create_database_user
Create database users in SAP Datasphere with custom consumption and ingestion permissions, including audit policies and auto-generated credentials.
Instructions
Create a new database user in a SAP Datasphere space with specified permissions.
IMPORTANT: This is a HIGH-RISK tool that requires user consent before execution.
Use this tool when:
User requests "Create a database user named JEFF in SALES"
Setting up new user access for applications or analysts
Configuring data ingestion users
Establishing read-only consumption users
Required parameters:
space_id: The space where user will be created
database_user_id: User name suffix (e.g., 'JEFF', 'REPORTING_USER')
user_definition: JSON object defining permissions and settings
User definition structure:
{
"consumption": {
"consumptionWithGrant": false,
"spaceSchemaAccess": false,
"scriptServerAccess": false,
"enablePasswordPolicy": false,
"localSchemaAccess": false,
"hdiGrantorForCupsAccess": false
},
"ingestion": {
"auditing": {
"dppRead": {
"isAuditPolicyActive": false,
"retentionPeriod": 7
},
"dppChange": {
"isAuditPolicyActive": false,
"retentionPeriod": 7
}
}
}
}Permission types:
Consumption: Read access to space data
consumptionWithGrant: Allow granting privileges to others
spaceSchemaAccess: Access to space schema objects
scriptServerAccess: Execute stored procedures/UDFs
Ingestion: Write access for data loading
Audit policies for compliance (DPP read/change tracking)
Security notes:
New password is auto-generated and returned (store securely!)
Audit retention period: 1-365 days
Minimum privilege principle recommended
Password must be changed on first login
Example queries:
"Create a read-only database user named ANALYST in SALES"
"Set up a database user for data loading in FINANCE"
"Create user REPORTING with consumption access"
Note: Corresponds to CLI: datasphere dbusers create --space --databaseuser --file-path <def.json>
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| space_id | Yes | The space ID where user will be created (e.g., 'SALES', 'FINANCE'). Must be uppercase. | |
| output_file | No | Optional: Path to save user credentials JSON (e.g., 'jeff.json'). RECOMMENDED for security - credentials shown only once! | |
| user_definition | Yes | JSON object defining user permissions and settings. Must include 'consumption' and 'ingestion' sections. | |
| database_user_id | Yes | Database user name suffix (e.g., 'JEFF', 'ANALYST', 'ETL_USER'). Will be prefixed with space name. |