Schema:

For guidance on query performance when using organization-wide usage views, see Performance (Organization Usage).

GRANTS_TO_USERS view¶

Important

This view is only available in the organization account. For more information, see Premium views in the organization account.

Organization Usage performance

When you query a specific view in the SNOWFLAKE.ORGANIZATION_USAGE schema, follow the organization-wide guidance in Performance (Organization Usage): bound every scan on history views, list columns explicitly, and use the time filter column table plus worked SQL and anti-patterns there.

This Organization Usage view can be used to query the roles that have been granted to a user.

Columns¶

Organization-level columns

Column Name	Data Type	Description
ORGANIZATION_NAME	VARCHAR	Name of the organization.
ACCOUNT_LOCATOR	VARCHAR	System-generated identifier for the account.
ACCOUNT_NAME	VARCHAR	User-defined identifier for the account.

Additional columns

Column Name	Data Type	Description
CREATED_ON	TIMESTAMP_LTZ	Time and date (in the UTC time zone) when the role is granted.
DELETED_ON	TIMESTAMP_LTZ	Time and date (in the UTC time zone) when the role is revoked.
EXPIRES_ON	TIMESTAMP_LTZ	Time and date (in the UTC time zone) when a temporary role grant expires. `NULL` for permanent grants.
ROLE	VARCHAR	Identifier for the role granted to the user.
GRANTED_TO	VARCHAR	For this view, the value is `USER`.
GRANTEE_NAME	VARCHAR	Name of the user to whom the privilege is granted.
GRANTED_BY	VARCHAR	Identifier for the role that granted the privilege.

Usage notes¶

Latency for the view may be up to 180 minutes (3 hours).

The GRANTS_TO_USERS view does not include grants of privileges and non-account roles to users. For that information, see the GRANTS_TO_ROLES view.
This view records current grants and historical grants, including grants that were revoked and granted again. When a single grant occurs and as long as it remains active (that is, not revoked):
- The view includes one row for the grant of the same role to the same user.
- Granting the same role to the same user again, from the same grantor, doesn’t add a row unless the statement changes the grant’s expiration. In that case, the DELETED_ON column of the existing row is set, and a new row records the grant with its new EXPIRES_ON and CREATED_ON values.
When a grant is revoked from the user, the DELETED_ON column for the grant is updated from NULL to the timestamp when the grant was revoked.
After revoking the role from the user, a grant of the same role to the same user is recorded in a new row. In this new row, the DELETED_ON column value is NULL because the grant is now active.
When a temporary grant expires, its row keeps a NULL DELETED_ON value until Snowflake removes the grant. DELETED_ON then shows when the grant was removed, which is later than EXPIRES_ON. To list grants that are currently active, filter on both columns. For example, in the ACCOUNT_USAGE schema:
```
SELECT role, grantee_name, granted_by, expires_on
  FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS
  WHERE deleted_on IS NULL
    AND (expires_on IS NULL OR expires_on > CURRENT_TIMESTAMP());
```