kb-cloud-client-typescript 2.4.0-alpha.12 → 2.4.0-alpha.121

package/dist/adminapi/apis/rdbms-api.js

@@ -29,6 +29,69 @@ const base_1 = require("../base");
  */
 const RdbmsApiAxiosParamCreator = function (configuration) {
     return {
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Grant or revoke native object and column privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeChange} body
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\"host\":\"%\"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        changeAccountObjectPrivileges: async (engineName, orgName, clusterName, accountName, body, subjectType, host, subjectQualifiers, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('changeAccountObjectPrivileges', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('changeAccountObjectPrivileges', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('changeAccountObjectPrivileges', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('changeAccountObjectPrivileges', 'accountName', accountName);
+            // verify required parameter 'body' is not null or undefined
+            (0, common_1.assertParamExists)('changeAccountObjectPrivileges', 'body', body);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'PATCH' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+            localVarHeaderParameter['Content-Type'] = 'application/json';
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            localVarRequestOptions.data = (0, common_1.serializeDataIfNeeded)(body, localVarRequestOptions, configuration);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * create an account in cluster
          * @summary Create cluster account
@@ -356,6 +419,198 @@ const RdbmsApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary List native object privilege capabilities for the connected server
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivilegeCapabilities: async (engineName, orgName, clusterName, accountName, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivilegeCapabilities', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivilegeCapabilities', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivilegeCapabilities', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivilegeCapabilities', 'accountName', accountName);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/capabilities`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Inspect native object and column privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {string} objectType
+         * @param {string} [databaseName]
+         * @param {string} [schemaName]
+         * @param {string} [objectName]
+         * @param {string} [objectId]
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [catalogName]
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\"host\":\"%\"}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivileges: async (engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, objectName, objectId, subjectType, host, catalogName, subjectQualifiers, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivileges', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivileges', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivileges', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivileges', 'accountName', accountName);
+            // verify required parameter 'objectType' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountObjectPrivileges', 'objectType', objectType);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (objectType !== undefined) {
+                localVarQueryParameter['objectType'] = objectType;
+            }
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+            if (schemaName !== undefined) {
+                localVarQueryParameter['schemaName'] = schemaName;
+            }
+            if (objectName !== undefined) {
+                localVarQueryParameter['objectName'] = objectName;
+            }
+            if (objectId !== undefined) {
+                localVarQueryParameter['objectId'] = objectId;
+            }
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+            if (catalogName !== undefined) {
+                localVarQueryParameter['catalogName'] = catalogName;
+            }
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+         * @summary Read native account privilege summary or selected database evidence
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers]
+         * @param {string} [databaseName] PostgreSQL database to inspect on demand. Omit for the global summary.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountPrivilegeOverview: async (engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseName, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountPrivilegeOverview', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountPrivilegeOverview', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountPrivilegeOverview', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('getAccountPrivilegeOverview', 'accountName', accountName);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/overview`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * get a database info in cluster
          * @param {string} engineName name of the engine
@@ -553,6 +808,146 @@ const RdbmsApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+         * @summary List exact column names for account object privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {string} objectType Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+         * @param {string} databaseName
+         * @param {string} objectName
+         * @param {string} [schemaName] Required for PostgreSQL; not accepted for MySQL
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccountObjectPrivilegeColumns: async (engineName, orgName, clusterName, accountName, objectType, databaseName, objectName, schemaName, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'accountName', accountName);
+            // verify required parameter 'objectType' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'objectType', objectType);
+            // verify required parameter 'databaseName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'databaseName', databaseName);
+            // verify required parameter 'objectName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeColumns', 'objectName', objectName);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/columns`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (objectType !== undefined) {
+                localVarQueryParameter['objectType'] = objectType;
+            }
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+            if (objectName !== undefined) {
+                localVarQueryParameter['objectName'] = objectName;
+            }
+            if (schemaName !== undefined) {
+                localVarQueryParameter['schemaName'] = schemaName;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+         * @summary Discover existing native privilege objects with stable routine identities
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {string} objectType
+         * @param {string} [databaseName]
+         * @param {string} [schemaName]
+         * @param {number} [offset]
+         * @param {number} [limit]
+         * @param {string} [catalogName]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccountObjectPrivilegeObjects: async (engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, offset, limit, catalogName, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeObjects', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeObjects', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeObjects', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeObjects', 'accountName', accountName);
+            // verify required parameter 'objectType' is not null or undefined
+            (0, common_1.assertParamExists)('listAccountObjectPrivilegeObjects', 'objectType', objectType);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/objects`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (objectType !== undefined) {
+                localVarQueryParameter['objectType'] = objectType;
+            }
+            if (databaseName !== undefined) {
+                localVarQueryParameter['databaseName'] = databaseName;
+            }
+            if (schemaName !== undefined) {
+                localVarQueryParameter['schemaName'] = schemaName;
+            }
+            if (offset !== undefined) {
+                localVarQueryParameter['offset'] = offset;
+            }
+            if (limit !== undefined) {
+                localVarQueryParameter['limit'] = limit;
+            }
+            if (catalogName !== undefined) {
+                localVarQueryParameter['catalogName'] = catalogName;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * list accounts in cluster
          * @summary List cluster accounts
@@ -775,6 +1170,138 @@ const RdbmsApiAxiosParamCreator = function (configuration) {
                 options: localVarRequestOptions,
             };
         },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Preview clearing explicit account privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        previewAccountPrivilegeReset: async (engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('previewAccountPrivilegeReset', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('previewAccountPrivilegeReset', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('previewAccountPrivilegeReset', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('previewAccountPrivilegeReset', 'accountName', accountName);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/reset`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'GET' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+            if (databaseNames) {
+                localVarQueryParameter['databaseNames'] = databaseNames;
+            }
+            if (allDatabases !== undefined) {
+                localVarQueryParameter['allDatabases'] = allDatabases;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Clear explicit account privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetAccountPrivileges: async (engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options = {}) => {
+            // verify required parameter 'engineName' is not null or undefined
+            (0, common_1.assertParamExists)('resetAccountPrivileges', 'engineName', engineName);
+            // verify required parameter 'orgName' is not null or undefined
+            (0, common_1.assertParamExists)('resetAccountPrivileges', 'orgName', orgName);
+            // verify required parameter 'clusterName' is not null or undefined
+            (0, common_1.assertParamExists)('resetAccountPrivileges', 'clusterName', clusterName);
+            // verify required parameter 'accountName' is not null or undefined
+            (0, common_1.assertParamExists)('resetAccountPrivileges', 'accountName', accountName);
+            const localVarPath = `/admin/v1/data/{engineName}/organizations/{orgName}/clusters/{clusterName}/accounts/{accountName}/object-privileges/reset`
+                .replace(`{${"engineName"}}`, encodeURIComponent(String(engineName)))
+                .replace(`{${"orgName"}}`, encodeURIComponent(String(orgName)))
+                .replace(`{${"clusterName"}}`, encodeURIComponent(String(clusterName)))
+                .replace(`{${"accountName"}}`, encodeURIComponent(String(accountName)));
+            // use dummy base URL string because the URL constructor only accepts absolute URLs.
+            const localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
+            let baseOptions;
+            if (configuration) {
+                baseOptions = configuration.baseOptions;
+            }
+            const localVarRequestOptions = Object.assign(Object.assign({ method: 'DELETE' }, baseOptions), options);
+            const localVarHeaderParameter = {};
+            const localVarQueryParameter = {};
+            // authentication BearerToken required
+            // http bearer authentication required
+            await (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration);
+            // authentication DigestAuth required
+            await (0, common_1.setApiKeyToObject)(localVarHeaderParameter, "Authorization", configuration);
+            if (subjectType !== undefined) {
+                localVarQueryParameter['subjectType'] = subjectType;
+            }
+            if (host !== undefined) {
+                localVarQueryParameter['host'] = host;
+            }
+            if (subjectQualifiers !== undefined) {
+                localVarQueryParameter['subjectQualifiers'] = subjectQualifiers;
+            }
+            if (databaseNames) {
+                localVarQueryParameter['databaseNames'] = databaseNames;
+            }
+            if (allDatabases !== undefined) {
+                localVarQueryParameter['allDatabases'] = allDatabases;
+            }
+            (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
+            let headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
+            localVarRequestOptions.headers = Object.assign(Object.assign(Object.assign({}, localVarHeaderParameter), headersFromBaseOptions), options.headers);
+            return {
+                url: (0, common_1.toPathString)(localVarUrlObj),
+                options: localVarRequestOptions,
+            };
+        },
         /**
          * unlock an account in cluster
          * @summary Unlock cluster account
@@ -1033,6 +1560,27 @@ exports.RdbmsApiAxiosParamCreator = RdbmsApiAxiosParamCreator;
 const RdbmsApiFp = function (configuration) {
     const localVarAxiosParamCreator = (0, exports.RdbmsApiAxiosParamCreator)(configuration);
     return {
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Grant or revoke native object and column privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeChange} body
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async changeAccountObjectPrivileges(engineName, orgName, clusterName, accountName, body, subjectType, host, subjectQualifiers, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.changeAccountObjectPrivileges(engineName, orgName, clusterName, accountName, body, subjectType, host, subjectQualifiers, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.changeAccountObjectPrivileges']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * create an account in cluster
          * @summary Create cluster account
@@ -1152,6 +1700,70 @@ const RdbmsApiFp = function (configuration) {
             const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.generateDemoData']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary List native object privilege capabilities for the connected server
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAccountObjectPrivilegeCapabilities(engineName, orgName, clusterName, accountName, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAccountObjectPrivilegeCapabilities(engineName, orgName, clusterName, accountName, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.getAccountObjectPrivilegeCapabilities']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Inspect native object and column privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {string} objectType
+         * @param {string} [databaseName]
+         * @param {string} [schemaName]
+         * @param {string} [objectName]
+         * @param {string} [objectId]
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [catalogName]
+         * @param {string} [subjectQualifiers] JSON object of string identity qualifiers, e.g. {\&quot;host\&quot;:\&quot;%\&quot;}. Allowed keys and defaults come from capabilities. Unknown keys or duplicate identity inputs are rejected.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAccountObjectPrivileges(engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, objectName, objectId, subjectType, host, catalogName, subjectQualifiers, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAccountObjectPrivileges(engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, objectName, objectId, subjectType, host, catalogName, subjectQualifiers, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.getAccountObjectPrivileges']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+         * @summary Read native account privilege summary or selected database evidence
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers]
+         * @param {string} [databaseName] PostgreSQL database to inspect on demand. Omit for the global summary.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async getAccountPrivilegeOverview(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseName, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.getAccountPrivilegeOverview(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseName, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.getAccountPrivilegeOverview']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * get a database info in cluster
          * @param {string} engineName name of the engine
@@ -1222,6 +1834,50 @@ const RdbmsApiFp = function (configuration) {
             const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.killSession']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+         * @summary List exact column names for account object privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {string} objectType Object type, table/view; PostgreSQL also supports materializedView/foreignTable
+         * @param {string} databaseName
+         * @param {string} objectName
+         * @param {string} [schemaName] Required for PostgreSQL; not accepted for MySQL
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listAccountObjectPrivilegeColumns(engineName, orgName, clusterName, accountName, objectType, databaseName, objectName, schemaName, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listAccountObjectPrivilegeColumns(engineName, orgName, clusterName, accountName, objectType, databaseName, objectName, schemaName, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.listAccountObjectPrivilegeColumns']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+         * @summary Discover existing native privilege objects with stable routine identities
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {string} objectType
+         * @param {string} [databaseName]
+         * @param {string} [schemaName]
+         * @param {number} [offset]
+         * @param {number} [limit]
+         * @param {string} [catalogName]
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async listAccountObjectPrivilegeObjects(engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, offset, limit, catalogName, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.listAccountObjectPrivilegeObjects(engineName, orgName, clusterName, accountName, objectType, databaseName, schemaName, offset, limit, catalogName, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.listAccountObjectPrivilegeObjects']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * list accounts in cluster
          * @summary List cluster accounts
@@ -1305,6 +1961,50 @@ const RdbmsApiFp = function (configuration) {
             const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.lockAccount']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
             return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
         },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Preview clearing explicit account privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async previewAccountPrivilegeReset(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.previewAccountPrivilegeReset(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.previewAccountPrivilegeReset']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Clear explicit account privileges
+         * @param {string} engineName
+         * @param {string} orgName
+         * @param {string} clusterName
+         * @param {string} accountName
+         * @param {ObjectPrivilegeSubjectType} [subjectType] Native subject kind; path account name identifies the subject.
+         * @param {string} [host] Deprecated MySQL host alias. Prefer subjectQualifiers. Do not specify host in both.
+         * @param {string} [subjectQualifiers] JSON identity qualifiers; MySQL host defaults to %.
+         * @param {Array<string>} [databaseNames] PostgreSQL only; exact selected database names as repeated parameters. Mutually exclusive with allDatabases.
+         * @param {boolean} [allDatabases] PostgreSQL whole-account reset requires explicit true; otherwise databaseNames must be nonempty. Selected scope preserves global memberships/attributes and privileges outside those databases.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        async resetAccountPrivileges(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options) {
+            var _a, _b, _c;
+            const localVarAxiosArgs = await localVarAxiosParamCreator.resetAccountPrivileges(engineName, orgName, clusterName, accountName, subjectType, host, subjectQualifiers, databaseNames, allDatabases, options);
+            const localVarOperationServerIndex = (_a = configuration === null || configuration === void 0 ? void 0 : configuration.serverIndex) !== null && _a !== void 0 ? _a : 0;
+            const localVarOperationServerBasePath = (_c = (_b = base_1.operationServerMap['RdbmsApi.resetAccountPrivileges']) === null || _b === void 0 ? void 0 : _b[localVarOperationServerIndex]) === null || _c === void 0 ? void 0 : _c.url;
+            return (axios, basePath) => (0, common_1.createRequestFunction)(localVarAxiosArgs, axios_1.default, base_1.BASE_PATH, configuration)(axios, localVarOperationServerBasePath || basePath);
+        },
         /**
          * unlock an account in cluster
          * @summary Unlock cluster account
@@ -1404,6 +2104,16 @@ exports.RdbmsApiFp = RdbmsApiFp;
 const RdbmsApiFactory = function (configuration, basePath, axios) {
     const localVarFp = (0, exports.RdbmsApiFp)(configuration);
     return {
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Grant or revoke native object and column privileges
+         * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        changeAccountObjectPrivileges(requestParameters, options) {
+            return localVarFp.changeAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.body, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, options).then((request) => request(axios, basePath));
+        },
         /**
          * create an account in cluster
          * @summary Create cluster account
@@ -1474,6 +2184,36 @@ const RdbmsApiFactory = function (configuration, basePath, axios) {
         generateDemoData(requestParameters, options) {
             return localVarFp.generateDemoData(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary List native object privilege capabilities for the connected server
+         * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivilegeCapabilities(requestParameters, options) {
+            return localVarFp.getAccountObjectPrivilegeCapabilities(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+         * @summary Inspect native object and column privileges
+         * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountObjectPrivileges(requestParameters, options) {
+            return localVarFp.getAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.objectName, requestParameters.objectId, requestParameters.subjectType, requestParameters.host, requestParameters.catalogName, requestParameters.subjectQualifiers, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+         * @summary Read native account privilege summary or selected database evidence
+         * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        getAccountPrivilegeOverview(requestParameters, options) {
+            return localVarFp.getAccountPrivilegeOverview(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseName, options).then((request) => request(axios, basePath));
+        },
         /**
          * get a database info in cluster
          * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -1513,6 +2253,26 @@ const RdbmsApiFactory = function (configuration, basePath, axios) {
         killSession(requestParameters, options) {
             return localVarFp.killSession(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.session, requestParameters.keep, options).then((request) => request(axios, basePath));
         },
+        /**
+         * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+         * @summary List exact column names for account object privileges
+         * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccountObjectPrivilegeColumns(requestParameters, options) {
+            return localVarFp.listAccountObjectPrivilegeColumns(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.objectName, requestParameters.schemaName, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+         * @summary Discover existing native privilege objects with stable routine identities
+         * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        listAccountObjectPrivilegeObjects(requestParameters, options) {
+            return localVarFp.listAccountObjectPrivilegeObjects(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.offset, requestParameters.limit, requestParameters.catalogName, options).then((request) => request(axios, basePath));
+        },
         /**
          * list accounts in cluster
          * @summary List cluster accounts
@@ -1563,6 +2323,26 @@ const RdbmsApiFactory = function (configuration, basePath, axios) {
         lockAccount(requestParameters, options) {
             return localVarFp.lockAccount(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(axios, basePath));
         },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Preview clearing explicit account privileges
+         * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        previewAccountPrivilegeReset(requestParameters, options) {
+            return localVarFp.previewAccountPrivilegeReset(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(axios, basePath));
+        },
+        /**
+         * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+         * @summary Clear explicit account privileges
+         * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+         * @param {*} [options] Override http request option.
+         * @throws {RequiredError}
+         */
+        resetAccountPrivileges(requestParameters, options) {
+            return localVarFp.resetAccountPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(axios, basePath));
+        },
         /**
          * unlock an account in cluster
          * @summary Unlock cluster account
@@ -1623,6 +2403,17 @@ exports.RdbmsApiFactory = RdbmsApiFactory;
  * @extends {BaseAPI}
  */
 class RdbmsApi extends base_1.BaseAPI {
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Grant or revoke native object and column privileges
+     * @param {RdbmsApiChangeAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    changeAccountObjectPrivileges(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).changeAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.body, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * create an account in cluster
      * @summary Create cluster account
@@ -1700,6 +2491,39 @@ class RdbmsApi extends base_1.BaseAPI {
     generateDemoData(requestParameters, options) {
         return (0, exports.RdbmsApiFp)(this.configuration).generateDemoData(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary List native object privilege capabilities for the connected server
+     * @param {RdbmsApiGetAccountObjectPrivilegeCapabilitiesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    getAccountObjectPrivilegeCapabilities(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).getAccountObjectPrivilegeCapabilities(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Native object GRANT/REVOKE alongside presets. Consult capabilities for engine/version-specific object types and privileges. PostgreSQL RESTRICT is the default; MySQL static GRANT OPTION is scope-wide.
+     * @summary Inspect native object and column privileges
+     * @param {RdbmsApiGetAccountObjectPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    getAccountObjectPrivileges(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).getAccountObjectPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.objectName, requestParameters.objectId, requestParameters.subjectType, requestParameters.host, requestParameters.catalogName, requestParameters.subjectQualifiers, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Without databaseName, returns role attributes, memberships, database access summaries and shared ACLs without connecting to other databases. PostgreSQL databaseName reads schema, object, ownership and PUBLIC evidence from that database only. Failed reads return an error, never an empty grant list. SQL is read-only evidence, not an exhaustive effective-access decision.
+     * @summary Read native account privilege summary or selected database evidence
+     * @param {RdbmsApiGetAccountPrivilegeOverviewRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    getAccountPrivilegeOverview(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).getAccountPrivilegeOverview(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseName, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * get a database info in cluster
      * @param {RdbmsApiGetDatabaseRequest} requestParameters Request parameters.
@@ -1743,6 +2567,28 @@ class RdbmsApi extends base_1.BaseAPI {
     killSession(requestParameters, options) {
         return (0, exports.RdbmsApiFp)(this.configuration).killSession(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.session, requestParameters.keep, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * Read MySQL or PostgreSQL relation column names using the account management connection. No workbench datasource is required. Names are returned verbatim for column-level grants.
+     * @summary List exact column names for account object privileges
+     * @param {RdbmsApiListAccountObjectPrivilegeColumnsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    listAccountObjectPrivilegeColumns(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).listAccountObjectPrivilegeColumns(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.objectName, requestParameters.schemaName, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * Lists existing objects of one supported kind. Pagination is not a fixed snapshot. PostgreSQL requires a connection database; schema-contained kinds require schemaName. MySQL global/database listing omits databaseName; other kinds require it.
+     * @summary Discover existing native privilege objects with stable routine identities
+     * @param {RdbmsApiListAccountObjectPrivilegeObjectsRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    listAccountObjectPrivilegeObjects(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).listAccountObjectPrivilegeObjects(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.objectType, requestParameters.databaseName, requestParameters.schemaName, requestParameters.offset, requestParameters.limit, requestParameters.catalogName, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * list accounts in cluster
      * @summary List cluster accounts
@@ -1798,6 +2644,28 @@ class RdbmsApi extends base_1.BaseAPI {
     lockAccount(requestParameters, options) {
         return (0, exports.RdbmsApiFp)(this.configuration).lockAccount(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, options).then((request) => request(this.axios, this.basePath));
     }
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Preview clearing explicit account privileges
+     * @param {RdbmsApiPreviewAccountPrivilegeResetRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    previewAccountPrivilegeReset(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).previewAccountPrivilegeReset(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(this.axios, this.basePath));
+    }
+    /**
+     * MySQL clears direct privileges at every scope (including columns, routines, dynamic privileges and grant options), explicit role memberships and PROXY grants for one exact user/host. Rejects protected accounts and servers with mandatory roles before writing. Preview does not mutate. Execution re-reads current grants; concurrent new grants can be included. Statements are not atomic; on failure refresh and preview before retrying. Existing sessions follow MySQL privilege-cache semantics; this does not lock the account or terminate connections. PostgreSQL requires selected databaseNames or explicit allDatabases=true. Selected scope clears direct database/local/default ACLs only. It preserves global memberships, role attributes and privileges in other databases. Whole-account scope additionally clears memberships and elevated attributes. PUBLIC access remains. Object ownership prevents reset; RESTRICT protects dependent grants. Each database is transactional, but cross-database reset is not atomic. No objects are dropped or reassigned.
+     * @summary Clear explicit account privileges
+     * @param {RdbmsApiResetAccountPrivilegesRequest} requestParameters Request parameters.
+     * @param {*} [options] Override http request option.
+     * @throws {RequiredError}
+     * @memberof RdbmsApi
+     */
+    resetAccountPrivileges(requestParameters, options) {
+        return (0, exports.RdbmsApiFp)(this.configuration).resetAccountPrivileges(requestParameters.engineName, requestParameters.orgName, requestParameters.clusterName, requestParameters.accountName, requestParameters.subjectType, requestParameters.host, requestParameters.subjectQualifiers, requestParameters.databaseNames, requestParameters.allDatabases, options).then((request) => request(this.axios, this.basePath));
+    }
     /**
      * unlock an account in cluster
      * @summary Unlock cluster account