Users, roles, and credentials
Database users authenticate to an instance. Roles grant database permissions, tokens authenticate a user, and remote credentials authorize access to external objects. Cloud accounts are separate.
Common workflow
Users receive the permissions granted by their roles. A generated personal token must be assigned to a user before it can authenticate that account. Remote credentials are registered separately so the server can access protected external objects.
API account and token workflow. Each example includes its input and permission requirements.
Commands
See system-defined properties for object identifiers and built-in metadata, transactions and references for command chaining, and reading results for property selection and binary output.