> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Resource Restrictions

> Control access to resources by restricting or unrestricting them using the Arize Go SDK.

<Note>
  The `resourcerestrictions` client methods are currently in **BETA**. The API may change without notice. A one-time warning is emitted on first use.
</Note>

Restricting a resource prevents roles bound at higher hierarchy levels (space, org, account) from granting access to it. Only space admins or users with the `PROJECT_RESTRICT` permission can perform these actions. Currently only `PROJECT` resources are supported.

## List Resource Restrictions

`List` returns a paginated list of resource restrictions. Defaults to a page size of 50. `ResourceType`, when non-empty, filters to a single resource type (currently only `PROJECT` is supported); when empty, restrictions of all supported types are returned.

**Signature:**

```go theme={null}
func (c *Client) List(
    ctx context.Context,
    req ListRequest,
) (*ListResourceRestrictions, error)
```

**Usage Example:**

```go theme={null}
package main

import (
    "context"
    "errors"
    "fmt"
    "log"

    "github.com/Arize-ai/client-go-v2/arize"
    "github.com/Arize-ai/client-go-v2/arize/resourcerestrictions"
)

func main() {
    client, err := arize.NewClient(arize.Config{APIKey: "your-api-key"})
    if err != nil {
        log.Fatal(err)
    }

    resp, err := client.ResourceRestrictions.List(
        context.Background(),
        resourcerestrictions.ListRequest{
            ResourceType: resourcerestrictions.ResourceRestrictionTypePROJECT,
            Limit:        25,
        },
    )
    if err != nil {
        var unauthorized *arize.UnauthorizedError
        if errors.As(err, &unauthorized) {
            log.Fatalf("unauthorized: %v", unauthorized)
        }
        log.Fatal(err)
    }

    for _, r := range resp.ResourceRestrictions {
        fmt.Printf("%s (type=%s) restricted at %s\n", r.ResourceId, r.ResourceType, r.CreatedAt)
    }
}
```

## Restrict a Resource

`Restrict` marks a resource as restricted and returns the restriction record. This operation is idempotent — restricting an already-restricted resource returns the existing restriction without error.

**Signature:**

```go theme={null}
func (c *Client) Restrict(
    ctx context.Context,
    req RestrictRequest,
) (*ResourceRestriction, error)
```

**Usage Example:**

```go theme={null}
package main

import (
    "context"
    "errors"
    "fmt"
    "log"

    "github.com/Arize-ai/client-go-v2/arize"
    "github.com/Arize-ai/client-go-v2/arize/resourcerestrictions"
)

func main() {
    client, err := arize.NewClient(arize.Config{APIKey: "your-api-key"})
    if err != nil {
        log.Fatal(err)
    }

    restriction, err := client.ResourceRestrictions.Restrict(
        context.Background(),
        resourcerestrictions.RestrictRequest{
            ResourceID: "your-project-id", // global ID of the resource to restrict
        },
    )
    if err != nil {
        var forbidden *arize.ForbiddenError
        if errors.As(err, &forbidden) {
            log.Fatalf("missing PROJECT_RESTRICT permission: %v", forbidden)
        }
        log.Fatal(err)
    }

    fmt.Printf("restricted %s (type=%s) at %s\n",
        restriction.ResourceId,
        restriction.ResourceType,
        restriction.CreatedAt,
    )
}
```

## Unrestrict a Resource

`Unrestrict` removes a restriction from a resource. `ResourceID` is the ID of the restricted resource (e.g. a project ID), not the ID of the restriction record itself — the API dereferences from the restricted resource to the restriction it holds. It returns only an error.

**Signature:**

```go theme={null}
func (c *Client) Unrestrict(ctx context.Context, req UnrestrictRequest) error
```

**Usage Example:**

```go theme={null}
package main

import (
    "context"
    "errors"
    "log"

    "github.com/Arize-ai/client-go-v2/arize"
    "github.com/Arize-ai/client-go-v2/arize/resourcerestrictions"
)

func main() {
    client, err := arize.NewClient(arize.Config{APIKey: "your-api-key"})
    if err != nil {
        log.Fatal(err)
    }

    err = client.ResourceRestrictions.Unrestrict(
        context.Background(),
        resourcerestrictions.UnrestrictRequest{ResourceID: "your-project-id"},
    )
    if err != nil {
        var notFound *arize.NotFoundError
        if errors.As(err, &notFound) {
            log.Printf("no restriction to remove: %v", notFound)
            return
        }
        log.Fatal(err)
    }
}
```