Ranger-compatible policy service API
Ranger Admin REST serving surface polled by engine plugins (read-only policy/service-def download).
This page lists 6 endpoints (OpenAPI tag ranger). It is generated from openapi.json; see the REST API overview for authentication, CSRF and error conventions.
| Method | Path | Operation id | Notes |
|---|---|---|---|
| GET | /service/plugins/definitions | list_defs | |
| GET | /service/plugins/definitions/name/{name} | get_def | |
| GET | /service/plugins/policies/download/{service} | download_policies | GET /plugins/policies/download/\{service\}?lastKnownVersion=N |
| GET | /service/plugins/policies/{id} | get_policy | |
| GET | /service/plugins/services | list_services | |
| GET | /service/tags/download/{service} | download_tags | GET /tags/download/\{service\}?lastKnownVersion=N |
GET /service/plugins/definitions
Operation id: list_defs. Auth: Bearer token equal to ranger.auth_token (open when the token is empty).
Response 200 (application/json): RangerServiceDefs
| Field | Type | Required | Description |
|---|---|---|---|
serviceDefs | object[] | yes | Each element is a raw Ranger service-definition object (stored verbatim). |
| Status | Meaning |
|---|---|
| 200 | All stored Ranger service-definitions |
| 401 | Missing or invalid bearer token (when a ranger auth token is configured) |
| 500 | Internal error |
GET /service/plugins/definitions/name/{name}
Operation id: get_def. Auth: Bearer token equal to ranger.auth_token (open when the token is empty).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
name | path | string | yes | Service-definition name (e.g. trino) |
Response 200 (application/json): object
| Status | Meaning |
|---|---|
| 200 | The raw Ranger service-definition |
| 401 | Missing or invalid bearer token (when a ranger auth token is configured) |
| 404 | No such service-definition |
| 500 | Internal error |
GET /service/plugins/policies/download/{service}
Operation id: download_policies. Auth: Bearer token equal to ranger.auth_token (open when the token is empty).
GET /plugins/policies/download/\{service\}?lastKnownVersion=N
Returns 304 when the plugin's cached version matches; 200 + ServicePolicies otherwise.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
service | path | string | yes | Policy profile (Ranger service) name |
lastKnownVersion | query | integer (int64) | no | The plugin's cached policy version; a match yields 304 Not Modified. |
Response 200 (application/json): RangerServicePolicies
| Field | Type | Required | Description |
|---|---|---|---|
serviceName | string | yes | |
serviceId | integer (int64) | yes | |
policyVersion | integer (int64) | yes | |
policyUpdateTime | integer (int64), nullable | no | epoch millis; omitted when unknown |
serviceDef | object | yes | The raw Ranger service-definition (stored verbatim). |
policies | object[] | yes | The service's enabled policies, each a raw Ranger policy object. |
auditMode | string | yes |
| Status | Meaning |
|---|---|
| 200 | The service's enabled policies + service-def (plugin download envelope) |
| 304 | Not modified — the plugin's lastKnownVersion matches the current policy version |
| 401 | Missing or invalid bearer token (when a ranger auth token is configured) |
| 404 | No such policy profile |
| 500 | Internal error |
GET /service/plugins/policies/{id}
Operation id: get_policy. Auth: Bearer token equal to ranger.auth_token (open when the token is empty).
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | integer (int64) | yes | Policy id |
Response 200 (application/json): object
| Status | Meaning |
|---|---|
| 200 | The raw stored Ranger policy body (with id) |
| 401 | Missing or invalid bearer token (when a ranger auth token is configured) |
| 404 | No such policy |
| 500 | Internal error |
GET /service/plugins/services
Operation id: list_services. Auth: Bearer token equal to ranger.auth_token (open when the token is empty).
Response 200 (application/json): array of RangerServiceRef
| Field | Type | Required | Description |
|---|---|---|---|
id | integer (int64) | yes | |
name | string | yes | |
type | string | yes | |
configs | object | yes | The service's config map (stored verbatim). |
policyVersion | integer (int64) | yes | |
isEnabled | boolean | yes |
| Status | Meaning |
|---|---|
| 200 | All policy profiles (Ranger services) |
| 401 | Missing or invalid bearer token (when a ranger auth token is configured) |
| 500 | Internal error |
GET /service/tags/download/{service}
Operation id: download_tags. Auth: Bearer token equal to ranger.auth_token (open when the token is empty).
GET /tags/download/\{service\}?lastKnownVersion=N
Serves the real resource→tag mapping (catalog_tag_assignments) for the service's warehouse(s) as a Ranger ServiceTags. Returns 304 when the plugin's cached tagVersion matches the current one; 200 otherwise.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
service | path | string | yes | Policy profile (Ranger service) name |
lastKnownVersion | query | integer (int64) | no | The plugin's cached policy version; a match yields 304 Not Modified. |
Response 200 (application/json): RangerServiceTags
| Field | Type | Required | Description |
|---|---|---|---|
op | string | yes | |
serviceName | string | yes | |
tagVersion | integer (int64) | yes | |
tags | object | yes | Tag map keyed by numeric tag-id → tag-def instance. |
serviceResources | object[] | yes | |
resourceToTagIds | object | yes | \{ "<resourceId>": [<tagId>, ...] \} linking each resource to its tags. |
| Status | Meaning |
|---|---|
| 200 | The service's catalog tag assignments (plugin tag-download envelope) |
| 304 | Not modified — the plugin's lastKnownVersion matches the current tag version |
| 401 | Missing or invalid bearer token (when a ranger auth token is configured) |
| 404 | No such policy profile |
| 500 | Internal error |