ACL - Upstash Documentation

Use ACL to inspect and manage the users, rules, and permissions of the database’s access control list. SETUSER creates or updates a user and applies rules from left to right: rules enable or disable the user (on, off), set passwords (>password, <password), and grant or revoke access to commands (+get, -@admin) and to key patterns (~cache:*). GETUSER shows the resulting rules for one user, USERS and LIST enumerate users in short and full form, and DELUSER removes them. WHOAMI reports the user the current connection is authenticated as, CAT lists the command categories that can be used in rules, and GENPASS returns a cryptographically strong random password. LOG shows recent authentication and permission failures, which is where to look when a client is unexpectedly denied, and RESET on that subcommand clears it. LOAD and SAVE reload and persist the ACL file. Upstash adds two deployment-specific forms: RESTTOKEN returns the REST token of an existing user, given that user’s password, and GENTOKEN builds a token for a username and password pair, generating a strong password when none is given, so the token can be passed to SETUSER as the user’s password. Together they are how an ACL user is given access to the REST API alongside the TCP endpoint. Changes take effect immediately on new and existing connections, so a rule that narrows access can lock out a running application; check with GETUSER before applying it broadly.

Syntax

ACL CAT [category]
ACL DELUSER <username> [username ...]
ACL GENPASS [bits]
ACL GETUSER <username>
ACL HELP
ACL LIST
ACL LOAD
ACL RESTTOKEN <username> <password>
ACL GENTOKEN <username> [password]
ACL LOG [count | RESET]
ACL SAVE
ACL SETUSER <username> [rule ...]
ACL USERS
ACL WHOAMI

Arguments

Argument	Required	Repeatable	Description
`subcommand`	Yes	No	One of the supported ACL operations shown in the syntax block.
`username`	Depends	Some forms	ACL user selected by the subcommand.
`rule`	No	Yes	ACL SETUSER rule; rules are applied from left to right.
`count \| RESET`	No	No	Limit ACL LOG output or clear the log.

Important points

This command can expose administrative information or make a broad destructive change. Restrict it to trusted code paths.
ACL is an administrative command. Changing users or rules can immediately revoke application access.
Upstash also supports the deployment-specific RESTTOKEN and GENTOKEN subcommands.

Response

The reply reports the result of the operation. Error replies have the same shape in RESP2 and RESP3 and are surfaced as exceptions by the SDKs below.

Protocol	Reply
RESP2	Simple string `OK`; Integer; Bulk string; array of bulk strings or nested metadata arrays; flat array of alternating keys and values; or Null bulk string or null array
RESP3	Simple string `OK`; Integer; Bulk string; array of bulk strings or nested metadata arrays; Map; or Null

Client libraries often decode bulk strings, maps, sets, and numeric strings into language-native values. The table describes the Redis wire reply.

Examples

TCP examples use the TLS REDIS_URL from the Upstash console. REST examples use UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN.

Redis CLI

ACL WHOAMI

@upstash/redis

This command is not supported yet in @upstash/redis.

upstash_redis

This command is not supported yet in upstash_redis.

ioredis

import Redis from "ioredis";

const redis = new Redis(process.env.REDIS_URL!);
const result = await redis.acl("WHOAMI");
console.log(result);

node-redis

import { createClient } from "redis";

const client = await createClient({ url: process.env.REDIS_URL })
  .on("error", console.error)
  .connect();
const result = await client.aclWhoAmI();
console.log(result);

redis-py

import os
import redis

client = redis.from_url(os.environ["REDIS_URL"])
result = client.acl_whoami()
print(result)

go-redis

package main

import (
    "context"
    "fmt"
    "os"

    "github.com/redis/go-redis/v9"
)

func main() {
    opts, err := redis.ParseURL(os.Getenv("REDIS_URL"))
    if err != nil {
        panic(err)
    }
    client := redis.NewClient(opts)
    result, err := client.ACLWhoAmI(context.Background()).Result()
    if err != nil {
        panic(err)
    }
    fmt.Println(result)
}

jedis

import java.net.URI;

import redis.clients.jedis.Jedis;

try (Jedis jedis = new Jedis(new URI(System.getenv("REDIS_URL")))) {
  Object result = jedis.aclWhoAmI();
  System.out.println(result);
}

redis-rs

use redis::TypedCommands;

fn main() -> redis::RedisResult<()> {
    let url = std::env::var("REDIS_URL").expect("REDIS_URL is not set");
    let client = redis::Client::open(url)?;
    let mut connection = client.get_connection()?;

    let result = connection.acl_whoami()?;
    println!("{result:?}");
    Ok(())
}

​Syntax

​Arguments

​Important points

​Response

​Examples

Syntax

Arguments

Important points

Response

Examples