> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arc.cdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# arc:restrict

> Use arc:restrict to restrict access to a service based on specified users and roles, taking precedence over ASP.NET restrictions.

export const siteNameShort = "Arc";

Use the `arc:restrict` keyword to restrict access to a service based on users and roles. This restriction takes precedence over any restrictions that you enforce using ASP.NET.

If you add `arc:restrict` to your script, only the specified users or roles can use the service.

The `arc:restrict` keyword can control access based on the following:

* The specific user trying to execute the feed.
* Whether the user is a member of a specified security role, where a role maps to the roles defined by the ASP.NET authentication and authorization configuration.

<Note>You can have multiple `arc:restrict` statements in a single script. They are evaluated with the logical `OR` operator.</Note>

## Parameters

* **user**: A comma-separated list of usernames. All users in the list have access to the feed.
  <Note>If you have Windows Integrated Authentication, you must ensure that usernames are domain- or machine-qualified (for example, `DOMAIN\username`).</Note>
* **role**: A comma-separated list of role names. Any user in at least one of the specified roles has access to the feed.
* **authtoken**: A comma-separated list of authtokens for users authorized to access the script. You can supply the authtoken in HTTP Basic authentication, the x-`arc`esb-authtoken header, or the @authtoken in the form-post data. If AllowtokeninURL is set in settings.json, located in the app\_data folder, you can also supply @authtoken in the query string.
* **visibility**: Setting the visibility to `local` makes the script inaccessible directly from HTTP. However, you can still invoke the script through another script.
* **method**: A comma-separated list of HTTP methods that the specified user can execute against the feed.

## Control Attributes

None

## Examples

Grant access only to the `tomk` and `jdoe` users:

```xml theme={null}
<arc:restrict user="newton\jdoe,newton\tomk"/>
```

Grant access only to a user in the `FeedConsumers` role:

```xml theme={null}
<arc:restrict role="FeedConsumers"/>
```

## See Also

* [arc:call](./op-arc-call): Call scripts, operations, or feeds.