API Get Metadata Registerd Models

[vinhdv4]

Hi all,

I has been call DBX API for get all metadata model
My user have no EXECUTE privileges on registered model, it only have USE CATALOG / USE SCHEMA  on parent catalog/schema
I still can get all metadata of Model

Here is my python code for call API:
___

import json

from databricks.sdk import WorkspaceClient

w = WorkspaceClient()

list_models = w.registered_models.list(

    catalog_name="system",

    schema_name="ai",

    include_browse=True)

i=0

for model in list_models:

    print(json.dumps(model.as_dict(), indent=4, ensure_ascii=False))

    i+=1

print(i)

___

But this documentation required EXECUTE privilege on the registered model (https://docs.databricks.com/api/workspace/registeredmodels/list)

Can anyone explain for me, please? T___T

[nick_martinek]

include_browse=True does not mean that USE CATALOG + USE SCHEMA are enough to list registered models.

What actually happens is:

With only USE CATALOG and USE SCHEMA:
include_browse=False → 0 models
include_browse=True → 0 models
After granting BROWSE on the catalog:
include_browse=False → 0 models
include_browse=True → models are returned

So include_browse=True includes models that are visible through the Unity Catalog BROWSE privilege, even when the principal does not have EXECUTE on the registered model.

In other words, EXECUTE is still required for normal access to the model, while BROWSE allows discovery / limited metadata visibility.

That explains why the API can return model metadata without EXECUTE when include_browse=True.

I hope that helps 🙂

[AbhilashNagilla]

The most likely reason is that system.ai grants EXECUTE to all users by default, so you probably hold effective EXECUTE inherited from the schema even without an explicit grant on any model, which is the privilege the API requires. USE CATALOG and USE SCHEMA are parent usage privileges that do not by themselves grant model access. Two checks confirm whether inherited EXECUTE or catalog BROWSE returned the models.

1. Print full_name and browse_only, then rerun with include_browse=False. The List Registered Models API says include_browse adds models the caller can access as selective metadata only, and browse_only=True marks a result returned through metadata-only BROWSE.

for model in w.registered_models.list(
    catalog_name="system",
    schema_name="ai",
    include_browse=True,
):
    print(model.full_name, model.browse_only)

The privileges reference separates that metadata discovery from EXECUTE, which loads a registered model for inference.

2. Check effective permissions on the system.ai schema and on a returned model. The Get Effective Permissions API takes securable type SCHEMA for the schema and FUNCTION for the model, since registered models are a type of function. The schema check surfaces the default all-users EXECUTE that inherits to the models; the model check surfaces any direct grant. Databricks documents that all users have EXECUTE on system.ai by default, and administrators can revoke it and grant EXECUTE on selected models instead.

With the same caller and unchanged grants, a model still returned when include_browse=False came through the regular privilege-filtered path, which requires ownership or effective EXECUTE. A model that appears only with include_browse=True and reports browse_only=True came through BROWSE.