Permissions for queries

Queries in ClickHouse can be divided into several types:

1. Read data queries: SELECT, SHOW, DESCRIBE, EXISTS.
2. Write data queries: INSERT, OPTIMIZE.
3. Change settings query: SET, USE.
4. DDL queries: CREATE, ALTER, RENAME, ATTACH, DETACH, DROP TRUNCATE.
5. KILL QUERY.

The following settings regulate user permissions by the type of query:

readonly

Restricts permissions for read data, write data, and change settings queries.

When set to 1, allows:

• All types of read queries (like SELECT and equivalent queries).
• Queries that modify only session context (like USE).

When set to 2, allows the above plus:

• SET and CREATE TEMPORARY TABLE

Possible values:

• 0 — Read, Write, and Change settings queries are allowed.
• 1 — Only Read data queries are allowed.
• 2 — Read data and Change settings queries are allowed.

Default value: 0

allow_ddl

Allows or denies DDL queries.

Possible values:

• 0 — DDL queries are not allowed.
• 1 — DDL queries are allowed.

Default value: 1