security.go (package eai)

Source: sdks/go/security.go. Back to the Go SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Class SecurityService

SecurityService groups the endpoints of: platform security posture and tenant security settings.

SecurityService.GetSettings

GetSettings(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the security settings. Returns tenant_id and settings: the security settings of the tenant, defaults included. Needs tenant_admin or security_officer and a tenant (403 tenant_required).

Route: /v1/security/settings (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the security settings". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SecurityService.Posture

Posture(ctx context.Context, opts ...CallOption) (json.RawMessage, error)

Get the security posture. Returns environment, generated_at, protections (authentication methods and other protections in force), checks (each with its status pass, warn or fail, severity and message) and summary (number of checks per status). For a caller with a tenant, also tenant with the security settings of the tenant, which some checks take into account. Needs security_officer or tenant_admin. Read only.

Route: /v1/security/posture (GET).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Get the security posture". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

SecurityService.UpdateSettings

UpdateSettings(ctx context.Context, body any, opts ...CallOption) (json.RawMessage, error)

Update the security settings. Partial update: only the settings sent change, the others keep their value. Needs tenant_admin or security_officer and a tenant.

Route: /v1/security/settings (PUT).

Name	Type	Default	Required	Description
ctx	context.Context		yes	Context of the call: cancellation and deadline.
body	any		yes	JSON object with the settings to change, for example {"prompt_injection_mode": "block"}.
opts	...CallOption		no	Per call options (query, idempotency key, traceparent, headers).

Returns: (json.RawMessage, error). Decoded JSON answer of the operation "Update the security settings". The error is a typed error of the SDK, nil on success.

Raises: error, the typed errors of the transport (Errors).

Functions

IsLocalHost

IsLocalHost(host string) bool

IsLocalHost reports whether host is localhost, 127.0.0.1 or ::1.

Name	Type	Default	Required	Description
host	string		yes	Host name without port, compared case insensitively.

Returns: bool. true for localhost, 127.0.0.1 and ::1.

ValidateBaseURL

ValidateBaseURL(raw string) error

ValidateBaseURL accepts https URLs, and http only for localhost and 127.0.0.1.

Name	Type	Default	Required	Description
raw	string		yes	Return an ApiResponse (data, status, headers) instead of the decoded body.

Returns: error. Error of the call (a typed error of the SDK), nil on success.

Raises: error.

ValidateWebSocketURL

ValidateWebSocketURL(raw string) (string, error)

ValidateWebSocketURL accepts wss URLs, and ws only for localhost and 127.0.0.1; returns the URL.

Name	Type	Default	Required	Description
raw	string		yes	Return an ApiResponse (data, status, headers) instead of the decoded body.

Returns: (string, error). The URL unchanged when accepted; the error is set for a relative URL, another scheme, or ws to a remote host.

Raises: error.

WithCABundle

WithCABundle(pem []byte) Option

WithCABundle adds PEM encoded CA certificates to the system pool; verification stays on.

Name	Type	Default	Required	Description
pem	[]byte		yes	PEM encoded CA certificates; empty, or without any certificate, makes NewClient fail.

Returns: Option. An Option to pass to NewClient.

WithDangerouslyDisableTLSVerificationForLocalhost

WithDangerouslyDisableTLSVerificationForLocalhost() Option

WithDangerouslyDisableTLSVerificationForLocalhost turns certificate verification off. NewClient refuses it unless the base URL host is localhost, 127.0.0.1 or ::1.

This element takes no parameter.

Returns: Option. An Option to pass to NewClient.

MaskSecret

MaskSecret(s string) string

MaskSecret keeps at most 4 characters of a secret.

Name	Type	Default	Required	Description
s	string		yes	Secret to mask, such as an API key or a token.

Returns: string. The first 4 characters plus *** for a secret longer than 12 characters, *** otherwise, empty for an empty secret.

IsEgressDenied

IsEgressDenied(err error) bool

IsEgressDenied reports an egress_denied error.

Name	Type	Default	Required	Description
err	error		yes	Error to test.

Returns: bool. true when err matches ErrEgressDenied.

EgressDeniedReason

EgressDeniedReason(err error) string

EgressDeniedReason returns details.reason of an egress_denied error.

Name	Type	Default	Required	Description
err	error		yes	Error returned by the SDK.

Returns: string. The reason string of Details, empty when err is not egress_denied or has no reason.

IsPromptInjectionBlocked

IsPromptInjectionBlocked(err error) bool

IsPromptInjectionBlocked reports a prompt_injection_blocked error.

Name	Type	Default	Required	Description
err	error		yes	Error to test.

Returns: bool. true when err matches ErrPromptInjectionBlocked.

IsPayloadTooLarge

IsPayloadTooLarge(err error) bool

IsPayloadTooLarge reports a payload_too_large error (or HTTP 413).

Name	Type	Default	Required	Description
err	error		yes	Error to test.

Returns: bool. true for the payload_too_large code or an HTTP 413 status.