Building a Data Stack Live with AI AgentsLivestream August 18

Skip to main content

REVOKE READ ON SHARE

Requires permissionRoles and access control →
Manage all organization SharesAdmin ✓Builder —Explorer —

Marked preset roles include the permission by default; a custom role qualifies when it inherits a role that includes it. Only the share owner can revoke access from a Share. Organization Admins can view a Share's grants (SHOW GRANTS ON SHARE) but cannot revoke access from Shares they do not own.

note

Only the owner of a Share can run REVOKE READ ON SHARE. Organization Admins can view existing grants with SHOW GRANTS ON SHARE, but running REVOKE against a Share owned by another account fails with Catalog Error: Database share <name> not found. In a multi-service-account (hypertenancy) setup, authenticate as the Share's owner to manage its grants.

For restricted Shares, use the REVOKE command to remove access from users or roles that have an existing GRANT. After you run REVOKE, there may be a delay of a few minutes before access is fully removed if the user has an active query on the Share. GRANT and REVOKE do not apply to UNRESTRICTED Shares.

Syntax​

REVOKE READ ON SHARE <share name> FROM { USER <username> | ROLE <role name> } [, ...];

If a username contains special characters, such as '@', it must be enclosed in double quotes (").

Example usage​

-- Revoke access to the share 'birds' from the user 'duck'.
REVOKE READ ON SHARE birds FROM USER duck;

-- Revoke access to the share 'taxis' from two users.
REVOKE READ ON SHARE taxis FROM USER usr1, USER usr2;

-- Revoke access from every user with the 'finance' role.
REVOKE READ ON SHARE core_metrics FROM ROLE finance;

-- Revoke access from a user whose username contains special characters.
REVOKE READ ON SHARE sensitive_data FROM USER "user@example-com";

If a user has access to the share through another role, they keep it after this revoke.