kb-cloud-client-typescript 2.4.0-alpha.11 → 2.4.0-alpha.111

package/dist/adminapi/apis/rdbms-api.d.ts

@@ -20,12 +20,34 @@ import type { DmsServiceAccount } from '../models';
 import type { DmsServiceAccountCreateRequest } from '../models';
 import type { DmsServiceAccountUpdateRequest } from '../models';
 import type { DmsSession } from '../models';
+import type { ObjectPrivilegeCapabilities } from '../models';
+import type { ObjectPrivilegeChange } from '../models';
+import type { ObjectPrivilegeEvidence } from '../models';
+import type { ObjectPrivilegeObjectList } from '../models';
+import type { ObjectPrivilegeResetStep } from '../models';
+import type { ObjectPrivilegeSnapshot } from '../models';
+import type { ObjectPrivilegeSubjectType } from '../models';
 import type { PrivilegeListItem } from '../models';
 /**
  * RdbmsApi - axios parameter creator
  * @export
  */
 export declare const RdbmsApiAxiosParamCreator: (configuration?: Configuration) => {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeChange} body
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\"host\":\"%\"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    changeAccountObjectPrivileges: (engineName: string, orgName: string, clusterName: string, accountName: string, body: ObjectPrivilegeChange, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -103,6 +125,52 @@ export declare const RdbmsApiAxiosParamCreator: (configuration?: Configuration)
      * @throws {RequiredError}
      */
     generateDemoData: (engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountObjectPrivilegeCapabilities: (engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {string} objectType
+     * @param {string} [databaseName]
+     * @param {string} [schemaName]
+     * @param {string} [objectName]
+     * @param {string} [objectId]
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [catalogName]
+     * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountObjectPrivileges: (engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, objectName?: string, objectId?: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, catalogName?: string, subjectQualifiers?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers]
+     * @param {string} [databaseName] PostgreSQL database to inspect on demand. Omit for the global summary.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountPrivilegeOverview: (engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseName?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * get a database info in cluster
      * @param {string} engineName name of the engine
@@ -149,6 +217,38 @@ export declare const RdbmsApiAxiosParamCreator: (configuration?: Configuration)
      * @throws {RequiredError}
      */
     killSession: (engineName: string, orgName: string, clusterName: string, session: string, keep?: boolean, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {string} objectType Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+     * @param {string} databaseName
+     * @param {string} objectName
+     * @param {string} [schemaName] Required for PostgreSQL; not accepted for MySQL
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listAccountObjectPrivilegeColumns: (engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName: string, objectName: string, schemaName?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {string} objectType
+     * @param {string} [databaseName]
+     * @param {string} [schemaName]
+     * @param {number} [offset]
+     * @param {number} [limit]
+     * @param {string} [catalogName]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listAccountObjectPrivilegeObjects: (engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, offset?: number, limit?: number, catalogName?: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -202,6 +302,38 @@ export declare const RdbmsApiAxiosParamCreator: (configuration?: Configuration)
      * @throws {RequiredError}
      */
     lockAccount: (engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+     * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    previewAccountPrivilegeReset: (engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+     * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    resetAccountPrivileges: (engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options?: RawAxiosRequestConfig) => Promise<RequestArgs>;
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account
@@ -269,6 +401,21 @@ export declare const RdbmsApiAxiosParamCreator: (configuration?: Configuration)
  * @export
  */
 export declare const RdbmsApiFp: (configuration?: Configuration) => {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeChange} body
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    changeAccountObjectPrivileges(engineName: string, orgName: string, clusterName: string, accountName: string, body: ObjectPrivilegeChange, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -346,6 +493,52 @@ export declare const RdbmsApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     generateDemoData(engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountObjectPrivilegeCapabilities(engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ObjectPrivilegeCapabilities>>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {string} objectType
+     * @param {string} [databaseName]
+     * @param {string} [schemaName]
+     * @param {string} [objectName]
+     * @param {string} [objectId]
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [catalogName]
+     * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountObjectPrivileges(engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, objectName?: string, objectId?: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, catalogName?: string, subjectQualifiers?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ObjectPrivilegeSnapshot>>;
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers]
+     * @param {string} [databaseName] PostgreSQL database to inspect on demand. Omit for the global summary.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountPrivilegeOverview(engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<ObjectPrivilegeEvidence>>>;
     /**
      * get a database info in cluster
      * @param {string} engineName name of the engine
@@ -392,6 +585,38 @@ export declare const RdbmsApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     killSession(engineName: string, orgName: string, clusterName: string, session: string, keep?: boolean, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {string} objectType Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+     * @param {string} databaseName
+     * @param {string} objectName
+     * @param {string} [schemaName] Required for PostgreSQL; not accepted for MySQL
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listAccountObjectPrivilegeColumns(engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName: string, objectName: string, schemaName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<string>>>;
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {string} objectType
+     * @param {string} [databaseName]
+     * @param {string} [schemaName]
+     * @param {number} [offset]
+     * @param {number} [limit]
+     * @param {string} [catalogName]
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listAccountObjectPrivilegeObjects(engineName: string, orgName: string, clusterName: string, accountName: string, objectType: string, databaseName?: string, schemaName?: string, offset?: number, limit?: number, catalogName?: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<ObjectPrivilegeObjectList>>;
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -445,6 +670,38 @@ export declare const RdbmsApiFp: (configuration?: Configuration) => {
      * @throws {RequiredError}
      */
     lockAccount(engineName: string, orgName: string, clusterName: string, accountName: string, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+     * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    previewAccountPrivilegeReset(engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<Array<ObjectPrivilegeResetStep>>>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {string} engineName
+     * @param {string} orgName
+     * @param {string} clusterName
+     * @param {string} accountName
+     * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+     * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+     * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    resetAccountPrivileges(engineName: string, orgName: string, clusterName: string, accountName: string, subjectType?: ObjectPrivilegeSubjectType, host?: string, subjectQualifiers?: string, databaseNames?: Array<string>, allDatabases?: boolean, options?: RawAxiosRequestConfig): Promise<(axios?: AxiosInstance, basePath?: string) => AxiosPromise<void>>;
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account
@@ -512,6 +769,14 @@ export declare const RdbmsApiFp: (configuration?: Configuration) => {
  * @export
  */
 export declare const RdbmsApiFactory: (configuration?: Configuration, basePath?: string, axios?: AxiosInstance) => {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    changeAccountObjectPrivileges(requestParameters: RdbmsApiChangeAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -568,6 +833,30 @@ export declare const RdbmsApiFactory: (configuration?: Configuration, basePath?:
      * @throws {RequiredError}
      */
     generateDemoData(requestParameters: RdbmsApiGenerateDemoDataRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountObjectPrivilegeCapabilities(requestParameters: RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeCapabilities>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountObjectPrivileges(requestParameters: RdbmsApiGetAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeSnapshot>;
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    getAccountPrivilegeOverview(requestParameters: RdbmsApiGetAccountPrivilegeOverviewRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeEvidence>>;
     /**
      * get a database info in cluster
      * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -599,6 +888,22 @@ export declare const RdbmsApiFactory: (configuration?: Configuration, basePath?:
      * @throws {RequiredError}
      */
     killSession(requestParameters: RdbmsApiKillSessionRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listAccountObjectPrivilegeColumns(requestParameters: RdbmsApiListAccountObjectPrivilegeColumnsRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<string>>;
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    listAccountObjectPrivilegeObjects(requestParameters: RdbmsApiListAccountObjectPrivilegeObjectsRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeObjectList>;
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -639,6 +944,22 @@ export declare const RdbmsApiFactory: (configuration?: Configuration, basePath?:
      * @throws {RequiredError}
      */
     lockAccount(requestParameters: RdbmsApiLockAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    previewAccountPrivilegeReset(requestParameters: RdbmsApiPreviewAccountPrivilegeResetRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeResetStep>>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     */
+    resetAccountPrivileges(requestParameters: RdbmsApiResetAccountPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account
@@ -686,6 +1007,15 @@ export declare const RdbmsApiFactory: (configuration?: Configuration, basePath?:
  * @interface RdbmsApi
  */
 export interface RdbmsApiInterface {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    changeAccountObjectPrivileges(requestParameters: RdbmsApiChangeAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -749,6 +1079,33 @@ export interface RdbmsApiInterface {
      * @memberof RdbmsApiInterface
      */
     generateDemoData(requestParameters: RdbmsApiGenerateDemoDataRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    getAccountObjectPrivilegeCapabilities(requestParameters: RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeCapabilities>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    getAccountObjectPrivileges(requestParameters: RdbmsApiGetAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeSnapshot>;
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    getAccountPrivilegeOverview(requestParameters: RdbmsApiGetAccountPrivilegeOverviewRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeEvidence>>;
     /**
      * get a database info in cluster
      * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -784,6 +1141,24 @@ export interface RdbmsApiInterface {
      * @memberof RdbmsApiInterface
      */
     killSession(requestParameters: RdbmsApiKillSessionRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    listAccountObjectPrivilegeColumns(requestParameters: RdbmsApiListAccountObjectPrivilegeColumnsRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<string>>;
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    listAccountObjectPrivilegeObjects(requestParameters: RdbmsApiListAccountObjectPrivilegeObjectsRequest, options?: RawAxiosRequestConfig): AxiosPromise<ObjectPrivilegeObjectList>;
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -829,6 +1204,24 @@ export interface RdbmsApiInterface {
      * @memberof RdbmsApiInterface
      */
     lockAccount(requestParameters: RdbmsApiLockAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    previewAccountPrivilegeReset(requestParameters: RdbmsApiPreviewAccountPrivilegeResetRequest, options?: RawAxiosRequestConfig): AxiosPromise<Array<ObjectPrivilegeResetStep>>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApiInterface
+     */
+    resetAccountPrivileges(requestParameters: RdbmsApiResetAccountPrivilegesRequest, options?: RawAxiosRequestConfig): AxiosPromise<void>;
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account
@@ -875,6 +1268,61 @@ export interface RdbmsApiInterface {
      */
     updateServiceAccount(requestParameters: RdbmsApiUpdateServiceAccountRequest, options?: RawAxiosRequestConfig): AxiosPromise<DmsServiceAccount>;
 }
+/**
+ * Request parameters for changeAccountObjectPrivileges operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiChangeAccountObjectPrivilegesRequest
+ */
+export interface RdbmsApiChangeAccountObjectPrivilegesRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly accountName: string;
+    /**
+     *
+     * @type {ObjectPrivilegeChange}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly body: ObjectPrivilegeChange;
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType;
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly host?: string;
+    /**
+     * JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @type {string}
+     * @memberof RdbmsApiChangeAccountObjectPrivileges
+     */
+    readonly subjectQualifiers?: string;
+}
 /**
  * Request parameters for createAccount operation in RdbmsApi.
  * @export
@@ -1092,6 +1540,177 @@ export interface RdbmsApiGenerateDemoDataRequest {
      */
     readonly accountName: string;
 }
+/**
+ * Request parameters for getAccountObjectPrivilegeCapabilities operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest
+ */
+export interface RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivilegeCapabilities
+     */
+    readonly accountName: string;
+}
+/**
+ * Request parameters for getAccountObjectPrivileges operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiGetAccountObjectPrivilegesRequest
+ */
+export interface RdbmsApiGetAccountObjectPrivilegesRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly accountName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly objectType: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly databaseName?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly schemaName?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly objectName?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly objectId?: string;
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType;
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly host?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly catalogName?: string;
+    /**
+     * JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountObjectPrivileges
+     */
+    readonly subjectQualifiers?: string;
+}
+/**
+ * Request parameters for getAccountPrivilegeOverview operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiGetAccountPrivilegeOverviewRequest
+ */
+export interface RdbmsApiGetAccountPrivilegeOverviewRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly accountName: string;
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType;
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly host?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly subjectQualifiers?: string;
+    /**
+     * PostgreSQL database to inspect on demand. Omit for the global summary.
+     * @type {string}
+     * @memberof RdbmsApiGetAccountPrivilegeOverview
+     */
+    readonly databaseName?: string;
+}
 /**
  * Request parameters for getDatabase operation in RdbmsApi.
  * @export
@@ -1234,6 +1853,128 @@ export interface RdbmsApiKillSessionRequest {
      */
     readonly keep?: boolean;
 }
+/**
+ * Request parameters for listAccountObjectPrivilegeColumns operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiListAccountObjectPrivilegeColumnsRequest
+ */
+export interface RdbmsApiListAccountObjectPrivilegeColumnsRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly accountName: string;
+    /**
+     * Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly objectType: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly databaseName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly objectName: string;
+    /**
+     * Required for PostgreSQL; not accepted for MySQL
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeColumns
+     */
+    readonly schemaName?: string;
+}
+/**
+ * Request parameters for listAccountObjectPrivilegeObjects operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiListAccountObjectPrivilegeObjectsRequest
+ */
+export interface RdbmsApiListAccountObjectPrivilegeObjectsRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly accountName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly objectType: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly databaseName?: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly schemaName?: string;
+    /**
+     *
+     * @type {number}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly offset?: number;
+    /**
+     *
+     * @type {number}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly limit?: number;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiListAccountObjectPrivilegeObjects
+     */
+    readonly catalogName?: string;
+}
 /**
  * Request parameters for listAccounts operation in RdbmsApi.
  * @export
@@ -1377,6 +2118,128 @@ export interface RdbmsApiLockAccountRequest {
      */
     readonly accountName: string;
 }
+/**
+ * Request parameters for previewAccountPrivilegeReset operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiPreviewAccountPrivilegeResetRequest
+ */
+export interface RdbmsApiPreviewAccountPrivilegeResetRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly accountName: string;
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType;
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly host?: string;
+    /**
+     * JSON identity qualifiers; MySQL host defaults to %.
+     * @type {string}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly subjectQualifiers?: string;
+    /**
+     * PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @type {Array<string>}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly databaseNames?: Array<string>;
+    /**
+     * PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @type {boolean}
+     * @memberof RdbmsApiPreviewAccountPrivilegeReset
+     */
+    readonly allDatabases?: boolean;
+}
+/**
+ * Request parameters for resetAccountPrivileges operation in RdbmsApi.
+ * @export
+ * @interface RdbmsApiResetAccountPrivilegesRequest
+ */
+export interface RdbmsApiResetAccountPrivilegesRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly engineName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly orgName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly clusterName: string;
+    /**
+     *
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly accountName: string;
+    /**
+     * Native subject kind; path account name identifies the subject.
+     * @type {ObjectPrivilegeSubjectType}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly subjectType?: ObjectPrivilegeSubjectType;
+    /**
+     * Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly host?: string;
+    /**
+     * JSON identity qualifiers; MySQL host defaults to %.
+     * @type {string}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly subjectQualifiers?: string;
+    /**
+     * PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+     * @type {Array<string>}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly databaseNames?: Array<string>;
+    /**
+     * PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+     * @type {boolean}
+     * @memberof RdbmsApiResetAccountPrivileges
+     */
+    readonly allDatabases?: boolean;
+}
 /**
  * Request parameters for unlockAccount operation in RdbmsApi.
  * @export
@@ -1565,6 +2428,15 @@ export interface RdbmsApiUpdateServiceAccountRequest {
  * @extends {BaseAPI}
  */
 export declare class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    changeAccountObjectPrivileges(requestParameters: RdbmsApiChangeAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -1628,6 +2500,33 @@ export declare class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
      * @memberof RdbmsApi
      */
     generateDemoData(requestParameters: RdbmsApiGenerateDemoDataRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    getAccountObjectPrivilegeCapabilities(requestParameters: RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ObjectPrivilegeCapabilities, any, {}>>;
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    getAccountObjectPrivileges(requestParameters: RdbmsApiGetAccountObjectPrivilegesRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ObjectPrivilegeSnapshot, any, {}>>;
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    getAccountPrivilegeOverview(requestParameters: RdbmsApiGetAccountPrivilegeOverviewRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ObjectPrivilegeEvidence[], any, {}>>;
     /**
      * get a database info in cluster
      * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -1663,6 +2562,24 @@ export declare class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
      * @memberof RdbmsApi
      */
     killSession(requestParameters: RdbmsApiKillSessionRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    listAccountObjectPrivilegeColumns(requestParameters: RdbmsApiListAccountObjectPrivilegeColumnsRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<string[], any, {}>>;
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    listAccountObjectPrivilegeObjects(requestParameters: RdbmsApiListAccountObjectPrivilegeObjectsRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ObjectPrivilegeObjectList, any, {}>>;
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -1708,6 +2625,24 @@ export declare class RdbmsApi extends BaseAPI implements RdbmsApiInterface {
      * @memberof RdbmsApi
      */
     lockAccount(requestParameters: RdbmsApiLockAccountRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    previewAccountPrivilegeReset(requestParameters: RdbmsApiPreviewAccountPrivilegeResetRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<ObjectPrivilegeResetStep[], any, {}>>;
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    resetAccountPrivileges(requestParameters: RdbmsApiResetAccountPrivilegesRequest, options?: RawAxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account