The DBMS DATABASE MANAGEMENT privileges
AuraDB Business CriticalAuraDB Virtual Dedicated CloudEnterprise Edition

The DBMS privileges for database management can be granted, denied, or revoked like other privileges.

For more details about the syntax descriptions, see Reading the administration commands syntax.
Table 1. Database management privileges command syntax
Command Description 
GRANT [IMMUTABLE] CREATE DATABASE
  ON DBMS
  TO role[, ...]

Enables the specified roles to create new standard databases.

 
GRANT [IMMUTABLE] DROP DATABASE
  ON DBMS
  TO role[, ...]

Enables the specified roles to delete standard databases.

 
GRANT [IMMUTABLE] ALTER DATABASE
  ON DBMS
  TO role[, ...]

Enables the specified roles to modify standard databases.

 
GRANT [IMMUTABLE] SET DATABASE ACCESS
  ON DBMS
  TO role[, ...]

Enables the specified roles to modify access to standard databases.

 
GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE
  ON DBMS
  TO role[, ...]

Enables the specified roles to set the default query language on a standard database.

 
GRANT [IMMUTABLE] CREATE COMPOSITE DATABASE
  ON DBMS
  TO role[, ...]

Enables the specified roles to create new composite databases.

 
GRANT [IMMUTABLE] DROP COMPOSITE DATABASE
  ON DBMS
  TO role[, ...]

Enables the specified roles to delete composite databases.

 
GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE
  ON DBMS
  TO role[, ...]

Enables the specified roles to modify composite databases.

 
GRANT [IMMUTABLE] COMPOSITE DATABASE MANAGEMENT
  ON DBMS
  TO role[, ...]

Enables the specified roles to create, delete or modify composite databases.

 
GRANT [IMMUTABLE] DATABASE MANAGEMENT
  ON DBMS
  TO role[, ...]

Enables the specified roles to create, delete, and modify databases.

From Cypher 25 (Neo4j server 2025.08), the ALTER DATABASE, SET DATABASE ACCESS, SET DATABASE DEFAULT LANGUAGE, and ALTER COMPOSITE DATABASE privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, DATABASE *. For more information on the database privilege versions, see The alter database-related privileges.

Grant privilege to create standard databases

You can grant the privilege to create standard databases using the CREATE DATABASE privilege.
For example:

GRANT CREATE DATABASE ON DBMS TO databaseAdder

As a result, the databaseAdder role has privileges that only allow creating standard databases. To list all privileges for the role databaseAdder as commands, use the following query:

SHOW ROLE databaseAdder PRIVILEGES AS COMMANDS;
Table 2. Result
command

"GRANT CREATE DATABASE ON DBMS TO `databaseAdder`"

Rows: 1

Grant privilege to create composite databases

You can grant the privilege to create composite databases using the CREATE COMPOSITE DATABASE privilege.
For example:

GRANT CREATE COMPOSITE DATABASE ON DBMS TO compositeDatabaseAdder

As a result, the compositeDatabaseAdder role has privileges that only allow creating composite databases. To list all privileges for the role compositeDatabaseAdder as commands, use the following query:

SHOW ROLE compositeDatabaseAdder PRIVILEGES AS COMMANDS;
Table 3. Result
command

"GRANT CREATE COMPOSITE DATABASE ON DBMS TO `compositeDatabaseAdder`"

Rows: 1

Grant privilege to delete standard databases

You can grant the privilege to delete standard databases using the DROP DATABASE privilege.
For example:

GRANT DROP DATABASE ON DBMS TO databaseDropper

As a result, the databaseDropper role has privileges that only allow deleting standard databases. To list all privileges for the role databaseDropper as commands, use the following query:

SHOW ROLE databaseDropper PRIVILEGES AS COMMANDS;
Table 4. Result
command

"GRANT DROP DATABASE ON DBMS TO `databaseDropper`"

Rows: 1

Grant privilege to delete composite databases

You can grant the privilege to delete composite databases using the DROP COMPOSITE DATABASE privilege.
For example:

GRANT DROP COMPOSITE DATABASE ON DBMS TO compositeDatabaseDropper

As a result, the compositeDatabaseDropper role has privileges that only allow deleting composite databases. To list all privileges for the role compositeDatabaseDropper as commands, use the following query:

SHOW ROLE compositeDatabaseDropper PRIVILEGES AS COMMANDS;
Table 5. Result
command

"GRANT DROP COMPOSITE DATABASE ON DBMS TO `compositeDatabaseDropper`"

Rows: 1

Grant privilege to modify standard databases

You can grant the privilege to modify standard databases using the ALTER DATABASE privilege.
For example:

GRANT ALTER DATABASE ON DBMS TO databaseModifier;

As a result, the databaseModifier role has privileges that only allow modifying standard databases. To list all privileges for the role databaseModifier as commands, use the following query:

SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS;
Table 6. Result
command

"GRANT ALTER DATABASE ON DBMS TO `databaseModifier`"

Rows: 1

From Cypher 25 (Neo4j server 2025.08), the ALTER DATABASE privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, DATABASE *. For more information on the database privilege versions, see The alter database-related privileges.

Grant privilege to modify access to standard databases

You can grant the privilege to modify access to standard databases using the SET DATABASE ACCESS privilege.
For example:

GRANT SET DATABASE ACCESS ON DBMS TO accessModifier

As a result, the accessModifier role has privileges that only allow modifying access to standard databases. To list all privileges for the role accessModifier as commands, use the following query:

SHOW ROLE accessModifier PRIVILEGES AS COMMANDS;
Table 7. Result
command

"GRANT SET DATABASE ACCESS ON DBMS TO `accessModifier`"

Rows: 1

From Cypher 25 (Neo4j server 2025.08), the SET DATABASE ACCESS privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, DATABASE *. For more information on the database privilege versions, see The alter database-related privileges.

Grant privilege to modify the default language of standard databases
Introduced in 2025.06

You can grant the privilege to modify the default language of standard databases using the SET DATABASE DEFAULT LANGUAGE privilege.
For example:

GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO languageModifier

As a result, the languageModifier role has privileges that only allow modifying default language to standard databases. To list all privileges for the role languageModifier as commands, use the following query:

SHOW ROLE languageModifier PRIVILEGES AS COMMANDS;
Table 8. Result
command

"GRANT SET DATABASE DEFAULT LANGUAGE ON DBMS TO `languageModifier`"

Rows: 1

From Cypher 25 (Neo4j server 2025.08), the SET DATABASE DEFAULT LANGUAGE privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, DATABASE *. For more information on the database privilege versions, see The alter database-related privileges.

Grant privilege to modify composite databases
Introduced in 2025.06

You can grant the privilege to modify composite databases using the ALTER COMPOSITE DATABASE privilege.
For example:

GRANT ALTER COMPOSITE DATABASE ON DBMS TO compositeDatabaseModifier;

As a result, the compositeDatabaseModifier role has privileges that only allow modifying composite databases. To list all privileges for the role compositeDatabaseModifier as commands, use the following query:

SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS;
Table 9. Result
command

"GRANT ALTER COMPOSITE DATABASE ON DBMS TO `compositeDatabaseModifier`"

Rows: 1

From Cypher 25 (Neo4j server 2025.08), the ALTER COMPOSITE DATABASE privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, DATABASE *. For more information on the database privilege versions, see The alter database-related privileges.

Grant privilege to manage composite databases

You can grant the privilege to create, delete, and modify composite databases using the COMPOSITE DATABASE MANAGEMENT privilege.
For example:

GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO compositeDatabaseManager;

As a result, the compositeDatabaseManager role has all privileges to manage composite databases. To list all privileges for the role compositeDatabaseManager as commands, use the following query:

SHOW ROLE compositeDatabaseManager PRIVILEGES AS COMMANDS;
Table 10. Result
command

"GRANT COMPOSITE DATABASE MANAGEMENT ON DBMS TO `compositeDatabaseManager`"

Rows: 1

Grant privilege to manage standard and composite databases

You can grant the privilege to create, delete, and modify standard and composite databases using the DATABASE MANAGEMENT privilege.
For example:

GRANT DATABASE MANAGEMENT ON DBMS TO databaseManager;

As a result, the databaseManager role has all privileges to manage standard and composite databases. To list all privileges for the role databaseManager as commands, use the following query:

SHOW ROLE databaseManager PRIVILEGES AS COMMANDS;
Table 11. Result
command

"GRANT DATABASE MANAGEMENT ON DBMS TO `databaseManager`"

Rows: 1