Restriction Policies

A restriction policy defines the access control rules for a resource, mapping a set of relations (such as editor and viewer) to a set of allowed principals (such as roles, teams, or users). The restriction policy determines who is authorized to perform what actions on the resource.

POST https://api.ap1.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.eu/api/v2/restriction_policy/{resource_id}https://api.ddog-gov.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us3.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us5.datadoghq.com/api/v2/restriction_policy/{resource_id}

Présentation

Updates the restriction policy associated with a resource.

Supported resources

Restriction policies can be applied to the following resources:

  • Dashboards: dashboard
  • Notebooks: notebook
  • Powerpacks: powerpack
  • Reference Tables: reference-table
  • Security Rules: security-rule
  • Service Level Objectives: slo
  • Synthetic Global Variables: synthetics-global-variable
  • Synthetic Tests: synthetics-test
  • Synthetic Private Locations: synthetics-private-location
  • Monitors: monitor
  • Workflows: workflow
  • App Builder Apps: app-builder-app
  • Connections: connection
  • Connection Groups: connection-group

Supported relations for resources

Resource TypeSupported Relations
Dashboardsviewer, editor
Notebooksviewer, editor
Powerpacksviewer, editor
Security Rulesviewer, editor
Service Level Objectivesviewer, editor
Synthetic Global Variablesviewer, editor
Synthetic Testsviewer, editor
Synthetic Private Locationsviewer, editor
Monitorsviewer, editor
Reference Tablesviewer, editor
Workflowsviewer, runner, editor
App Builder Appsviewer, editor
Connectionsviewer, resolver, editor
Connection Groupsviewer, editor

Arguments

Paramètres du chemin

Nom

Type

Description

resource_id [required]

string

Identifier, formatted as type:id. Supported types: connection, dashboard, notebook, reference-table, security-rule, slo, workflow, app-builder-app, connection, connection-group.

Chaînes de requête

Nom

Type

Description

allow_self_lockout

boolean

Allows admins (users with the user_access_manage permission) to remove their own access from the resource if set to true. By default, this is set to false, preventing admins from locking themselves out.

Requête

Body Data (required)

Restriction policy payload

Expand All

Champ

Type

Description

data [required]

object

Restriction policy object.

attributes [required]

object

Restriction policy attributes.

bindings [required]

[object]

An array of bindings.

principals [required]

[string]

An array of principals. A principal is a subject or group of subjects. Each principal is formatted as type:id. Supported types: role, team, user, and org. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.

relation [required]

string

The role/level of access.

id [required]

string

The identifier, always equivalent to the value specified in the resource_id path parameter.

type [required]

enum

Restriction policy type. Allowed enum values: restriction_policy

default: restriction_policy

{
  "data": {
    "id": "dashboard:test-update",
    "type": "restriction_policy",
    "attributes": {
      "bindings": [
        {
          "relation": "editor",
          "principals": [
            "org:00000000-0000-beef-0000-000000000000"
          ]
        }
      ]
    }
  }
}

Réponse

OK

Response containing information about a single restriction policy.

Expand All

Champ

Type

Description

data [required]

object

Restriction policy object.

attributes [required]

object

Restriction policy attributes.

bindings [required]

[object]

An array of bindings.

principals [required]

[string]

An array of principals. A principal is a subject or group of subjects. Each principal is formatted as type:id. Supported types: role, team, user, and org. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.

relation [required]

string

The role/level of access.

id [required]

string

The identifier, always equivalent to the value specified in the resource_id path parameter.

type [required]

enum

Restriction policy type. Allowed enum values: restriction_policy

default: restriction_policy

{
  "data": {
    "attributes": {
      "bindings": [
        {
          "principals": [
            "role:00000000-0000-1111-0000-000000000000"
          ],
          "relation": "editor"
        }
      ]
    },
    "id": "dashboard:abc-def-ghi",
    "type": "restriction_policy"
  }
}

Bad Request

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Exemple de code

// Update a restriction policy returns "OK" response

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)

func main() {
	// there is a valid "user" in the system

	body := datadogV2.RestrictionPolicyUpdateRequest{
		Data: datadogV2.RestrictionPolicy{
			Id:   "dashboard:test-update",
			Type: datadogV2.RESTRICTIONPOLICYTYPE_RESTRICTION_POLICY,
			Attributes: datadogV2.RestrictionPolicyAttributes{
				Bindings: []datadogV2.RestrictionPolicyBinding{
					{
						Relation: "editor",
						Principals: []string{
							"org:00000000-0000-beef-0000-000000000000",
						},
					},
				},
			},
		},
	}
	ctx := datadog.NewDefaultContext(context.Background())
	configuration := datadog.NewConfiguration()
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewRestrictionPoliciesApi(apiClient)
	resp, r, err := api.UpdateRestrictionPolicy(ctx, "dashboard:test-update", body, *datadogV2.NewUpdateRestrictionPolicyOptionalParameters())

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `RestrictionPoliciesApi.UpdateRestrictionPolicy`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}

	responseContent, _ := json.MarshalIndent(resp, "", "  ")
	fmt.Fprintf(os.Stdout, "Response from `RestrictionPoliciesApi.UpdateRestrictionPolicy`:\n%s\n", responseContent)
}

Instructions

First install the library and its dependencies and then save the example to main.go and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" go run "main.go"

GET https://api.ap1.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.eu/api/v2/restriction_policy/{resource_id}https://api.ddog-gov.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us3.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us5.datadoghq.com/api/v2/restriction_policy/{resource_id}

Présentation

Retrieves the restriction policy associated with a specified resource.

Arguments

Paramètres du chemin

Nom

Type

Description

resource_id [required]

string

Identifier, formatted as type:id. Supported types: connection, dashboard, notebook, reference-table, security-rule, slo, workflow, app-builder-app, connection, connection-group.

Réponse

OK

Response containing information about a single restriction policy.

Expand All

Champ

Type

Description

data [required]

object

Restriction policy object.

attributes [required]

object

Restriction policy attributes.

bindings [required]

[object]

An array of bindings.

principals [required]

[string]

An array of principals. A principal is a subject or group of subjects. Each principal is formatted as type:id. Supported types: role, team, user, and org. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.

relation [required]

string

The role/level of access.

id [required]

string

The identifier, always equivalent to the value specified in the resource_id path parameter.

type [required]

enum

Restriction policy type. Allowed enum values: restriction_policy

default: restriction_policy

{
  "data": {
    "attributes": {
      "bindings": [
        {
          "principals": [
            "role:00000000-0000-1111-0000-000000000000"
          ],
          "relation": "editor"
        }
      ]
    },
    "id": "dashboard:abc-def-ghi",
    "type": "restriction_policy"
  }
}

Bad Request

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Exemple de code

// Get a restriction policy returns "OK" response

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)

func main() {
	ctx := datadog.NewDefaultContext(context.Background())
	configuration := datadog.NewConfiguration()
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewRestrictionPoliciesApi(apiClient)
	resp, r, err := api.GetRestrictionPolicy(ctx, "dashboard:test-get")

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `RestrictionPoliciesApi.GetRestrictionPolicy`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}

	responseContent, _ := json.MarshalIndent(resp, "", "  ")
	fmt.Fprintf(os.Stdout, "Response from `RestrictionPoliciesApi.GetRestrictionPolicy`:\n%s\n", responseContent)
}

Instructions

First install the library and its dependencies and then save the example to main.go and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" go run "main.go"

DELETE https://api.ap1.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.eu/api/v2/restriction_policy/{resource_id}https://api.ddog-gov.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us3.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us5.datadoghq.com/api/v2/restriction_policy/{resource_id}

Présentation

Deletes the restriction policy associated with a specified resource.

Arguments

Paramètres du chemin

Nom

Type

Description

resource_id [required]

string

Identifier, formatted as type:id. Supported types: connection, dashboard, notebook, reference-table, security-rule, slo, workflow, app-builder-app, connection, connection-group.

Réponse

No Content

Bad Request

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Exemple de code

// Delete a restriction policy returns "No Content" response

package main

import (
	"context"
	"fmt"
	"os"

	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
)

func main() {
	ctx := datadog.NewDefaultContext(context.Background())
	configuration := datadog.NewConfiguration()
	apiClient := datadog.NewAPIClient(configuration)
	api := datadogV2.NewRestrictionPoliciesApi(apiClient)
	r, err := api.DeleteRestrictionPolicy(ctx, "dashboard:test-delete")

	if err != nil {
		fmt.Fprintf(os.Stderr, "Error when calling `RestrictionPoliciesApi.DeleteRestrictionPolicy`: %v\n", err)
		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
	}
}

Instructions

First install the library and its dependencies and then save the example to main.go and run following commands:

    
DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" go run "main.go"

PREVIEWING: brett.blue/reorg-otel