# UserSitePermissionsByUserLogin: Matomo Matomo Users Manager User Site Permissions ## Documentation The access level (view, write, admin or noaccess) one account holds on one site. Update and delete are not wired up - see the remarks below; call insert again with a new access value to change or remove a permission, the same idempotent call Matomo itself uses for both. - Catalog: `Matomo` - Schema: `UsersManager` - Primary Keys: `site` - Label: Matomo Users Manager User Site Permissions - Retrieve: True - Insert: True - Update: False - Delete: False ## Parameters of Table Function The following parameters can be used to control the behaviour of the table function `UserSitePermissionsByUserLogin`. A value must be provided at all times for required parameters, but optional parameters in general do not need to have a value and the execution will default to a pre-defined behaviour. Values can be specified by position and by name. In both cases, all parameters not specified will be evaluated using their default values. Value specification by position is done by listing all values from the first to the last needed value. For example: a `select * from table(value1, value2, value3)` on a table with four parameters will use the default value for the fourth parameter and the specified values for the first three. Value specification by name is done by listing all values that require a value. For example with `select * from table(name1 => value1, name3 => value3)` on the same table will use the default values for the second and fourth parameters and the specified values for the first and third. | Name | Data Type | Required | Default Value | Documentation | |---|:---:|:---:|:---:|---| | `user_login` | `varchar2` | ☑ | | The Matomo account to list site permissions of - Matomo.UsersManager.Users.login. | ## Columns of Table Function The columns of the table function `UserSitePermissionsByUserLogin` are shown below. Each column has an SQL data type. A new non-null value must be provided for every required column at all times during insert. | Name | Data Type | Label | Required | Documentation | |---|:---:|---|:---:|---| | `access` | `varchar2` | | ☑ | Access level: 'view', 'write', 'admin' or 'noaccess' - Matomo removes the underlying row entirely once it is set to 'noaccess', verified 2026-08-28. Granting 'admin' or the anonymous account 'view' over a genuine login session (not this driver's own token_auth connection) additionally demands password confirmation - Matomo's own setUserAccess() gates that on AuthenticationToken::isSessionToken(), which a token_auth connection is not, confirmed live 2026-08-28. Matomo also accepts an array of one role plus capability IDs here (for instance ['write', 'tagmanager_write']) - not exposed by this column, which only ever carries the plain role. | | `site` | `int32` | | ☑ | Site ID: primary key within one user_login's own result set (not globally unique - the same call scoped to a different account answers its own set of site rows). Matomo's own setUserAccess() takes it as 'idSites', plural, and also accepts a comma list or 'all'; this column always carries exactly one site. | | `user_login` | `varchar2` | | ☐ | Account to grant, change or remove access for. Required on insert; never answered on read, since a read is already scoped to one account by the table's own user_login argument. |