1# @ohos.privacyManager (Privacy Management) (System API) 2 3The **privacyManager** module provides APIs for privacy management, such as management of permission usage records. 4 5> **NOTE** 6> 7> - The initial APIs of this module are supported since API version 9. Newly added APIs will be marked with a superscript to indicate their earliest API version. 8> - The APIs provided by this module are system APIs. 9 10## Modules to Import 11 12```ts 13import { privacyManager } from '@kit.AbilityKit'; 14``` 15 16 17## privacyManager.addPermissionUsedRecord 18 19addPermissionUsedRecord(tokenID: number, permissionName: Permissions, successCount: number, failCount: number, options?: AddPermissionUsedRecordOptions): Promise<void> 20 21Adds a permission usage record when an application protected by the permission is called by another service or application. This API uses a promise to return the result. 22The permission usage record includes the application identity (token ID) of the invoker, name of the permission used, and number of successful and failed accesses to the target application. 23 24**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 25 26**System capability**: SystemCapability.Security.AccessToken 27 28**Parameters** 29 30| Name | Type | Mandatory| Description | 31| -------- | ------------------- | ---- | ------------------------------------------ | 32| tokenID | number | Yes | Application token ID of the caller, which is the value of **accessTokenId** in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 33| permissionName | Permissions | Yes | Name of the permission.| 34| successCount | number | Yes | Number of successful accesses.| 35| failCount | number | Yes | Number of failed accesses.| 36| options<sup>12+</sup> | [AddPermissionUsedRecordOptions](#addpermissionusedrecordoptions12) | No | Options for adding a permission usage record. This parameter is supported since API version 12.| 37 38**Return value** 39 40| Type | Description | 41| :------------ | :---------------------------------- | 42| Promise<void> | Promise that returns no value.| 43 44**Error codes** 45 46For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 47 48| ID| Error Message| 49| -------- | -------- | 50| 201 | Permission denied. Interface caller does not have permission. | 51| 202 | Not System App. Interface caller is not a system app. | 52| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 53| 12100001 | Invalid parameter. The tokenID is 0, the permissionName exceeds 256 characters, the count value is invalid, or usedType in AddPermissionUsedRecordOptions is invalid. | 54| 12100002 | The specified tokenID does not exist or refer to an application process. | 55| 12100003 | The specified permission does not exist or is not an user_grant permission. | 56| 12100007 | The service is abnormal. | 57| 12100008 | Out of memory. | 58 59**Example** 60 61```ts 62import { privacyManager } from '@kit.AbilityKit'; 63import { BusinessError } from '@kit.BasicServicesKit'; 64 65let tokenID: number = 0; // You can use getApplicationInfo to obtain accessTokenId. 66privacyManager.addPermissionUsedRecord(tokenID, 'ohos.permission.READ_AUDIO', 1, 0).then(() => { 67 console.log('addPermissionUsedRecord success'); 68}).catch((err: BusinessError) => { 69 console.error(`addPermissionUsedRecord fail, err->${JSON.stringify(err)}`); 70}); 71// with options param 72let options: privacyManager.AddPermissionUsedRecordOptions = { 73 usedType: privacyManager.PermissionUsedType.PICKER_TYPE 74}; 75privacyManager.addPermissionUsedRecord(tokenID, 'ohos.permission.READ_AUDIO', 1, 0, options).then(() => { 76 console.log('addPermissionUsedRecord success'); 77}).catch((err: BusinessError) => { 78 console.error(`addPermissionUsedRecord fail, err->${JSON.stringify(err)}`); 79}); 80``` 81 82## privacyManager.addPermissionUsedRecord 83 84addPermissionUsedRecord(tokenID: number, permissionName: Permissions, successCount: number, failCount: number, callback: AsyncCallback<void>): void 85 86Adds a permission usage record when an application protected by the permission is called by another service or application. This API uses an asynchronous callback to return the result. 87The permission usage record includes the application identity (token ID) of the invoker, name of the permission used, and number of successful and failed accesses to the target application. 88 89**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 90 91**System capability**: SystemCapability.Security.AccessToken 92 93**Parameters** 94 95| Name | Type | Mandatory| Description | 96| -------- | ------------------- | ---- | ------------------------------------------ | 97| tokenID | number | Yes | Application token ID of the caller, which is the value of **accessTokenId** in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 98| permissionName | Permissions | Yes | Permission name. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 99| successCount | number | Yes | Number of successful accesses.| 100| failCount | number | Yes | Number of failed accesses.| 101| callback | AsyncCallback<void> | Yes | Callback invoked to return the result. If the operation is successful, **err** is **undefined**. Otherwise, **err** is an error object.| 102 103**Error codes** 104 105For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 106 107| ID| Error Message| 108| -------- | -------- | 109| 201 | Permission denied. Interface caller does not have permission. | 110| 202 | Not System App. Interface caller is not a system app. | 111| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 112| 12100001 | Invalid parameter. The tokenID is 0, the permissionName exceeds 256 characters, or the count value is invalid. | 113| 12100002 | The specified tokenID does not exist or refer to an application process. | 114| 12100003 | The specified permission does not exist or is not an user_grant permission. | 115| 12100007 | The service is abnormal. | 116| 12100008 | Out of memory. | 117 118**Example** 119 120```ts 121import { privacyManager } from '@kit.AbilityKit'; 122import { BusinessError } from '@kit.BasicServicesKit'; 123 124let tokenID: number = 0; // You can use getApplicationInfo to obtain accessTokenId. 125privacyManager.addPermissionUsedRecord(tokenID, 'ohos.permission.READ_AUDIO', 1, 0, (err: BusinessError, data: void) => { 126 if (err) { 127 console.error(`addPermissionUsedRecord fail, err->${JSON.stringify(err)}`); 128 } else { 129 console.log('addPermissionUsedRecord success'); 130 } 131}); 132``` 133 134## privacyManager.getPermissionUsedRecord 135 136getPermissionUsedRecord(request: PermissionUsedRequest): Promise<PermissionUsedResponse> 137 138Obtains historical permission usage records. This API uses a promise to return the result. 139 140**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 141 142**System capability**: SystemCapability.Security.AccessToken 143 144**Parameters** 145 146| Name | Type | Mandatory| Description | 147| -------- | ------------------- | ---- | ------------------------------------------ | 148| request | [PermissionUsedRequest](#permissionusedrequest) | Yes | Request for querying permission usage records. | 149 150**Return value** 151 152| Type | Description | 153| :------------ | :---------------------------------- | 154| Promise<[PermissionUsedResponse](#permissionusedresponse)> | Promise used to return the permission usage records.| 155 156**Error codes** 157 158For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 159 160| ID| Error Message| 161| -------- | -------- | 162| 201 | Permission denied. Interface caller does not have permission. | 163| 202 | Not System App. Interface caller is not a system app. | 164| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 165| 12100001 | Invalid parameter. The value of flag in request is invalid. | 166| 12100002 | The specified tokenID does not exist or refer to an application process. | 167| 12100003 | The specified permission does not exist or is not an user_grant permission. | 168| 12100007 | The service is abnormal. | 169| 12100008 | Out of memory. | 170 171**Example** 172 173```ts 174import { privacyManager } from '@kit.AbilityKit'; 175import { BusinessError } from '@kit.BasicServicesKit'; 176 177let request: privacyManager.PermissionUsedRequest = { 178 'tokenId': 1, 179 'isRemote': false, 180 'deviceId': 'device', 181 'bundleName': 'bundle', 182 'permissionNames': [], 183 'beginTime': 0, 184 'endTime': 1, 185 'flag':privacyManager.PermissionUsageFlag.FLAG_PERMISSION_USAGE_DETAIL, 186}; 187 188privacyManager.getPermissionUsedRecord(request).then((data) => { 189 console.log(`getPermissionUsedRecord success, data->${JSON.stringify(data)}`); 190}).catch((err: BusinessError) => { 191 console.error(`getPermissionUsedRecord fail, err->${JSON.stringify(err)}`); 192}); 193``` 194 195## privacyManager.getPermissionUsedRecord 196 197getPermissionUsedRecord(request: PermissionUsedRequest, callback: AsyncCallback<PermissionUsedResponse>): void 198 199Obtains historical permission usage records. This API uses an asynchronous callback to return the result. 200 201**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 202 203**System capability**: SystemCapability.Security.AccessToken 204 205**Parameters** 206 207| Name | Type | Mandatory| Description | 208| -------- | ------------------- | ---- | ------------------------------------------ | 209| request | [PermissionUsedRequest](#permissionusedrequest) | Yes| Request for querying permission usage records.| 210| callback | AsyncCallback<[PermissionUsedResponse](#permissionusedresponse)> | Yes| Callback invoked to return the result. If the operation is successful, **err** is **undefined** and **data** is the permission usage record obtained. Otherwise, **err** is an error object.| 211 212**Error codes** 213 214For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 215 216| ID| Error Message| 217| -------- | -------- | 218| 201 | Permission denied. Interface caller does not have permission. | 219| 202 | Not System App. Interface caller is not a system app. | 220| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 221| 12100001 | Invalid parameter. The value of flag in request is invalid. | 222| 12100002 | The specified tokenID does not exist or refer to an application process. | 223| 12100003 | The specified permission does not exist or is not an user_grant permission. | 224| 12100007 | The service is abnormal. | 225| 12100008 | Out of memory. | 226 227**Example** 228 229```ts 230import { privacyManager } from '@kit.AbilityKit'; 231import { BusinessError } from '@kit.BasicServicesKit'; 232 233let request: privacyManager.PermissionUsedRequest = { 234 'tokenId': 1, 235 'isRemote': false, 236 'deviceId': 'device', 237 'bundleName': 'bundle', 238 'permissionNames': [], 239 'beginTime': 0, 240 'endTime': 1, 241 'flag':privacyManager.PermissionUsageFlag.FLAG_PERMISSION_USAGE_DETAIL, 242}; 243 244privacyManager.getPermissionUsedRecord(request, (err: BusinessError, data: privacyManager.PermissionUsedResponse) => { 245 if (err) { 246 console.error(`getPermissionUsedRecord fail, err->${JSON.stringify(err)}`); 247 } else { 248 console.log(`getPermissionUsedRecord success, data->${JSON.stringify(data)}`); 249 } 250}); 251``` 252 253## privacyManager.startUsingPermission 254 255startUsingPermission(tokenID: number, permissionName: Permissions): Promise<void> 256 257Starts to use a permission and flushes the permission usage record. This API is called by a system application, either running in the foreground or background, and uses a promise to return the result. This API uses a promise to return the result. 258 259**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 260 261**System capability**: SystemCapability.Security.AccessToken 262 263**Parameters** 264 265| Name | Type | Mandatory| Description | 266| -------------- | ------ | ---- | ------------------------------------ | 267| tokenID | number | Yes | Application token ID of the caller, which is the value of **accessTokenId** in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 268| permissionName | Permissions | Yes | Permission to use. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 269 270**Return value** 271 272| Type | Description | 273| ------------- | --------------------------------------- | 274| Promise<void> | Promise that returns no value.| 275 276**Error codes** 277 278For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 279 280| ID| Error Message| 281| -------- | -------- | 282| 201 | Permission denied. Interface caller does not have permission. | 283| 202 | Not System App. Interface caller is not a system app. | 284| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 285| 12100001 | Invalid parameter. The tokenID is 0, the permissionName exceeds 256 characters, or the count value is invalid. | 286| 12100002 | The specified tokenID does not exist or refer to an application process. | 287| 12100003 | The specified permission does not exist or is not an user_grant permission. | 288| 12100004 | The API is used repeatedly with the same input. It means the application specified by the tokenID has been using the specified permission. | 289| 12100007 | The service is abnormal. | 290| 12100008 | Out of memory. | 291 292**Example** 293 294```ts 295import { privacyManager } from '@kit.AbilityKit'; 296import { BusinessError } from '@kit.BasicServicesKit'; 297 298let tokenID: number = 0; // You can use getApplicationInfo to obtain accessTokenId. 299privacyManager.startUsingPermission(tokenID, 'ohos.permission.READ_AUDIO').then(() => { 300 console.log('startUsingPermission success'); 301}).catch((err: BusinessError) => { 302 console.error(`startUsingPermission fail, err->${JSON.stringify(err)}`); 303}); 304``` 305 306## privacyManager.startUsingPermission 307 308startUsingPermission(tokenID: number, permissionName: Permissions, callback: AsyncCallback<void>): void 309 310Starts to use a permission and flushes the permission usage record. This API is called by a system application, either running in the foreground or background, and uses a promise to return the result. This API uses an asynchronous callback to return the result. 311 312**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 313 314**System capability**: SystemCapability.Security.AccessToken 315 316**Parameters** 317 318| Name | Type | Mandatory| Description | 319| -------------- | --------------------- | ---- | ------------------------------------ | 320| tokenID | number | Yes | Application token ID of the caller, which is the value of **accessTokenId** in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 321| permissionName | Permissions | Yes | Permission to use. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 322| callback | AsyncCallback<void> | Yes | Callback invoked to return the result. If the operation is successful, **err** is **undefined**. Otherwise, **err** is an error object.| 323 324**Error codes** 325 326For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 327 328| ID| Error Message| 329| -------- | -------- | 330| 201 | Permission denied. Interface caller does not have permission. | 331| 202 | Not System App. Interface caller is not a system app. | 332| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 333| 12100001 | Invalid parameter. The tokenID is 0, the permissionName exceeds 256 characters, or the count value is invalid. | 334| 12100002 | The specified tokenID does not exist or refer to an application process. | 335| 12100003 | The specified permission does not exist or is not an user_grant permission. | 336| 12100004 | The API is used repeatedly with the same input. It means the application specified by the tokenID has been using the specified permission. | 337| 12100007 | The service is abnormal. | 338| 12100008 | Out of memory. | 339 340**Example** 341 342```ts 343import { privacyManager } from '@kit.AbilityKit'; 344import { BusinessError } from '@kit.BasicServicesKit'; 345 346let tokenID: number = 0; // You can use getApplicationInfo to obtain accessTokenId. 347privacyManager.startUsingPermission(tokenID, 'ohos.permission.READ_AUDIO', (err: BusinessError, data: void) => { 348 if (err) { 349 console.error(`startUsingPermission fail, err->${JSON.stringify(err)}`); 350 } else { 351 console.log('startUsingPermission success'); 352 } 353}); 354``` 355 356## privacyManager.stopUsingPermission 357 358stopUsingPermission(tokenID: number, permissionName: Permissions): Promise<void> 359 360Stops using a permission. This API is called by a system application and uses a promise to return the result. **startUsingPermission** and **stopUsingPermission** are used in pairs. This API uses a promise to return the result. 361 362**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 363 364**System capability**: SystemCapability.Security.AccessToken 365 366**Parameters** 367 368| Name | Type | Mandatory| Description | 369| -------------- | ------ | ---- | ------------------------------------ | 370| tokenID | number | Yes | Application token ID of the caller, which is the value of **accessTokenId** in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 371| permissionName | Permissions | Yes | Permission to use. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 372 373**Return value** 374 375| Type | Description | 376| ------------- | --------------------------------------- | 377| Promise<void> | Promise that returns no value.| 378 379**Error codes** 380 381For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 382 383| ID| Error Message| 384| -------- | -------- | 385| 201 | Permission denied. Interface caller does not have permission. | 386| 202 | Not System App. Interface caller is not a system app. | 387| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 388| 12100001 | Invalid parameter. The tokenID is 0, the permissionName exceeds 256 characters, or the count value is invalid. | 389| 12100002 | The specified tokenID does not exist or refer to an application process. | 390| 12100003 | The specified permission does not exist or is not an user_grant permission. | 391| 12100004 | The API is not used in pair with 'startUsingPermission'. | 392| 12100007 | The service is abnormal. | 393| 12100008 | Out of memory. | 394 395**Example** 396 397```ts 398import { privacyManager } from '@kit.AbilityKit'; 399import { BusinessError } from '@kit.BasicServicesKit'; 400 401let tokenID: number = 0; // You can use getApplicationInfo to obtain accessTokenId. 402privacyManager.stopUsingPermission(tokenID, 'ohos.permission.READ_AUDIO').then(() => { 403 console.log('stopUsingPermission success'); 404}).catch((err: BusinessError) => { 405 console.error(`stopUsingPermission fail, err->${JSON.stringify(err)}`); 406}); 407``` 408 409## privacyManager.stopUsingPermission 410 411stopUsingPermission(tokenID: number, permissionName: Permissions, callback: AsyncCallback<void>): void 412 413Stops using a permission. This API is called by a system application and uses a promise to return the result. **startUsingPermission** and **stopUsingPermission** are used in pairs. This API uses an asynchronous callback to return the result. 414 415**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 416 417**System capability**: SystemCapability.Security.AccessToken 418 419**Parameters** 420 421| Name | Type | Mandatory| Description | 422| -------------- | --------------------- | ---- | ------------------------------------ | 423| tokenID | number | Yes | Application token ID of the caller, which is the value of **accessTokenId** in [ApplicationInfo](js-apis-bundleManager-applicationInfo.md).| 424| permissionName | Permissions | Yes | Permission to use. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 425| callback | AsyncCallback<void> | Yes | Callback invoked to return the result. If the operation is successful, **err** is **undefined**. Otherwise, **err** is an error object.| 426 427**Error codes** 428 429For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 430 431| ID| Error Message| 432| -------- | -------- | 433| 201 | Permission denied. Interface caller does not have permission. | 434| 202 | Not System App. Interface caller is not a system app. | 435| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 436| 12100001 | Invalid parameter. The tokenID is 0, the permissionName exceeds 256 characters, or the count value is invalid. | 437| 12100002 | The specified tokenID does not exist or refer to an application process. | 438| 12100003 | The specified permission does not exist or is not an user_grant permission. | 439| 12100004 | The API is not used in pair with 'startUsingPermission'. | 440| 12100007 | The service is abnormal. | 441| 12100008 | Out of memory. | 442 443**Example** 444 445```ts 446import { privacyManager } from '@kit.AbilityKit'; 447import { BusinessError } from '@kit.BasicServicesKit'; 448 449let tokenID: number = 0; // You can use getApplicationInfo to obtain accessTokenId. 450privacyManager.stopUsingPermission(tokenID, 'ohos.permission.READ_AUDIO', (err: BusinessError, data: void) => { 451 if (err) { 452 console.error(`stopUsingPermission fail, err->${JSON.stringify(err)}`); 453 } else { 454 console.log('stopUsingPermission success'); 455 } 456}); 457``` 458 459## privacyManager.on 460 461on(type: 'activeStateChange', permissionList: Array<Permissions>, callback: Callback<ActiveChangeResponse>): void 462 463Subscribes to the permission usage status changes of the specified permissions. 464 465Multiple callbacks can be registered for the same **permissionList**. 466 467The same callback cannot be registered for the **permissionList**s with common values. 468 469**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 470 471**System capability**: SystemCapability.Security.AccessToken 472 473**Parameters** 474 475| Name | Type | Mandatory| Description | 476| ------------------ | --------------------- | ---- | ------------------------------------------------------------ | 477| type | string | Yes | Event type. The value is **'activeStateChange'**, which indicates the permission usage change. | 478| permissionList | Array<Permissions> | Yes | Permissions to be observed. If this parameter is left empty, this API subscribes to usage status changes of all permissions. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 479| callback | Callback<[ActiveChangeResponse](#activechangeresponse)> | Yes| Callback invoked to return a change in the permission usage.| 480 481**Error codes** 482 483For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 484 485| ID| Error Message| 486| -------- | -------- | 487| 201 | Permission denied. Interface caller does not have permission. | 488| 202 | Not System App. Interface caller is not a system app. | 489| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 490| 12100001 | Invalid parameter. The tokenID is 0, or the permissionName exceeds 256 characters. | 491| 12100004 | The API is used repeatedly with the same input. | 492| 12100005 | The registration time has exceeded the limitation. | 493| 12100007 | The service is abnormal. | 494| 12100008 | Out of memory. | 495 496**Example** 497 498```ts 499import { privacyManager, Permissions } from '@kit.AbilityKit'; 500import { BusinessError } from '@kit.BasicServicesKit'; 501 502let permissionList: Array<Permissions> = []; 503try { 504 privacyManager.on('activeStateChange', permissionList, (data: privacyManager.ActiveChangeResponse) => { 505 console.debug('receive permission state change, data:' + JSON.stringify(data)); 506 }); 507} catch(err) { 508 console.error(`catch err->${JSON.stringify(err)}`); 509} 510``` 511 512## privacyManager.off 513 514off(type: 'activeStateChange', permissionList: Array<Permissions>, callback?: Callback<ActiveChangeResponse>): void 515 516Unsubscribes from the permission usage status changes of the specified permissions. 517 518If no callback is passed in **privacyManager.off**, all callbacks of **permissionList** will be unregistered. 519 520**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 521 522**System capability**: SystemCapability.Security.AccessToken 523 524**Parameters** 525 526| Name | Type | Mandatory| Description | 527| ------------------ | --------------------- | ---- | ------------------------------------------------------------ | 528| type | string | Yes | Event type. The value is **'activeStateChange'**, which indicates the permission usage change. | 529| permissionList | Array<Permissions> | Yes | List of permissions. The value must be the same as that of **on()**. If this parameter is left empty, this API unsubscribes from usage status changes of all permissions. For details about the permissions, see [Permissions for All Applications](../../security/AccessToken/permissions-for-all.md).| 530| callback | Callback<[ActiveChangeResponse](#activechangeresponse)> | No| Callback for the permission usage change event.| 531 532**Error codes** 533 534For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 535 536| ID| Error Message| 537| -------- | -------- | 538| 201 | Permission denied. Interface caller does not have permission. | 539| 202 | Not System App. Interface caller is not a system app. | 540| 401 | Parameter error. Possible causes: 1.Mandatory parameters are left unspecified; 2.Incorrect parameter types. | 541| 12100001 | Invalid parameter. The permissionNames in the list are all invalid, or the list size exceeds 1024 bytes. | 542| 12100004 | The API is not used in pair with 'on'. | 543| 12100007 | The service is abnormal. | 544| 12100008 | Out of memory. | 545 546**Example** 547 548```ts 549import { privacyManager, Permissions } from '@kit.AbilityKit'; 550 551let permissionList: Array<Permissions> = []; 552try { 553 privacyManager.off('activeStateChange', permissionList); 554} catch(err) { 555 console.error(`catch err->${JSON.stringify(err)}`); 556} 557``` 558 559## privacyManager.getPermissionUsedTypeInfos<sup>12+</sup> 560 561getPermissionUsedTypeInfos(tokenId?: number, permissionName?: Permissions): Promise<Array<PermissionUsedTypeInfo>> 562 563Obtains information about how a sensitive permission is used by an application. 564 565**Required permissions**: ohos.permission.PERMISSION_USED_STATS (available only to system applications) 566 567**System capability**: SystemCapability.Security.AccessToken 568 569**Parameters** 570 571| Name | Type | Mandatory| Description | 572| ------------------ | --------------------- | ---- | ------------------------------------------------------------ | 573| tokenId | number | No | ID of the application that uses the sensitive permission. If this parameter is left empty, this API obtains the sensitive permission access information of all applications. | 574| permissionName | Permissions | No | Name of the sensitive permission used. If this parameter is left blank, this API obtains the access information about all sensitive permissions. | 575 576**Return value** 577 578| Type | Description | 579| ------------- | --------------------------------------- | 580| Promise<Array<[PermissionUsedTypeInfo](#permissionusedtypeinfo12)>> | Promise used to return the information obtained.| 581 582**Error codes** 583 584For details about the error codes, see [Access Control Error Codes](errorcode-access-token.md). 585 586| ID| Error Message| 587| -------- | -------- | 588| 201 | Permission denied. Interface caller does not have permission. | 589| 202 | Not System App. Interface caller is not a system app. | 590| 401 | Parameter error. Possible causes: 1.Incorrect parameter types. | 591| 12100001 | Invalid parameter. PermissionName exceeds 256 characters. | 592| 12100002 | The input tokenId does not exist. | 593| 12100003 | The input permissionName does not exist. | 594 595**Example** 596 597```ts 598import { privacyManager, Permissions } from '@kit.AbilityKit'; 599import { BusinessError } from '@kit.BasicServicesKit'; 600 601let tokenId: number = 0; // You can use bundleManager.getApplicationInfo to obtain accessTokenId. 602let permissionName: Permissions = 'ohos.permission.CAMERA'; 603// Without any parameter. 604privacyManager.getPermissionUsedTypeInfos().then(() => { 605 console.log('getPermissionUsedTypeInfos success'); 606}).catch((err: BusinessError) => { 607 console.error(`getPermissionUsedTypeInfos fail, err->${JSON.stringify(err)}`); 608}); 609// Pass in tokenId only. 610privacyManager.getPermissionUsedTypeInfos(tokenId).then(() => { 611 console.log('getPermissionUsedTypeInfos success'); 612}).catch((err: BusinessError) => { 613 console.error(`getPermissionUsedTypeInfos fail, err->${JSON.stringify(err)}`); 614}); 615// Pass in permissionName only. 616privacyManager.getPermissionUsedTypeInfos(null, permissionName).then(() => { 617 console.log('getPermissionUsedTypeInfos success'); 618}).catch((err: BusinessError) => { 619 console.error(`getPermissionUsedTypeInfos fail, err->${JSON.stringify(err)}`); 620}); 621// Pass in tokenId and permissionName. 622privacyManager.getPermissionUsedTypeInfos(tokenId, permissionName).then(() => { 623 console.log('getPermissionUsedTypeInfos success'); 624}).catch((err: BusinessError) => { 625 console.error(`getPermissionUsedTypeInfos fail, err->${JSON.stringify(err)}`); 626}); 627``` 628 629## PermissionUsageFlag 630 631Enumerates the modes for querying the permission usage records. 632 633**System capability**: SystemCapability.Security.AccessToken 634 635| Name | Value| Description | 636| ----------------------- | ------ | ---------------------- | 637| FLAG_PERMISSION_USAGE_SUMMARY | 0 | Query the permission usage summary.| 638| FLAG_PERMISSION_USAGE_DETAIL | 1 | Query detailed permission usage records. | 639 640## PermissionUsedRequest 641 642Represents the request for querying permission usage records. 643 644**System capability**: SystemCapability.Security.AccessToken 645 646| Name | Type | Mandatory | Description | 647| -------- | -------------- | ---- | ---------------------------------------- | 648| tokenId | number | No | Token ID of the application (invoker).<br> By default, all applications are queried. | 649| isRemote | boolean | No | Whether to query the permission usage records of the remote device.<br> The default value is **false**, which means the permission usage records of the local device are queried by default.| 650| deviceId | string | No | ID of the device hosting the target application.<br> The default value is the local device ID. | 651| bundleName | string | No | Bundle name of the target application.<br> By default, all applications are queried.| 652| permissionNames | Array<Permissions> | No | Permissions to query.<br> By default, the usage records of all permissions are queried. | 653| beginTime | number | No | Start time of the query, in ms.<br>The default value is **0**, which means the start time is not set.| 654| endTime | number | No | End time of the query, in ms.<br>The default value is **0**, which means the end time is not set.| 655| flag | [PermissionUsageFlag](#permissionusageflag) | Yes | Query mode.| 656 657## PermissionUsedResponse 658 659Represents the permission usage records of all applications. 660 661**System capability**: SystemCapability.Security.AccessToken 662 663| Name | Type | Readable| Writable| Description | 664| --------- | -------------- | ---- | ---- | ---------------------------------------- | 665| beginTime | number | Yes | No | Start time of the query, in ms.| 666| endTime | number | Yes | No | End time of the query, in ms.| 667| bundleRecords | Array<[BundleUsedRecord](#bundleusedrecord)> | Yes | No | Permission usage records. | 668 669## BundleUsedRecord 670 671Represents the permission access records of an application. 672 673**System capability**: SystemCapability.Security.AccessToken 674 675| Name | Type | Readable| Writable| Description | 676| -------- | -------------- | ---- | ---- | ---------------------------------------- | 677| tokenId | number | Yes | No | Token ID of the application (invoker). | 678| isRemote | boolean | Yes | No | Whether the token ID belongs to the application on a remote device. The default value is **false**.| 679| deviceId | string | Yes | No | ID of the device hosting the target application. | 680| bundleName | string | Yes | No | Bundle name of the target application.| 681| permissionRecords | Array<[PermissionUsedRecord](#permissionusedrecord)> | Yes | No | Permission usage records of the target application. | 682 683## PermissionUsedRecord 684 685Represents the usage records of a permission. 686 687**System capability**: SystemCapability.Security.AccessToken 688 689| Name | Type | Readable| Writable| Description | 690| -------- | -------------- | ---- | ---- | ---------------------------------------- | 691| permissionName | Permissions | Yes | No | Name of the permission. | 692| accessCount | number | Yes | No | Total number of times that the permission is accessed.| 693| rejectCount | number | Yes | No | Total number of times that the access to the permission is rejected.| 694| lastAccessTime | number | Yes | No | Last time when the permission was accessed, accurate to ms.| 695| lastRejectTime | number | Yes | No | Last time when the access to the permission was rejected, accurate to ms.| 696| lastAccessDuration | number | Yes | No | Last access duration, in ms.| 697| accessRecords | Array<[UsedRecordDetail](#usedrecorddetail)> | Yes | No | Successful access records. This parameter is valid only when **flag** is **FLAG_PERMISSION_USAGE_DETAIL**. By default, 10 records are provided. | 698| rejectRecords | Array<[UsedRecordDetail](#usedrecorddetail)> | Yes | No | Rejected access records. This parameter is valid only when **flag** is **FLAG_PERMISSION_USAGE_DETAIL**. By default, 10 records are provided. | 699 700## UsedRecordDetail 701 702Represents the details of a single access record. 703 704**System capability**: SystemCapability.Security.AccessToken 705 706| Name | Type | Readable| Writable| Description | 707| -------- | -------------- | ---- | ---- | ---------------------------------------- | 708| status | number | Yes | No | Access status. | 709| lockScreenStatus<sup>11+</sup> | number | Yes | No | Status of the screen during the access.<br> - **1**: The screen is not locked when the permission is used.<br> - **2**: The screen is locked when the permission is used. | 710| timestamp | number | Yes | No | Access timestamp, in ms.| 711| accessDuration | number | Yes | No | Access duration, in ms. | 712| count<sup>11+</sup> | number | Yes| No | Number of successful or failed accesses. 713| usedType<sup>12+</sup> | [PermissionUsedType](#permissionusedtype12) | Yes| No | Means for using the sensitive permission.| 714 715## PermissionActiveStatus 716 717Enumerates the permission usage statuses. 718 719**System capability**: SystemCapability.Security.AccessToken 720 721| Name | Value | Description | 722| ------------------------- | ------ | ---------------- | 723| PERM_INACTIVE | 0 | The permission is not used. | 724| PERM_ACTIVE_IN_FOREGROUND | 1 | The permission is being used by an application running in the foreground.| 725| PERM_ACTIVE_IN_BACKGROUND | 2 | The permission is being used by an application running in the background.| 726 727## ActiveChangeResponse 728 729Defines the detailed permission usage information. 730 731 **System capability**: SystemCapability.Security.AccessToken 732 733| Name | Type | Readable| Writable| Description | 734| -------------- | ---------------------- | ---- | ---- | --------------------- | 735| tokenId | number | Yes | No | Token ID of the application. | 736| permissionName | Permissions | Yes | No | Name of the permission.| 737| deviceId | string | Yes | No | Device ID. | 738| activeStatus | [PermissionActiveStatus](#permissionactivestatus) | Yes | No | Permission usage status. | 739 740## PermissionUsedType<sup>12+</sup> 741 742Enumerates the means for using a sensitive permission. 743 744**System capability**: SystemCapability.Security.AccessToken 745 746| Name | Value| Description | 747| ----------------------- | -- | ---------------- | 748| NORMAL_TYPE | 0 | The sensitive permission is used after authorization through a dialog box or a system settings page. | 749| PICKER_TYPE | 1 | The sensitive permission is used through a system picker. This access mode does not grant the permissions to the application.| 750| SECURITY_COMPONENT_TYPE | 2 | The sensitive permission is used through a security component, which comes with the authorization.| 751 752## PermissionUsedTypeInfo<sup>12+</sup> 753 754Represents detailed information about the use of a permission. 755 756 **System capability**: SystemCapability.Security.AccessToken 757 758| Name | Type | Readable| Writable| Description | 759| -------------- | ---------------------- | ---- | ---- | --------------------- | 760| tokenId | number | Yes | No | ID of the application that uses the sensitive permission.| 761| permissionName | Permissions | Yes | No | Name of the sensitive permission.| 762| usedType | [PermissionUsedType](#permissionusedtype12) | Yes| No | Means for using the sensitive permission.| 763 764## AddPermissionUsedRecordOptions<sup>12+</sup> 765 766Represents the options for adding a permission usage record. 767 768 **System capability**: SystemCapability.Security.AccessToken 769 770| Name | Type | Readable| Writable| Description | 771| -------------- | ---------------------- | ---- | ---- | --------------------- | 772| usedType | [PermissionUsedType](#permissionusedtype12) | Yes| No | Means for using the sensitive permission.| 773