Add restriction policy APIs (#1337)

Co-authored-by: ci.datadog-api-spec <[email protected]>
Co-authored-by: api-clients-generation-pipeline[bot] <54105614+api-clients-generation-pipeline[bot]@users.noreply.github.com>

Author: api-clients-generation-pipeline[bot]

.apigentools-info

@@ -4,13 +4,13 @@
     "spec_versions": {
         "v1": {
             "apigentools_version": "1.6.4",
-            "regenerated": "2023-02-15 14:54:05.761282",
-            "spec_repo_commit": "3371aaa2"
+            "regenerated": "2023-02-16 07:53:05.962816",
+            "spec_repo_commit": "7d823ab8"
         },
         "v2": {
             "apigentools_version": "1.6.4",
-            "regenerated": "2023-02-15 14:54:05.774859",
-            "spec_repo_commit": "3371aaa2"
+            "regenerated": "2023-02-16 07:53:05.981326",
+            "spec_repo_commit": "7d823ab8"
         }
     }
 }

.generator/schemas/v2/openapi.yaml

@@ -347,6 +347,15 @@ components:
         example: 10
         format: int64
         type: integer
+    ResourceID:
+      description: 'Identifier, formatted as `type:id`. Supported types: `connection`,
+        `dashboard`, `notebook`, `security-rule`.'
+      example: dashboard:abc-def-ghi
+      in: path
+      name: resource_id
+      required: true
+      schema:
+        type: string
     RoleID:
       description: The unique identifier of the role.
       in: path
@@ -9010,6 +9019,91 @@ components:
         page:
           $ref: '#/components/schemas/Pagination'
       type: object
+    RestrictionPolicy:
+      description: Restriction policy object.
+      properties:
+        attributes:
+          $ref: '#/components/schemas/RestrictionPolicyAttributes'
+        id:
+          description: The identifier, always equivalent to the value specified in
+            the `resource_id` path parameter.
+          example: dashboard:abc-def-ghi
+          type: string
+        type:
+          $ref: '#/components/schemas/RestrictionPolicyType'
+      required:
+      - type
+      - id
+      - attributes
+      type: object
+    RestrictionPolicyAttributes:
+      description: Restriction policy attributes.
+      example:
+        bindings: []
+      properties:
+        bindings:
+          description: An array of bindings.
+          items:
+            $ref: '#/components/schemas/RestrictionPolicyBinding'
+          type: array
+      required:
+      - bindings
+      type: object
+    RestrictionPolicyBinding:
+      description: Specifies which principals are associated with a relation.
+      properties:
+        principals:
+          description: 'An array of principals. A principal is a subject or group
+            of subjects.
+
+            Each principal is formatted as `type:id`. Supported types: `role`, `user`,
+            `org`.
+
+            The org ID can be obtained through the api/v2/current_user API.'
+          example:
+          - role:00000000-0000-1111-0000-000000000000
+          items:
+            description: 'Subject or group of subjects. Each principal is formatted
+              as `type:id`.
+
+              Supported types: `role`, `user`, `org`.
+
+              The org ID can be obtained through the api/v2/current_user API.'
+            type: string
+          type: array
+        relation:
+          description: The role/level of access.
+          example: editor
+          type: string
+      required:
+      - relation
+      - principals
+      type: object
+    RestrictionPolicyResponse:
+      description: Response containing information about a single restriction policy.
+      properties:
+        data:
+          $ref: '#/components/schemas/RestrictionPolicy'
+      required:
+      - data
+      type: object
+    RestrictionPolicyType:
+      default: restriction_policy
+      description: Restriction policy type.
+      enum:
+      - restriction_policy
+      example: restriction_policy
+      type: string
+      x-enum-varnames:
+      - RESTRICTION_POLICY
+    RestrictionPolicyUpdateRequest:
+      description: Update request for a restriction policy.
+      properties:
+        data:
+          $ref: '#/components/schemas/RestrictionPolicy'
+      required:
+      - data
+      type: object
     Role:
       description: Role object returned by the API.
       properties:
@@ -16998,6 +17092,96 @@ paths:
         any
 
         feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
+  /api/v2/restriction_policy/{resource_id}:
+    delete:
+      description: Deletes the restriction policy associated with a specified resource.
+      operationId: DeleteRestrictionPolicy
+      parameters:
+      - $ref: '#/components/parameters/ResourceID'
+      responses:
+        '204':
+          description: No Content
+        '400':
+          $ref: '#/components/responses/BadRequestResponse'
+        '403':
+          $ref: '#/components/responses/NotAuthorizedResponse'
+        '429':
+          $ref: '#/components/responses/TooManyRequestsResponse'
+      security:
+      - apiKeyAuth: []
+        appKeyAuth: []
+      summary: Delete a restriction policy
+      tags:
+      - Restriction Policies
+    get:
+      description: Retrieves the restriction policy associated with a specified resource.
+      operationId: GetRestrictionPolicy
+      parameters:
+      - $ref: '#/components/parameters/ResourceID'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RestrictionPolicyResponse'
+          description: OK
+        '400':
+          $ref: '#/components/responses/BadRequestResponse'
+        '403':
+          $ref: '#/components/responses/NotAuthorizedResponse'
+        '429':
+          $ref: '#/components/responses/TooManyRequestsResponse'
+      security:
+      - apiKeyAuth: []
+        appKeyAuth: []
+      summary: Get a restriction policy
+      tags:
+      - Restriction Policies
+    post:
+      description: 'Updates the restriction policy associated with a resource.
+
+
+        #### Supported resources
+
+        Restriction policies can be applied to the following resources:
+
+        - Connections: `connection`
+
+        - Dashboards: `dashboard`
+
+        - Notebooks: `notebook`
+
+        - Security Rules: `security-rule`'
+      operationId: UpdateRestrictionPolicy
+      parameters:
+      - $ref: '#/components/parameters/ResourceID'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RestrictionPolicyUpdateRequest'
+        description: Restriction policy payload
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RestrictionPolicyResponse'
+          description: OK
+        '400':
+          $ref: '#/components/responses/BadRequestResponse'
+        '403':
+          $ref: '#/components/responses/NotAuthorizedResponse'
+        '429':
+          $ref: '#/components/responses/TooManyRequestsResponse'
+      security:
+      - apiKeyAuth: []
+        appKeyAuth: []
+      summary: Update a restriction policy
+      tags:
+      - Restriction Policies
+      x-codegen-request-body-name: body
   /api/v2/roles:
     get:
       description: Returns all roles, including their names and their unique identifiers.
@@ -20733,6 +20917,14 @@ tags:
   name: Processes
 - description: Search or aggregate your RUM events over HTTP.
   name: RUM
+- description: 'A restriction policy defines the access control rules for a resource,
+    mapping a set of relations
+
+    (such as editor and viewer) to a set of allowed principals (such as roles). The
+    restriction policy
+
+    determines who is authorized to perform what actions on the resource.'
+  name: Restriction Policies
 - description: 'The Roles API is used to create and manage Datadog roles, what
 
     [global permissions](https://docs.datadoghq.com/account_management/rbac/)

docs/datadog_api_client.v2.api.rst

@@ -155,6 +155,13 @@ processes\_api
    :members:
    :show-inheritance:
 
+restriction\_policies\_api
+--------------------------
+
+.. automodule:: datadog_api_client.v2.api.restriction_policies_api
+   :members:
+   :show-inheritance:
+
 roles\_api
 ----------
 

docs/datadog_api_client.v2.model.rst

@@ -3725,6 +3725,48 @@ response\_meta\_attributes
    :members:
    :show-inheritance:
 
+restriction\_policy
+-------------------
+
+.. automodule:: datadog_api_client.v2.model.restriction_policy
+   :members:
+   :show-inheritance:
+
+restriction\_policy\_attributes
+-------------------------------
+
+.. automodule:: datadog_api_client.v2.model.restriction_policy_attributes
+   :members:
+   :show-inheritance:
+
+restriction\_policy\_binding
+----------------------------
+
+.. automodule:: datadog_api_client.v2.model.restriction_policy_binding
+   :members:
+   :show-inheritance:
+
+restriction\_policy\_response
+-----------------------------
+
+.. automodule:: datadog_api_client.v2.model.restriction_policy_response
+   :members:
+   :show-inheritance:
+
+restriction\_policy\_type
+-------------------------
+
+.. automodule:: datadog_api_client.v2.model.restriction_policy_type
+   :members:
+   :show-inheritance:
+
+restriction\_policy\_update\_request
+------------------------------------
+
+.. automodule:: datadog_api_client.v2.model.restriction_policy_update_request
+   :members:
+   :show-inheritance:
+
 role
 ----
 

examples/v2/restriction-policies/DeleteRestrictionPolicy.py

@@ -0,0 +1,13 @@
+"""
+Delete a restriction policy returns "No Content" response
+"""
+
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.restriction_policies_api import RestrictionPoliciesApi
+
+configuration = Configuration()
+with ApiClient(configuration) as api_client:
+    api_instance = RestrictionPoliciesApi(api_client)
+    api_instance.delete_restriction_policy(
+        resource_id="dashboard:abc-def-ghi",
+    )

examples/v2/restriction-policies/GetRestrictionPolicy.py

@@ -0,0 +1,15 @@
+"""
+Get a restriction policy returns "OK" response
+"""
+
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.restriction_policies_api import RestrictionPoliciesApi
+
+configuration = Configuration()
+with ApiClient(configuration) as api_client:
+    api_instance = RestrictionPoliciesApi(api_client)
+    response = api_instance.get_restriction_policy(
+        resource_id="dashboard:abc-def-ghi",
+    )
+
+    print(response)

examples/v2/restriction-policies/UpdateRestrictionPolicy.py

@@ -0,0 +1,39 @@
+"""
+Update a restriction policy returns "OK" response
+"""
+
+from os import environ
+from datadog_api_client import ApiClient, Configuration
+from datadog_api_client.v2.api.restriction_policies_api import RestrictionPoliciesApi
+from datadog_api_client.v2.model.restriction_policy import RestrictionPolicy
+from datadog_api_client.v2.model.restriction_policy_attributes import RestrictionPolicyAttributes
+from datadog_api_client.v2.model.restriction_policy_binding import RestrictionPolicyBinding
+from datadog_api_client.v2.model.restriction_policy_type import RestrictionPolicyType
+from datadog_api_client.v2.model.restriction_policy_update_request import RestrictionPolicyUpdateRequest
+
+# there is a valid "user" in the system
+USER_DATA_RELATIONSHIPS_ORG_DATA_ID = environ["USER_DATA_RELATIONSHIPS_ORG_DATA_ID"]
+
+body = RestrictionPolicyUpdateRequest(
+    data=RestrictionPolicy(
+        id="dashboard:abc-def-ghi",
+        type=RestrictionPolicyType.RESTRICTION_POLICY,
+        attributes=RestrictionPolicyAttributes(
+            bindings=[
+                RestrictionPolicyBinding(
+                    relation="editor",
+                    principals=[
+                        "org:00000000-0000-beef-0000-000000000000",
+                    ],
+                ),
+            ],
+        ),
+    ),
+)
+
+configuration = Configuration()
+with ApiClient(configuration) as api_client:
+    api_instance = RestrictionPoliciesApi(api_client)
+    response = api_instance.update_restriction_policy(resource_id="dashboard:abc-def-ghi", body=body)
+
+    print(response)