Restriction Policies

A restriction policy defines the access control rules for a resource, mapping a set of relations (such as editor and viewer) to a set of allowed principals (such as roles, teams, or users). The restriction policy determines who is authorized to perform what actions on the resource.

POST https://api.ap1.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.eu/api/v2/restriction_policy/{resource_id}https://api.ddog-gov.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us3.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us5.datadoghq.com/api/v2/restriction_policy/{resource_id}

Overview

Updates the restriction policy associated with a resource.

Supported resources

Restriction policies can be applied to the following resources:

  • Dashboards: dashboard
  • Notebooks: notebook
  • Powerpacks: powerpack
  • Reference Tables: reference-table
  • Security Rules: security-rule
  • Service Level Objectives: slo
  • Synthetic Global Variables: synthetics-global-variable
  • Synthetic Tests: synthetics-test
  • Synthetic Private Locations: synthetics-private-location
  • Monitors: monitor
  • Workflows: workflow
  • App Builder Apps: app-builder-app
  • Connections: connection
  • Connection Groups: connection-group

Supported relations for resources

Resource TypeSupported Relations
Dashboardsviewer, editor
Notebooksviewer, editor
Powerpacksviewer, editor
Security Rulesviewer, editor
Service Level Objectivesviewer, editor
Synthetic Global Variablesviewer, editor
Synthetic Testsviewer, editor
Synthetic Private Locationsviewer, editor
Monitorsviewer, editor
Reference Tablesviewer, editor
Workflowsviewer, runner, editor
App Builder Appsviewer, editor
Connectionsviewer, resolver, editor
Connection Groupsviewer, editor

Arguments

Path Parameters

Name

Type

Description

resource_id [required]

string

Identifier, formatted as type:id. Supported types: connection, dashboard, notebook, reference-table, security-rule, slo, workflow, app-builder-app, connection, connection-group.

Query Strings

Name

Type

Description

allow_self_lockout

boolean

Allows admins (users with the user_access_manage permission) to remove their own access from the resource if set to true. By default, this is set to false, preventing admins from locking themselves out.

Request

Body Data (required)

Restriction policy payload

Expand All

Field

Type

Description

data [required]

object

Restriction policy object.

attributes [required]

object

Restriction policy attributes.

bindings [required]

[object]

An array of bindings.

principals [required]

[string]

An array of principals. A principal is a subject or group of subjects. Each principal is formatted as type:id. Supported types: role, team, user, and org. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.

relation [required]

string

The role/level of access.

id [required]

string

The identifier, always equivalent to the value specified in the resource_id path parameter.

type [required]

enum

Restriction policy type. Allowed enum values: restriction_policy

default: restriction_policy

{
  "data": {
    "id": "dashboard:test-update",
    "type": "restriction_policy",
    "attributes": {
      "bindings": [
        {
          "relation": "editor",
          "principals": [
            "org:00000000-0000-beef-0000-000000000000"
          ]
        }
      ]
    }
  }
}

Response

OK

Response containing information about a single restriction policy.

Expand All

Field

Type

Description

data [required]

object

Restriction policy object.

attributes [required]

object

Restriction policy attributes.

bindings [required]

[object]

An array of bindings.

principals [required]

[string]

An array of principals. A principal is a subject or group of subjects. Each principal is formatted as type:id. Supported types: role, team, user, and org. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.

relation [required]

string

The role/level of access.

id [required]

string

The identifier, always equivalent to the value specified in the resource_id path parameter.

type [required]

enum

Restriction policy type. Allowed enum values: restriction_policy

default: restriction_policy

{
  "data": {
    "attributes": {
      "bindings": [
        {
          "principals": [
            "role:00000000-0000-1111-0000-000000000000"
          ],
          "relation": "editor"
        }
      ]
    },
    "id": "dashboard:abc-def-ghi",
    "type": "restriction_policy"
  }
}

Bad Request

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Code Example

                          # Path parameters
export resource_id="dashboard:abc-def-ghi"
# Curl command
curl -X POST "https://api.ap1.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/restriction_policy/${resource_id}" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "data": { "id": "dashboard:test-update", "type": "restriction_policy", "attributes": { "bindings": [ { "relation": "editor", "principals": [ "org:00000000-0000-beef-0000-000000000000" ] } ] } } } EOF

GET https://api.ap1.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.eu/api/v2/restriction_policy/{resource_id}https://api.ddog-gov.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us3.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us5.datadoghq.com/api/v2/restriction_policy/{resource_id}

Overview

Retrieves the restriction policy associated with a specified resource.

Arguments

Path Parameters

Name

Type

Description

resource_id [required]

string

Identifier, formatted as type:id. Supported types: connection, dashboard, notebook, reference-table, security-rule, slo, workflow, app-builder-app, connection, connection-group.

Response

OK

Response containing information about a single restriction policy.

Expand All

Field

Type

Description

data [required]

object

Restriction policy object.

attributes [required]

object

Restriction policy attributes.

bindings [required]

[object]

An array of bindings.

principals [required]

[string]

An array of principals. A principal is a subject or group of subjects. Each principal is formatted as type:id. Supported types: role, team, user, and org. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs.

relation [required]

string

The role/level of access.

id [required]

string

The identifier, always equivalent to the value specified in the resource_id path parameter.

type [required]

enum

Restriction policy type. Allowed enum values: restriction_policy

default: restriction_policy

{
  "data": {
    "attributes": {
      "bindings": [
        {
          "principals": [
            "role:00000000-0000-1111-0000-000000000000"
          ],
          "relation": "editor"
        }
      ]
    },
    "id": "dashboard:abc-def-ghi",
    "type": "restriction_policy"
  }
}

Bad Request

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Code Example

                  # Path parameters
export resource_id="dashboard:abc-def-ghi"
# Curl command
curl -X GET "https://api.ap1.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/restriction_policy/${resource_id}" \ -H "Accept: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}"

DELETE https://api.ap1.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.eu/api/v2/restriction_policy/{resource_id}https://api.ddog-gov.com/api/v2/restriction_policy/{resource_id}https://api.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us3.datadoghq.com/api/v2/restriction_policy/{resource_id}https://api.us5.datadoghq.com/api/v2/restriction_policy/{resource_id}

Overview

Deletes the restriction policy associated with a specified resource.

Arguments

Path Parameters

Name

Type

Description

resource_id [required]

string

Identifier, formatted as type:id. Supported types: connection, dashboard, notebook, reference-table, security-rule, slo, workflow, app-builder-app, connection, connection-group.

Response

No Content

Bad Request

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Field

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Code Example

                  # Path parameters
export resource_id="dashboard:abc-def-ghi"
# Curl command
curl -X DELETE "https://api.ap1.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/restriction_policy/${resource_id}" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}"

PREVIEWING: mahashree.rajendran/update-streams