaseName?: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly schemaName?: string
+
+    /**
+     * 
+     * @type {number}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly offset?: number
+
+    /**
+     * 
+     * @type {number}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly limit?: number
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly catalogName?: string
+}
+
 /**
  * Request parameters for listAccounts operation in RdbmsApi.
  * @export
@@ -2558,6 +3916,146 @@ export interface RdbmsApiLockAccountRequest {
     readonly accountName: string
 }
 
+/**
+ * Request parameters for previewAccountPrivilegeReset operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiPreviewAccountPrivilegeResetRequest
+ */
+export interface RdbmsApiPreviewAccountPrivilegeResetRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly accountName: string
+
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType
+
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly host?: string
+
+    /**
+     * JSON identity qualifiers; MySQL host defaults to %.
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly subjectQualifiers?: string
+
+    /**
+     * PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @type {Array<string>}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly databaseNames?: Array<string>
+
+    /**
+     * PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @type {boolean}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly allDatabases?: boolean
+}
+
+/**
+ * Request parameters for resetAccountPrivileges operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiResetAccountPrivilegesRequest
+ */
+export interface RdbmsApiResetAccountPrivilegesRequest {
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly engineName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly orgName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly clusterName: string
+
+    /**
+     * 
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly accountName: string
+
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType
+
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly host?: string
+
+    /**
+     * JSON identity qualifiers; MySQL host defaults to %.
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly subjectQualifiers?: string
+
+    /**
+     * PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @type {Array<string>}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly databaseNames?: Array<string>
+
+    /**
+     * PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @type {boolean}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly allDatabases?: boolean
+}
+
 /**
  * Request parameters for unlockAccount operation in RdbmsApi.
  * @export
@@ -2768,6 +4266,18 @@ export interface RdbmsApiUpdateServiceAccountRequest {
  * @extends {BaseAPI}
  */
 export class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public changeAccountObjectPrivileges(requestParameters: RdbmsApiChangeAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).changeAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.body, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -2852,6 +4362,42 @@ export class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
         return RdbmsApiFp(this.configuration).generateDemoData(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public getAccountObjectPrivilegeCapabilities(requestParameters: RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).getAccountObjectPrivilegeCapabilities(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public getAccountObjectPrivileges(requestParameters: RdbmsApiGetAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).getAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.objectName, requestParameters.objectId, requestParameters.subjectType, requestParameters.host, requestParameters.catalogName, requestParameters.subjectQualifiers, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public getAccountPrivilegeOverview(requestParameters: RdbmsApiGetAccountPrivilegeOverviewRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).getAccountPrivilegeOverview(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseName, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * get a database info in cluster
      * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -2899,6 +4445,30 @@ export class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
         return RdbmsApiFp(this.configuration).killSession(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.session, requestParameters.keep, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public listAccountObjectPrivilegeColumns(requestParameters: RdbmsApiListAccountObjectPrivilegeColumnsRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).listAccountObjectPrivilegeColumns(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.objectName, requestParameters.schemaName, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public listAccountObjectPrivilegeObjects(requestParameters: RdbmsApiListAccountObjectPrivilegeObjectsRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).listAccountObjectPrivilegeObjects(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.offset, requestParameters.limit, requestParameters.catalogName, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -2959,6 +4529,30 @@ export class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
         return RdbmsApiFp(this.configuration).lockAccount(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(this.axios, this.basePath));
     }
 
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public previewAccountPrivilegeReset(requestParameters: RdbmsApiPreviewAccountPrivilegeResetRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).previewAccountPrivilegeReset(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(this.axios, this.basePath));
+    }
+
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    public resetAccountPrivileges(requestParameters: RdbmsApiResetAccountPrivilegesRequest, options?: RawAxiosRequestConfig) {
+        return RdbmsApiFp(this.configuration).resetAccountPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(this.axios, this.basePath));
+    }
+
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account