1.3.17. /db/_security

GET /{db}/_security

Returns the current security object from the specified database.

The security object consists of two compulsory elements, admins and members, which are used to specify the list of users and/or roles that have admin and members rights to the database respectively:

  • members: they can read all types of documents from the DB, and they can write (and edit) documents to the DB except for design documents.
  • admins: they have all the privileges of members plus the privileges: write (and edit) design documents, add/remove database admins and members and set the database revisions limit. They can not create a database nor delete a database.

Both members and admins objects contain two array-typed fields:

  • names: List of CouchDB user names
  • roles: List of users roles

Any additional fields in the security object are optional. The entire security object is made available to validation and other internal functions so that the database can control and limit functionality.

If both the names and roles fields of either the admins or members properties are empty arrays, or are not existent, it means the database has no admins or members.

Having no admins, only server admins (with the reserved _admin role) are able to update design documents and make other admin level changes.

Having no members or roles, any user can write regular documents (any non-design document) and read documents from the database.

Since CouchDB 3.x newly created databases have by default the _admin role to prevent unintentional access.

If there are any member names or roles defined for a database, then only authenticated users having a matching name or role are allowed to read documents from the database (or do a GET /{db} call).

Parameters:
  • db – Database name
Request Headers:
 
  • Accept
    • application/json
    • text/plain
Response Headers:
 
Response JSON Object:
 
  • admins (object) – Object with two fields as names and roles. See description above for more info.
  • members (object) – Object with two fields as names and roles. See description above for more info.
Status Codes:
  • 200 OK – Request completed successfully

Request:

  1. GET /db/_security HTTP/1.1
  2. Accept: application/json
  3. Host: localhost:5984

Response:

  1. HTTP/1.1 200 OK
  2. Cache-Control: must-revalidate
  3. Content-Length: 109
  4. Content-Type: application/json
  5. Date: Mon, 12 Aug 2013 19:05:29 GMT
  6. Server: CouchDB (Erlang/OTP)
  7. {
  8. "admins": {
  9. "names": [
  10. "superuser"
  11. ],
  12. "roles": [
  13. "admins"
  14. ]
  15. },
  16. "members": {
  17. "names": [
  18. "user1",
  19. "user2"
  20. ],
  21. "roles": [
  22. "developers"
  23. ]
  24. }
  25. }

PUT /{db}/_security

Sets the security object for the given database.

Parameters:
  • db – Database name
Request Headers:
 
Request JSON Object:
 
Response Headers:
 
Response JSON Object:
 
  • ok (boolean) – Operation status
Status Codes:
  • 200 OK – Request completed successfully
  • 401 Unauthorized – CouchDB Server Administrator privileges required

Request:

  1. shell> curl http://localhost:5984/pineapple/_security -X PUT -H 'content-type: application/json' -H 'accept: application/json' -d '{"admins":{"names":["superuser"],"roles":["admins"]},"members":{"names": ["user1","user2"],"roles": ["developers"]}}'
  1. PUT /db/_security HTTP/1.1
  2. Accept: application/json
  3. Content-Length: 121
  4. Content-Type: application/json
  5. Host: localhost:5984
  6. {
  7. "admins": {
  8. "names": [
  9. "superuser"
  10. ],
  11. "roles": [
  12. "admins"
  13. ]
  14. },
  15. "members": {
  16. "names": [
  17. "user1",
  18. "user2"
  19. ],
  20. "roles": [
  21. "developers"
  22. ]
  23. }
  24. }

Response:

  1. HTTP/1.1 200 OK
  2. Cache-Control: must-revalidate
  3. Content-Length: 12
  4. Content-Type: application/json
  5. Date: Tue, 13 Aug 2013 11:26:28 GMT
  6. Server: CouchDB (Erlang/OTP)
  7. {
  8. "ok": true
  9. }