Secure MarkLogic Server

Using Pseudo-functions with Granular Privileges

Save PDF

Using Pseudo-functions with Granular Privileges

Save PDF

Last Updated: April 14, 2026
1 minute read

MarkLogic Server
Version 10.0
Documentation

When you have a payload that creates a database and a granular privilege for that database, you need to substitute a variable of some sort for the ID of the database because the database has yet to be created. MarkLogic Server has the following pseudo-functions that can be used when creating and assigning granular privileges:

Pseudo-Function and Parameters	Replaced By...
`$group-id(group-name)`	The group ID of the named group.
`$database-id(database-name)`	The database ID of the named database.
`$host-id()`	The host ID of the host running the query.
`$host-id(host-name)`	The host ID of the named host.
`$forest-id(forest-name)`	The forest ID of the named forest.
`$cluster-id()`	The cluster ID of the cluster to which the host running the query belongs.
`$cluster-id(cluster-name)`	The cluster ID of the named cluster.
`$role-id(role-name)`	The role ID of the named role.
`$user-id(user-name)`	The user ID of the named user.
`$server-id(server-name)`	The server ID of the named server in the group to which the host running the query belongs.
`$server-id("server-name", group-id)`	The server ID of the named server in the specified group. Note that `group-id` is an unsigned long. To refer to the group by name as well, nest the calls: `$server-id(server-name, $group-id(group-name))`
`$privilege-id("privilege-name")`	The privilege ID of the named /execute/ privilege.
`$privilege-id("privilege-name", "execute")`	The privilege ID of the named execute privilege.
`$privilege-id("privilege-name", "uri")`	The privilege ID of the named URI privilege.

For example, to create the privilege finalDbName-index-editor for a not-yet-created database represented by the variable FinalDbName, execute the following code:

{
    "privilege-name": "finalDbName-index-editor",
    "action": "http://marklogic.com/xdmp/privileges/admin/database/index/$database-id(FinalDbName)",
    "role": ["firstEditorRole","secondEditorRole"],
    "kind": "execute"
  }