Skip to main content
Call this API to add or modify settings that restrict employees, departments, or roles from viewing the Contacts.

API call description

In the DingTalk OA admin console, you can restrict members of a department from viewing the Contacts. This API extends that capability. It can restrict not only members of a department, but also individual employees and roles, from viewing the Contacts.
The visibility restriction settings configured through this API are stored independently from those configured in the OA admin console. The final effect is a logical OR of both. For example, if the same department is set to “view self only” by either this API or the OA admin console, the department will be restricted to viewing self only.

Request

Basic information

FieldValue
HTTP URLhttps://api.dingtalk.io/v1.0/contact/restrictions/settings
HTTP MethodPUT
Supported app typeappType-Internal app
Required permissionpermission-Contact.Visibility.ReadWrite-Permission to manage the visibility scope of Contacts data

Request header

NameTypeRequiredDescription
x-acs-dingtalk-access-tokenStringYesThe access credential for calling this API. Obtain it by calling the Get the access token of an internal app API.

Request body

NameTypeRequiredDescription
idLongNoThe setting ID. - Do not pass this parameter when adding a new setting. - To modify an existing setting, specify this parameter. Obtain the ID by calling the Get the list of Contacts visibility restriction settings API.
nameStringNoThe setting name.
descriptionStringNoThe setting description.
subjectUserIdsArray of StringNoThe list of user IDs whose Contacts visibility is restricted. Obtain userid by calling the Get the user ID list of a department API. The total number of elements across subjectUserIds, subjectDeptIds, and subjectTagIds cannot exceed 50.
subjectDeptIdsArray of LongNoThe list of department IDs whose Contacts visibility is restricted. Obtain dept_id by calling the Get the department list API. The total number of elements across subjectUserIds, subjectDeptIds, and subjectTagIds cannot exceed 50.
subjectTagIdsArray of LongNoThe list of role IDs whose Contacts visibility is restricted. Obtain the role IDs by calling the Get the role list API. The total number of elements across subjectUserIds, subjectDeptIds, and subjectTagIds cannot exceed 50.
typeStringYesThe restriction type. Valid values: - onlySelf: Can view self only. Cannot view any other departments or users. - onlySelfDeptAndChild: Can view only the user’s own department and its sub-departments. Cannot view any other departments or users. - excludeNode: Default value. Can view only the departments and users in the allowlist. The allowlist takes effect only when this parameter is set to excludeNode.
excludeUserIdsArray of StringNoThe user IDs in the allowlist. Obtain userid by calling the Get the user ID list of a department API. - The total number of elements across excludeUserIds, excludeDeptIds, and excludeTagIds cannot exceed 50. - The allowlist takes effect only when type is set to excludeNode.
excludeDeptIdsArray of LongNoThe department IDs in the allowlist. Obtain them by calling the Get the department list API. - The total number of elements across excludeUserIds, excludeDeptIds, and excludeTagIds cannot exceed 50. - The allowlist takes effect only when type is set to excludeNode.
excludeTagIdsArray of LongNoThe role IDs in the allowlist. Obtain them by calling the Get the role list API. - The total number of elements across excludeUserIds, excludeDeptIds, and excludeTagIds cannot exceed 50. - The allowlist takes effect only when type is set to excludeNode.
activeBooleanNoWhether this setting takes effect. - true: Takes effect. - false: Does not take effect.
restrictInUserProfileBooleanNoWhether to also restrict visibility on the Profile page. - true: Yes. - false: No. When enabled, tapping the Profile Photo of an employee outside the visible scope in the DingTalk Client does not display the user’s profile information within the current organization.
restrictInSearchBooleanNoWhether to also restrict search. - true: Yes. - false: No. When enabled, searching for an employee outside the visible scope in the DingTalk Client returns no results.

Request example

HTTP
PUT /v1.0/contact/restrictions/settings HTTP/1.1
Host:api.dingtalk.io
x-acs-dingtalk-access-token:xxxxx
Content-Type:application/json

{
  "id" : 10001,
  "name" : "Members of department xxx can view self only",
  "description" : "Members of department xxx are restricted from viewing other departments",
  "subjectUserIds" : [ "userId1" ],
  "subjectDeptIds" : [ 10000 ],
  "subjectTagIds" : [ 20000 ],
  "type" : "excludeNode",
  "excludeUserIds" : [ "userId2" ],
  "excludeDeptIds" : [ 10000 ],
  "excludeTagIds" : [ 20000 ],
  "active" : true,
  "restrictInUserProfile" : true,
  "restrictInSearch" : true
}
Java
// This file is auto-generated, don't edit it. Thanks.
package com.aliyun.sample;

import com.aliyun.tea.*;

public class Sample {

    /**
     * Initialize the account Client using a Token
     * @return Client
     * @throws Exception
     */
    public static com.aliyun.dingtalkcontact_1_0.Client createClient() throws Exception {
        com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config();
        config.protocol = "https";
        config.regionId = "central";
        return new com.aliyun.dingtalkcontact_1_0.Client(config);
    }

    public static void main(String[] args_) throws Exception {
        java.util.List<String> args = java.util.Arrays.asList(args_);
        com.aliyun.dingtalkcontact_1_0.Client client = Sample.createClient();
        com.aliyun.dingtalkcontact_1_0.models.UpdateContactRestrictSettingHeaders updateContactRestrictSettingHeaders = new com.aliyun.dingtalkcontact_1_0.models.UpdateContactRestrictSettingHeaders();
        updateContactRestrictSettingHeaders.xAcsDingtalkAccessToken = "<your access token>";
        com.aliyun.dingtalkcontact_1_0.models.UpdateContactRestrictSettingRequest updateContactRestrictSettingRequest = new com.aliyun.dingtalkcontact_1_0.models.UpdateContactRestrictSettingRequest()
                .setId(10001L)
                .setName("Members of department xxx can view self only")
                .setDescription("Members of department xxx are restricted from viewing other departments")
                .setSubjectUserIds(java.util.Arrays.asList(
                    "userId1"
                ))
                .setSubjectDeptIds(java.util.Arrays.asList(
                    10000L
                ))
                .setSubjectTagIds(java.util.Arrays.asList(
                    20000L
                ))
                .setType("excludeNode")
                .setExcludeUserIds(java.util.Arrays.asList(
                    "userId2"
                ))
                .setExcludeDeptIds(java.util.Arrays.asList(
                    10000L
                ))
                .setExcludeTagIds(java.util.Arrays.asList(
                    20000L
                ))
                .setActive(true)
                .setRestrictInUserProfile(true)
                .setRestrictInSearch(true);
        try {
            client.updateContactRestrictSettingWithOptions(updateContactRestrictSettingRequest, updateContactRestrictSettingHeaders, new com.aliyun.teautil.models.RuntimeOptions());
        } catch (TeaException err) {
            if (!com.aliyun.teautil.Common.empty(err.code) && !com.aliyun.teautil.Common.empty(err.message)) {
                // err contains the code and message attributes, which help locate the issue during development.
            }

        } catch (Exception _err) {
            TeaException err = new TeaException(_err.getMessage(), _err);
            if (!com.aliyun.teautil.Common.empty(err.code) && !com.aliyun.teautil.Common.empty(err.message)) {
                // err contains the code and message attributes, which help locate the issue during development.
            }

        }        
    }
}
Python
# -*- coding: utf-8 -*-
# This file is auto-generated, don't edit it. Thanks.
import sys

from typing import List

from alibabacloud_dingtalk.contact_1_0.client import Client as dingtalkcontact_1_0Client
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_dingtalk.contact_1_0 import models as dingtalkcontact__1__0_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_tea_util.client import Client as UtilClient

class Sample:
    def __init__(self):
        pass

    @staticmethod
    def create_client() -> dingtalkcontact_1_0Client:
        """
        Initialize the account Client using a Token
        @return: Client
        @throws Exception
        """
        config = open_api_models.Config()
        config.protocol = 'https'
        config.region_id = 'central'
        return dingtalkcontact_1_0Client(config)

    @staticmethod
    def main(
        args: List[str],
    ) -> None:
        client = Sample.create_client()
        update_contact_restrict_setting_headers = dingtalkcontact__1__0_models.UpdateContactRestrictSettingHeaders()
        update_contact_restrict_setting_headers.x_acs_dingtalk_access_token = '<your access token>'
        update_contact_restrict_setting_request = dingtalkcontact__1__0_models.UpdateContactRestrictSettingRequest(
            id=10001,
            name='Members of department xxx can view self only',
            description='Members of department xxx are restricted from viewing other departments',
            subject_user_ids=[
                'userId1'
            ],
            subject_dept_ids=[
                10000
            ],
            subject_tag_ids=[
                20000
            ],
            type='excludeNode',
            exclude_user_ids=[
                'userId2'
            ],
            exclude_dept_ids=[
                10000
            ],
            exclude_tag_ids=[
                20000
            ],
            active=True,
            restrict_in_user_profile=True,
            restrict_in_search=True
        )
        try:
            client.update_contact_restrict_setting_with_options(update_contact_restrict_setting_request, update_contact_restrict_setting_headers, util_models.RuntimeOptions())
        except Exception as err:
            if not UtilClient.empty(err.code) and not UtilClient.empty(err.message):
                # err contains the code and message attributes, which help locate the issue during development.
                pass

    @staticmethod
    async def main_async(
        args: List[str],
    ) -> None:
        client = Sample.create_client()
        update_contact_restrict_setting_headers = dingtalkcontact__1__0_models.UpdateContactRestrictSettingHeaders()
        update_contact_restrict_setting_headers.x_acs_dingtalk_access_token = '<your access token>'
        update_contact_restrict_setting_request = dingtalkcontact__1__0_models.UpdateContactRestrictSettingRequest(
            id=10001,
            name='Members of department xxx can view self only',
            description='Members of department xxx are restricted from viewing other departments',
            subject_user_ids=[
                'userId1'
            ],
            subject_dept_ids=[
                10000
            ],
            subject_tag_ids=[
                20000
            ],
            type='excludeNode',
            exclude_user_ids=[
                'userId2'
            ],
            exclude_dept_ids=[
                10000
            ],
            exclude_tag_ids=[
                20000
            ],
            active=True,
            restrict_in_user_profile=True,
            restrict_in_search=True
        )
        try:
            await client.update_contact_restrict_setting_with_options_async(update_contact_restrict_setting_request, update_contact_restrict_setting_headers, util_models.RuntimeOptions())
        except Exception as err:
            if not UtilClient.empty(err.code) and not UtilClient.empty(err.message):
                # err contains the code and message attributes, which help locate the issue during development.
                pass

if __name__ == '__main__':
    Sample.main(sys.argv[1:])
PHP
<?php

// This file is auto-generated, don't edit it. Thanks.
namespace AlibabaCloud\SDK\Sample;

use AlibabaCloud\SDK\Dingtalk\Vcontact_1_0\Dingtalk;
use \Exception;
use AlibabaCloud\Tea\Exception\TeaError;
use AlibabaCloud\Tea\Utils\Utils;

use Darabonba\OpenApi\Models\Config;
use AlibabaCloud\SDK\Dingtalk\Vcontact_1_0\Models\UpdateContactRestrictSettingHeaders;
use AlibabaCloud\SDK\Dingtalk\Vcontact_1_0\Models\UpdateContactRestrictSettingRequest;
use AlibabaCloud\Tea\Utils\Utils\RuntimeOptions;

class Sample {

    /**
     * Initialize the account Client using a Token
     * @return Dingtalk Client
     */
    public static function createClient(){
        $config = new Config([]);
        $config->protocol = "https";
        $config->regionId = "central";
        return new Dingtalk($config);
    }

    /**
     * @param string[] $args
     * @return void
     */
    public static function main($args){
        $client = self::createClient();
        $updateContactRestrictSettingHeaders = new UpdateContactRestrictSettingHeaders([]);
        $updateContactRestrictSettingHeaders->xAcsDingtalkAccessToken = "<your access token>";
        $updateContactRestrictSettingRequest = new UpdateContactRestrictSettingRequest([
            "id" => 10001,
            "name" => "Members of department xxx can view self only",
            "description" => "Members of department xxx are restricted from viewing other departments",
            "subjectUserIds" => [
                "userId1"
            ],
            "subjectDeptIds" => [
                10000
            ],
            "subjectTagIds" => [
                20000
            ],
            "type" => "excludeNode",
            "excludeUserIds" => [
                "userId2"
            ],
            "excludeDeptIds" => [
                10000
            ],
            "excludeTagIds" => [
                20000
            ],
            "active" => true,
            "restrictInUserProfile" => true,
            "restrictInSearch" => true
        ]);
        try {
            $client->updateContactRestrictSettingWithOptions($updateContactRestrictSettingRequest, $updateContactRestrictSettingHeaders, new RuntimeOptions([]));
        }
        catch (Exception $err) {
            if (!($err instanceof TeaError)) {
                $err = new TeaError([], $err->getMessage(), $err->getCode(), $err);
            }
            if (!Utils::empty_($err->code) && !Utils::empty_($err->message)) {
                // err contains the code and message attributes, which help locate the issue during development.
            }
        }
    }
}
$path = __DIR__ . \DIRECTORY_SEPARATOR . '..' . \DIRECTORY_SEPARATOR . 'vendor' . \DIRECTORY_SEPARATOR . 'autoload.php';
if (file_exists($path)) {
    require_once $path;
}
Sample::main(array_slice($argv, 1));
Go
// This file is auto-generated, don't edit it. Thanks.
package main

import (
  "os"
  util  "github.com/alibabacloud-go/tea-utils/v2/service"
  dingtalkcontact_1_0  "github.com/alibabacloud-go/dingtalk/contact_1_0"
  openapi  "github.com/alibabacloud-go/darabonba-openapi/v2/client"
  "github.com/alibabacloud-go/tea/tea"
)

/**
 * Initialize the account Client using a Token
 * @return Client
 * @throws Exception
 */
func CreateClient () (_result *dingtalkcontact_1_0.Client, _err error) {
  config := &openapi.Config{}
  config.Protocol = tea.String("https")
  config.RegionId = tea.String("central")
  _result = &dingtalkcontact_1_0.Client{}
  _result, _err = dingtalkcontact_1_0.NewClient(config)
  return _result, _err
}

func _main (args []*string) (_err error) {
  client, _err := CreateClient()
  if _err != nil {
    return _err
  }

  updateContactRestrictSettingHeaders := &dingtalkcontact_1_0.UpdateContactRestrictSettingHeaders{}
  updateContactRestrictSettingHeaders.XAcsDingtalkAccessToken = tea.String("<your access token>")
  updateContactRestrictSettingRequest := &dingtalkcontact_1_0.UpdateContactRestrictSettingRequest{
    Id: tea.Int64(10001),
    Name: tea.String("Members of department xxx can view self only"),
    Description: tea.String("Members of department xxx are restricted from viewing other departments"),
    SubjectUserIds: []*string{tea.String("userId1")},
    SubjectDeptIds: []*int64{tea.Int64(10000)},
    SubjectTagIds: []*int64{tea.Int64(20000)},
    Type: tea.String("excludeNode"),
    ExcludeUserIds: []*string{tea.String("userId2")},
    ExcludeDeptIds: []*int64{tea.Int64(10000)},
    ExcludeTagIds: []*int64{tea.Int64(20000)},
    Active: tea.Bool(true),
    RestrictInUserProfile: tea.Bool(true),
    RestrictInSearch: tea.Bool(true),
  }
  tryErr := func()(_e error) {
    defer func() {
      if r := tea.Recover(recover()); r != nil {
        _e = r
      }
    }()
    _, _err = client.UpdateContactRestrictSettingWithOptions(updateContactRestrictSettingRequest, updateContactRestrictSettingHeaders, &util.RuntimeOptions{})
    if _err != nil {
      return _err
    }

    return nil
  }()

  if tryErr != nil {
    var err = &tea.SDKError{}
    if _t, ok := tryErr.(*tea.SDKError); ok {
      err = _t
    } else {
      err.Message = tea.String(tryErr.Error())
    }
    if !tea.BoolValue(util.Empty(err.Code)) && !tea.BoolValue(util.Empty(err.Message)) {
      // err contains the code and message attributes, which help locate the issue during development.
    }

  }
  return _err
}

func main() {
  err := _main(tea.StringSlice(os.Args[1:]))
  if err != nil {
    panic(err)
  }
}
Node.js
// This file is auto-generated, don't edit it
import Util, * as $Util from '@alicloud/tea-util';
import dingtalkcontact_1_0, * as $dingtalkcontact_1_0 from '@alicloud/dingtalk/contact_1_0';
import OpenApi, * as $OpenApi from '@alicloud/openapi-client';
import * as $tea from '@alicloud/tea-typescript';

export default class Client {

  /**
   * Initialize the account Client using a Token
   * @return Client
   * @throws Exception
   */
  static createClient(): dingtalkcontact_1_0 {
    let config = new $OpenApi.Config({ });
    config.protocol = "https";
    config.regionId = "central";
    return new dingtalkcontact_1_0(config);
  }

  static async main(args: string[]): Promise<void> {
    let client = Client.createClient();
    let updateContactRestrictSettingHeaders = new $dingtalkcontact_1_0.UpdateContactRestrictSettingHeaders({ });
    updateContactRestrictSettingHeaders.xAcsDingtalkAccessToken = "<your access token>";
    let updateContactRestrictSettingRequest = new $dingtalkcontact_1_0.UpdateContactRestrictSettingRequest({
      id: 10001,
      name: "Members of department xxx can view self only",
      description: "Members of department xxx are restricted from viewing other departments",
      subjectUserIds: [
        "userId1"
      ],
      subjectDeptIds: [
        10000
      ],
      subjectTagIds: [
        20000
      ],
      type: "excludeNode",
      excludeUserIds: [
        "userId2"
      ],
      excludeDeptIds: [
        10000
      ],
      excludeTagIds: [
        20000
      ],
      active: true,
      restrictInUserProfile: true,
      restrictInSearch: true,
    });
    try {
      await client.updateContactRestrictSettingWithOptions(updateContactRestrictSettingRequest, updateContactRestrictSettingHeaders, new $Util.RuntimeOptions({ }));
    } catch (err) {
      if (!Util.empty(err.code) && !Util.empty(err.message)) {
        // err contains the code and message attributes, which help locate the issue during development.
      }

    }    
  }

}

Client.main(process.argv.slice(2));
C#
// This file is auto-generated, don't edit it. Thanks.

using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Threading.Tasks;

using Tea;
using Tea.Utils;

namespace AlibabaCloud.SDK.Sample
{
    public class Sample 
    {

        /**
         * Initialize the account Client using a Token
         * @return Client
         * @throws Exception
         */
        public static AlibabaCloud.SDK.Dingtalkcontact_1_0.Client CreateClient()
        {
            AlibabaCloud.OpenApiClient.Models.Config config = new AlibabaCloud.OpenApiClient.Models.Config();
            config.Protocol = "https";
            config.RegionId = "central";
            return new AlibabaCloud.SDK.Dingtalkcontact_1_0.Client(config);
        }

        public static void Main(string[] args)
        {
            AlibabaCloud.SDK.Dingtalkcontact_1_0.Client client = CreateClient();
            AlibabaCloud.SDK.Dingtalkcontact_1_0.Models.UpdateContactRestrictSettingHeaders updateContactRestrictSettingHeaders = new AlibabaCloud.SDK.Dingtalkcontact_1_0.Models.UpdateContactRestrictSettingHeaders();
            updateContactRestrictSettingHeaders.XAcsDingtalkAccessToken = "<your access token>";
            AlibabaCloud.SDK.Dingtalkcontact_1_0.Models.UpdateContactRestrictSettingRequest updateContactRestrictSettingRequest = new AlibabaCloud.SDK.Dingtalkcontact_1_0.Models.UpdateContactRestrictSettingRequest
            {
                Id = 10001,
                Name = "Members of department xxx can view self only",
                Description = "Members of department xxx are restricted from viewing other departments",
                SubjectUserIds = new List<string>
                {
                    "userId1"
                },
                SubjectDeptIds = new List<long?>
                {
                    10000
                },
                SubjectTagIds = new List<long?>
                {
                    20000
                },
                Type = "excludeNode",
                ExcludeUserIds = new List<string>
                {
                    "userId2"
                },
                ExcludeDeptIds = new List<long?>
                {
                    10000
                },
                ExcludeTagIds = new List<long?>
                {
                    20000
                },
                Active = true,
                RestrictInUserProfile = true,
                RestrictInSearch = true,
            };
            try
            {
                client.UpdateContactRestrictSettingWithOptions(updateContactRestrictSettingRequest, updateContactRestrictSettingHeaders, new AlibabaCloud.TeaUtil.Models.RuntimeOptions());
            }
            catch (TeaException err)
            {
                if (!AlibabaCloud.TeaUtil.Common.Empty(err.Code) && !AlibabaCloud.TeaUtil.Common.Empty(err.Message))
                {
                    // err contains the code and message attributes, which help locate the issue during development.
                }
            }
            catch (Exception _err)
            {
                TeaException err = new TeaException(new Dictionary<string, object>
                {
                    { "message", _err.Message }
                });
                if (!AlibabaCloud.TeaUtil.Common.Empty(err.Code) && !AlibabaCloud.TeaUtil.Common.Empty(err.Message))
                {
                    // err contains the code and message attributes, which help locate the issue during development.
                }
            }
        }

    }
}

Response

Response body

NameTypeDescription
resultLongThe restriction setting ID.

Response body example

HTTP/1.1 200 OK
Content-Type:application/json

{
  "result" : 10001
}

Error codes

If an error is returned when calling this API, look up the solution in the Global error codes documentation based on the error message.
HttpCodeError codeError messageDescription
400userIdInvalidThe userId does not exist.The userId does not exist.
400excludeNodeExceedThe total number of elements across the excludeUserIds, excludeDeptIds, and excludeTagIds arrays cannot exceed 50.The total number of elements across the excludeUserIds, excludeDeptIds, and excludeTagIds arrays cannot exceed 50.
400subjectNodeExceedThe total number of elements across the subjectUserIds, subjectDeptIds, and subjectTagIds arrays cannot exceed 50.The total number of elements across the subjectUserIds, subjectDeptIds, and subjectTagIds arrays cannot exceed 50.
400typeInvalidThe type must be one of excludeNode, onlySelf, or onlySelfDeptAndChild.The type must be one of excludeNode, onlySelf, or onlySelfDeptAndChild.
400subjectNodeEmptysubjectUserIds, subjectDeptIds, and subjectTagIds cannot all be empty.subjectUserIds, subjectDeptIds, and subjectTagIds cannot all be empty.
400idInvalidThe setting corresponding to the id does not exist.The setting corresponding to the id does not exist.
500system.errorSystem error.System error.