Resource Restrictions

The resourcerestrictions client methods are currently in BETA. The API may change without notice. A one-time warning is emitted on first use.

Restricting a resource prevents roles bound at higher hierarchy levels (space, org, account) from granting access to it. Only space admins or users with the PROJECT_RESTRICT permission can perform these actions. Currently only PROJECT resources are supported.

List Resource Restrictions

List returns a paginated list of resource restrictions. Defaults to a page size of 50. ResourceType, when non-empty, filters to a single resource type (currently only PROJECT is supported); when empty, restrictions of all supported types are returned. Signature:

func (c *Client) List(
    ctx context.Context,
    req ListRequest,
) (*ListResourceRestrictions, error)

Usage Example:

package main

import (
    "context"
    "errors"
    "fmt"
    "log"

    "github.com/Arize-ai/client-go-v2/arize"
    "github.com/Arize-ai/client-go-v2/arize/resourcerestrictions"
)

func main() {
    client, err := arize.NewClient(arize.Config{APIKey: "your-api-key"})
    if err != nil {
        log.Fatal(err)
    }

    resp, err := client.ResourceRestrictions.List(
        context.Background(),
        resourcerestrictions.ListRequest{
            ResourceType: resourcerestrictions.ResourceRestrictionTypePROJECT,
            Limit:        25,
        },
    )
    if err != nil {
        var unauthorized *arize.UnauthorizedError
        if errors.As(err, &unauthorized) {
            log.Fatalf("unauthorized: %v", unauthorized)
        }
        log.Fatal(err)
    }

    for _, r := range resp.ResourceRestrictions {
        fmt.Printf("%s (type=%s) restricted at %s\n", r.ResourceId, r.ResourceType, r.CreatedAt)
    }
}

Restrict a Resource

Restrict marks a resource as restricted and returns the restriction record. This operation is idempotent — restricting an already-restricted resource returns the existing restriction without error. Signature:

func (c *Client) Restrict(
    ctx context.Context,
    req RestrictRequest,
) (*ResourceRestriction, error)

Usage Example:

package main

import (
    "context"
    "errors"
    "fmt"
    "log"

    "github.com/Arize-ai/client-go-v2/arize"
    "github.com/Arize-ai/client-go-v2/arize/resourcerestrictions"
)

func main() {
    client, err := arize.NewClient(arize.Config{APIKey: "your-api-key"})
    if err != nil {
        log.Fatal(err)
    }

    restriction, err := client.ResourceRestrictions.Restrict(
        context.Background(),
        resourcerestrictions.RestrictRequest{
            ResourceID: "your-project-id", // global ID of the resource to restrict
        },
    )
    if err != nil {
        var forbidden *arize.ForbiddenError
        if errors.As(err, &forbidden) {
            log.Fatalf("missing PROJECT_RESTRICT permission: %v", forbidden)
        }
        log.Fatal(err)
    }

    fmt.Printf("restricted %s (type=%s) at %s\n",
        restriction.ResourceId,
        restriction.ResourceType,
        restriction.CreatedAt,
    )
}

Unrestrict a Resource

Unrestrict removes a restriction from a resource. ResourceID is the ID of the restricted resource (e.g. a project ID), not the ID of the restriction record itself — the API dereferences from the restricted resource to the restriction it holds. It returns only an error. Signature:

func (c *Client) Unrestrict(ctx context.Context, req UnrestrictRequest) error

Usage Example:

package main

import (
    "context"
    "errors"
    "log"

    "github.com/Arize-ai/client-go-v2/arize"
    "github.com/Arize-ai/client-go-v2/arize/resourcerestrictions"
)

func main() {
    client, err := arize.NewClient(arize.Config{APIKey: "your-api-key"})
    if err != nil {
        log.Fatal(err)
    }

    err = client.ResourceRestrictions.Unrestrict(
        context.Background(),
        resourcerestrictions.UnrestrictRequest{ResourceID: "your-project-id"},
    )
    if err != nil {
        var notFound *arize.NotFoundError
        if errors.As(err, &notFound) {
            log.Printf("no restriction to remove: %v", notFound)
            return
        }
        log.Fatal(err)
    }
}

API reference

API clients

List Resource Restrictions

Restrict a Resource

Unrestrict a Resource

​List Resource Restrictions

​Restrict a Resource

​Unrestrict a Resource

List Resource Restrictions

Restrict a Resource

Unrestrict a Resource