---
title: Logs Restriction Queries
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > API Reference > Logs Restriction Queries
---

# Logs Restriction Queries

**Note: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).**

A Restriction Query is a logs query that restricts which logs the `logs_read_data` permission grants read access to. For users whose roles have Restriction Queries, any log query they make only returns those log events that also match one of their Restriction Queries. This is true whether the user queries log events from any log-related feature, including the log explorer, Live Tail, re-hydration, or a dashboard widget.

Restriction Queries currently only support use of the following components of log events:

- Reserved attributes
- The log message
- Tags

To restrict read access on log data, add a team tag to log events to indicate which teams own them, and then scope Restriction Queries to the relevant values of the team tag. Tags can be applied to log events in many ways, and a log event can have multiple tags with the same key (like team) and different values. This means the same log event can be visible to roles whose restriction queries are scoped to different team values.

See [How to Set Up RBAC for Logs](https://docs.datadoghq.com/logs/guide/logs-rbac.md?tab=api#restrict-access-to-logs) for details on how to add restriction queries.

## List restriction queries → preview{% #list-restriction-queries %}

| Datadog site      | API endpoint                                                             |
| ----------------- | ------------------------------------------------------------------------ |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/logs/config/restriction_queries      |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/logs/config/restriction_queries      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries  |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/logs/config/restriction_queries     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries |

## Create a restriction query → preview{% #create-a-restriction-query %}

| Datadog site      | API endpoint                                                              |
| ----------------- | ------------------------------------------------------------------------- |
| ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries |
| ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries |
| app.datadoghq.eu  | POST https://api.datadoghq.eu/api/v2/logs/config/restriction_queries      |
| app.ddog-gov.com  | POST https://api.ddog-gov.com/api/v2/logs/config/restriction_queries      |
| us2.ddog-gov.com  | POST https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries  |
| app.datadoghq.com | POST https://api.datadoghq.com/api/v2/logs/config/restriction_queries     |
| us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries |
| us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries |

## Get a restriction query → preview{% #get-a-restriction-query %}

| Datadog site      | API endpoint                                                                                    |
| ----------------- | ----------------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}  |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |

## Update a restriction query → preview{% #update-a-restriction-query %}

| Datadog site      | API endpoint                                                                                      |
| ----------------- | ------------------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | PATCH https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| ap2.datadoghq.com | PATCH https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| app.datadoghq.eu  | PATCH https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| app.ddog-gov.com  | PATCH https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| us2.ddog-gov.com  | PATCH https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}  |
| app.datadoghq.com | PATCH https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}     |
| us3.datadoghq.com | PATCH https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| us5.datadoghq.com | PATCH https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |

## Replace a restriction query → preview{% #replace-a-restriction-query %}

| Datadog site      | API endpoint                                                                                    |
| ----------------- | ----------------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | PUT https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| ap2.datadoghq.com | PUT https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| app.datadoghq.eu  | PUT https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| app.ddog-gov.com  | PUT https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| us2.ddog-gov.com  | PUT https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}  |
| app.datadoghq.com | PUT https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}     |
| us3.datadoghq.com | PUT https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| us5.datadoghq.com | PUT https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |

## Delete a restriction query → preview{% #delete-a-restriction-query %}

| Datadog site      | API endpoint                                                                                       |
| ----------------- | -------------------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | DELETE https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| ap2.datadoghq.com | DELETE https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| app.datadoghq.eu  | DELETE https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| app.ddog-gov.com  | DELETE https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}      |
| us2.ddog-gov.com  | DELETE https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}  |
| app.datadoghq.com | DELETE https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}     |
| us3.datadoghq.com | DELETE https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |
| us5.datadoghq.com | DELETE https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id} |

## List roles for a restriction query → preview{% #list-roles-for-a-restriction-query %}

| Datadog site      | API endpoint                                                                                          |
| ----------------- | ----------------------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles      |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles  |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |

## Grant role to a restriction query → preview{% #grant-role-to-a-restriction-query %}

| Datadog site      | API endpoint                                                                                           |
| ----------------- | ------------------------------------------------------------------------------------------------------ |
| ap1.datadoghq.com | POST https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| ap2.datadoghq.com | POST https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| app.datadoghq.eu  | POST https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles      |
| app.ddog-gov.com  | POST https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles      |
| us2.ddog-gov.com  | POST https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles  |
| app.datadoghq.com | POST https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles     |
| us3.datadoghq.com | POST https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| us5.datadoghq.com | POST https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |

## Revoke role from a restriction query → preview{% #revoke-role-from-a-restriction-query %}

| Datadog site      | API endpoint                                                                                             |
| ----------------- | -------------------------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | DELETE https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| ap2.datadoghq.com | DELETE https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| app.datadoghq.eu  | DELETE https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles      |
| app.ddog-gov.com  | DELETE https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles      |
| us2.ddog-gov.com  | DELETE https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles  |
| app.datadoghq.com | DELETE https://api.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles     |
| us3.datadoghq.com | DELETE https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |
| us5.datadoghq.com | DELETE https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/{restriction_query_id}/roles |

## Get all restriction queries for a given user → preview{% #get-all-restriction-queries-for-a-given-user %}

| Datadog site      | API endpoint                                                                            |
| ----------------- | --------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/user/{user_id} |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/user/{user_id} |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/user/{user_id}      |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/user/{user_id}      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/user/{user_id}  |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/logs/config/restriction_queries/user/{user_id}     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/user/{user_id} |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/user/{user_id} |

## Get restriction query for a given role → preview{% #get-restriction-query-for-a-given-role %}

| Datadog site      | API endpoint                                                                            |
| ----------------- | --------------------------------------------------------------------------------------- |
| ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/logs/config/restriction_queries/role/{role_id} |
| ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/logs/config/restriction_queries/role/{role_id} |
| app.datadoghq.eu  | GET https://api.datadoghq.eu/api/v2/logs/config/restriction_queries/role/{role_id}      |
| app.ddog-gov.com  | GET https://api.ddog-gov.com/api/v2/logs/config/restriction_queries/role/{role_id}      |
| us2.ddog-gov.com  | GET https://api.us2.ddog-gov.com/api/v2/logs/config/restriction_queries/role/{role_id}  |
| app.datadoghq.com | GET https://api.datadoghq.com/api/v2/logs/config/restriction_queries/role/{role_id}     |
| us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/logs/config/restriction_queries/role/{role_id} |
| us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/logs/config/restriction_queries/role/{role_id} |