Version: 2026.10

Secure Connections

Create and manage Secure Connections, share Resources over them, and govern who may send and receive.

Method	Description
`create_receiving_remote()`	Create a receiving remote connection.
`create_sending_remote()`	Create a sending remote connection.
`get_receiving_remote()`	Retrieve a receiving remote by ID.
`get_sending_remote()`	Retrieve a sending remote by ID.
`list_receiving_remotes()`	List receiving remote connections.
`list_sending_remotes()`	List sending remote connections.
`update_receiving_remote()`	Update a receiving remote connection.
`update_sending_remote()`	Update a sending remote connection.
`list_shareable_sending_connections()`	List the Secure Connections a resource may be shared to.
`share_file_to_sending_remote()`	Share a resource with a partner over a Secure Connection.
`revoke_file_from_sending_remote()`	Stop sharing a resource over a Secure Connection.
`list_sending_remote_shares_for_resource()`	List the Secure Connections a resource is shared to.
`favorite_connection()`	Star a Secure Connection.
`unfavorite_connection()`	Remove the star from a Secure Connection.
`get_receiving_connection_owners()`	List the owners of a receiving connection.
`set_receiving_connection_owners()`	Replace the owners of a receiving connection.
`get_sending_connection_permitted_senders()`	List who may send over a sending connection.
`set_sending_connection_permitted_senders()`	Replace who may send over a sending connection.
`get_receiving_connection_infosec_levels()`	Incoming infosec levels seen on a receiving connection.
`get_receiving_connection_infosec_level_mappings()`	How incoming infosec levels map to local ones.
`set_receiving_connection_infosec_level_mappings()`	Replace the infosec level mappings.
`get_receiving_connection_control_tags()`	Control tags seen on a receiving connection.
`list_receiving_remote_sync_statuses()`	Sync status of Resources received over a connection.
`list_sending_remote_sync_statuses()`	Sync status of Resources sent over a connection.
`list_resource_sync_status_by_connection()`	One Resource's latest sync status on each connection.
`evaluate_sending_remote_tag_sets()`	Preview what a sending connection's tag rules do.
`validate_receiving_remote_manifest_catalog()`	Check a manifest's control tags against a receiving connection.
`list_object_stores()`	List object stores.

Remote Connections

create_receiving_remote

V3Client.create_receiving_remote(
    receiving_connection_create_dto,
) -> ReceivingConnectionDto

Create a receiving remote connection to accept resources pushed from another registry.

Parameters

Name	Type	Description
`receiving_connection_create_dto`	`ReceivingConnectionCreateDto`	DTO describing the new receiving connection.

Returns: ReceivingConnectionDto — the created receiving remote.

Basic
Full example

from istari_digital_client.v3.models.receiving_connection_create_dto import ReceivingConnectionCreateDto

remote = client.create_receiving_remote(
    receiving_connection_create_dto=ReceivingConnectionCreateDto(
        label="upstream-registry",
        description="Accept resources from the partner",
        shared_id="upstream-registry",
        shared_secret="shared-secret",
        object_store_id="<object_store_id>",
    ),
)
print(remote.id)

from istari_digital_client.v3.models.receiving_connection_create_dto import ReceivingConnectionCreateDto

remote = client.create_receiving_remote(
    receiving_connection_create_dto=ReceivingConnectionCreateDto(
        label="partner-registry",
        description="Accept resources from the partner",
        shared_id="partner-registry",
        shared_secret="shared-secret",
        object_store_id="<object_store_id>",
    ),
)
retrieved = client.get_receiving_remote(remote.id)
print(retrieved.label)

create_sending_remote

V3Client.create_sending_remote(
    sending_connection_create_dto,
) -> SendingConnectionDto

Create a sending remote connection to push resources to another registry.

SendingConnectionCreateDto.allow_reshare defaults to False. Set it to True to let the receiving organization share files that arrived over this connection onward over its own sending connections. False keeps those files on the receiving instance.

Parameters

Name	Type	Description
`sending_connection_create_dto`	`SendingConnectionCreateDto`	DTO describing the new sending connection. `allow_reshare` (`bool`, default `False`) controls whether the receiver may share files onward.

Returns: SendingConnectionDto — the created sending remote, including allow_reshare.

Basic
Full example

from istari_digital_client.v3.models.sending_connection_create_dto import SendingConnectionCreateDto

remote = client.create_sending_remote(
    sending_connection_create_dto=SendingConnectionCreateDto(
        label="downstream-registry",
        description="Send resources to the partner",
        shared_id="downstream-registry",
        shared_secret="shared-secret",
        object_store_id="<object_store_id>",
    ),
)
print(remote.id)

from istari_digital_client.v3.models.sending_connection_create_dto import SendingConnectionCreateDto

remote = client.create_sending_remote(
    sending_connection_create_dto=SendingConnectionCreateDto(
        label="partner-registry",
        description="Send resources to the partner",
        shared_id="partner-registry",
        shared_secret="shared-secret",
        object_store_id="<object_store_id>",
        allow_reshare=True,
    ),
)
remotes = client.list_sending_remotes()
print(f"{len(remotes.items)} sending remote(s) configured")

get_receiving_remote

V3Client.get_receiving_remote(
    remote_id,
) -> ReceivingConnectionDto

Retrieve a receiving remote connection by ID.

ReceivingConnectionDto.allow_reshare is read-only. The value is the sender's setting, learned when the connection syncs.

Parameters

Name	Type	Description
`remote_id`	`str`	The ID of the receiving remote to get.

Returns: ReceivingConnectionDto — the receiving remote, including allow_reshare.

Basic
Full example

remote = client.get_receiving_remote("remote-id-here")
print(remote.label)

from istari_digital_client.v3.models.update_receiving_connection_dto import UpdateReceivingConnectionDto

remote = client.get_receiving_remote("remote-id-here")
updated = client.update_receiving_remote(
    remote_id=remote.id,
    update_receiving_connection_dto=UpdateReceivingConnectionDto(label="renamed"),
)

get_sending_remote

V3Client.get_sending_remote(
    remote_id,
) -> SendingConnectionDto

Retrieve a sending remote connection by ID.

Parameters

Name	Type	Description
`remote_id`	`str`	The ID of the sending remote to get.

Returns: SendingConnectionDto — the sending remote.

Basic
Full example

remote = client.get_sending_remote("remote-id-here")
print(remote.label)

from istari_digital_client.v3.models.update_sending_connection_dto import UpdateSendingConnectionDto

remote = client.get_sending_remote("remote-id-here")
updated = client.update_sending_remote(
    remote_id=remote.id,
    update_sending_connection_dto=UpdateSendingConnectionDto(label="renamed"),
)

list_receiving_remotes

V3Client.list_receiving_remotes(
    *,
    cursor=None,
    size=None,
    include_total=None,
    show_archived=None,
) -> CursorPageReceivingConnectionDto

List receiving remote connections. Each item's allow_reshare is read-only and is the sender's setting, learned when the connection syncs.

Optional parameters

Name	Type	Default	Description
`cursor`	`str \| None`	`None`	Pagination cursor.
`size`	`int \| None`	`None`	Page size (0–100).
`include_total`	`bool \| None`	`None`	Include total count.
`show_archived`	`bool \| None`	`None`	Include archived remotes when `True`.

Returns: CursorPageReceivingConnectionDto — paginated list. Each item includes allow_reshare.

Basic
Full example

page = client.list_receiving_remotes()
for r in page.items:
    print(r.id, r.label)

page = client.list_receiving_remotes(include_total=True, show_archived=True)
print(f"{page.total} receiving remote(s) (including archived)")

list_sending_remotes

V3Client.list_sending_remotes(
    *,
    cursor=None,
    size=None,
    include_total=None,
    show_archived=None,
) -> CursorPageSendingConnectionDto

List sending remote connections.

Optional parameters

Name	Type	Default	Description
`cursor`	`str \| None`	`None`	Pagination cursor.
`size`	`int \| None`	`None`	Page size (0–100).
`include_total`	`bool \| None`	`None`	Include total count.
`show_archived`	`bool \| None`	`None`	Include archived remotes when `True`.

Returns: CursorPageSendingConnectionDto — paginated list.

Basic
Full example

page = client.list_sending_remotes()
for r in page.items:
    print(r.id, r.label)

page = client.list_sending_remotes(include_total=True)
print(f"{page.total} sending remote(s) configured")

update_receiving_remote

V3Client.update_receiving_remote(
    remote_id,
    update_receiving_connection_dto,
) -> ReceivingConnectionDto

Update a receiving remote connection.

Parameters

Name	Type	Description
`remote_id`	`str`	The ID of the receiving remote to update.
`update_receiving_connection_dto`	`UpdateReceivingConnectionDto`	DTO containing the fields to update.

Returns: ReceivingConnectionDto — the updated receiving remote.

Basic
Full example

from istari_digital_client.v3.models.update_receiving_connection_dto import UpdateReceivingConnectionDto

updated = client.update_receiving_remote(
    remote_id="remote-id-here",
    update_receiving_connection_dto=UpdateReceivingConnectionDto(label="new-name"),
)

from istari_digital_client.v3.models.update_receiving_connection_dto import UpdateReceivingConnectionDto

remote = client.get_receiving_remote("remote-id-here")
updated = client.update_receiving_remote(
    remote_id=remote.id,
    update_receiving_connection_dto=UpdateReceivingConnectionDto(label="renamed-remote"),
)
print(updated.label)

update_sending_remote

V3Client.update_sending_remote(
    remote_id,
    update_sending_connection_dto,
) -> SendingConnectionDto

Update a sending remote connection.

UpdateSendingConnectionDto.allow_reshare changes whether the receiving organization may share files that arrived over this connection onward over its own sending connections.

Parameters

Name	Type	Description
`remote_id`	`str`	The ID of the sending remote to update.
`update_sending_connection_dto`	`UpdateSendingConnectionDto`	DTO containing the fields to update. `allow_reshare` (`bool`, optional) sets whether the receiver may share onward.

Returns: SendingConnectionDto — the updated sending remote, including allow_reshare.

Basic
Full example

from istari_digital_client.v3.models.update_sending_connection_dto import UpdateSendingConnectionDto

updated = client.update_sending_remote(
    remote_id="remote-id-here",
    update_sending_connection_dto=UpdateSendingConnectionDto(label="new-name"),
)

from istari_digital_client.v3.models.update_sending_connection_dto import UpdateSendingConnectionDto

remote = client.get_sending_remote("remote-id-here")
updated = client.update_sending_remote(
    remote_id=remote.id,
    update_sending_connection_dto=UpdateSendingConnectionDto(
        label="renamed-remote",
        allow_reshare=True,
    ),
)
print(updated.label, updated.allow_reshare)

Share individual resources with a partner organization over a Sending Connection (Secure Connection) that an administrator has already configured. These methods are the SDK counterpart of the Share with external connection dialog described in Secure Connections.

The same rules apply as in the web app:

Only models and artifacts are synced to the partner. Systems cannot be shared as a whole. The share and list calls accept the file of any resource type and do not reject a standalone file, so check resource_type yourself rather than relying on an error.
The caller needs Editor access or above on the resource. Any authenticated user may list shareable connections.
The connection must exist and be active. Creating connections is an administrator task — see Set up Secure Connections.
The connection's Permitted Infosec Level and Tag Rules still apply. A share that violates them is rejected or automatically revoked.
If the connection restricts Permitted Senders, you must be on its list, and your per-user level (View or Edit) caps the share_level you may request in addition to the connection's ceiling. There is no non-admin call to read your own level; a share above it fails with 403. See Permitted Senders.
Sync is asynchronous. A share call returns as soon as the share is recorded; the partner receives the file on the next sync cycle (typically 1–2 minutes).
List calls are paginated. Each page exposes the cursor for the next page as next_page; pass it back as cursor until it is None.

Share methods take the resource's file_id (the storage-level identifier on ResourceDto), not its resource_id. list_sending_remote_shares_for_resource() takes the resource_id and resolves the file for you.

list_shareable_sending_connections

V3Client.list_shareable_sending_connections(
    *,
    cursor=None,
    size=None,
    include_total=None,
) -> CursorPageShareableSendingConnectionDto

List the active Sending Connections a resource may be shared to. Unlike list_sending_remotes(), this is available to non-administrators and returns a slim projection without connection configuration. Secure Connections are not tenant-scoped, so the list is instance-wide.

Optional parameters

Name	Type	Default	Description
`cursor`	`str \| None`	`None`	`next_page` from the previous page.
`size`	`int \| None`	`None`	Page size (0–100).
`include_total`	`bool \| None`	`None`	Include total count.

Returns: CursorPageShareableSendingConnectionDto — paginated list. Each item carries id, label, description, and received_access_level, the ceiling for the share_level you may request on that connection.

Basic
Full example

page = client.list_shareable_sending_connections()
for conn in page.items:
    print(conn.id, conn.label, conn.received_access_level)

from istari_digital_client.v3.models.received_access_level import ReceivedAccessLevel

# Find the connections that allow Edit access on the partner side, across all pages
editable = []
cursor = None
while True:
    page = client.list_shareable_sending_connections(size=100, cursor=cursor)
    editable.extend(
        conn for conn in page.items
        if conn.received_access_level == ReceivedAccessLevel.EDITOR
    )
    cursor = page.next_page
    if not cursor:
        break
for conn in editable:
    print(f"{conn.label}: {conn.description}")

share_file_to_sending_remote

V3Client.share_file_to_sending_remote(
    remote_id,
    file_id,
    share_file_to_sending_remote_dto=None,
) -> RemoteFileShareDto

Share a resource's file with the partner behind a Sending Connection. If the file was previously shared and then revoked, the share is restored. Calling it again on an active share updates the share_level in place.

Parameters

Name	Type	Description
`remote_id`	`str`	The ID of the Sending Connection to share to.
`file_id`	`str`	The `file_id` of the resource to share.
`share_file_to_sending_remote_dto`	`ShareFileToSendingRemoteDto \| None`	Optional body. `share_level` is `ReceivedAccessLevel.VIEWER` (default) or `ReceivedAccessLevel.EDITOR`.

share_level controls what the partner can do with their copy. Viewer is read-only; Editor lets the receiving organization run jobs on the resource and add revisions to their copy. You cannot request Editor on a connection whose received_access_level is Viewer, or when the administrator has listed you as a View-level permitted sender on that connection.

Returns: RemoteFileShareDto — the share record, with id, sending_connection_id, sending_connection_label, file_id, share_level, created, is_archived, and archived.

Basic
Full example

resource = client.get_resource("resource-id-here")

share = client.share_file_to_sending_remote(
    remote_id="sending-connection-id-here",
    file_id=resource.file_id,
)
print(share.share_level)  # Viewer

from istari_digital_client.v3.models.received_access_level import ReceivedAccessLevel
from istari_digital_client.v3.models.share_file_to_sending_remote_dto import ShareFileToSendingRemoteDto

resource = client.get_resource("resource-id-here")

# Pick the connection by label and check its ceiling before asking for Editor
conn = next(
    c for c in client.list_shareable_sending_connections(size=100).items
    if c.label == "partner-registry"
)
if conn.received_access_level != ReceivedAccessLevel.EDITOR:
    raise RuntimeError(f"{conn.label} only permits view access")

share = client.share_file_to_sending_remote(
    remote_id=conn.id,
    file_id=resource.file_id,
    share_file_to_sending_remote_dto=ShareFileToSendingRemoteDto(
        share_level=ReceivedAccessLevel.EDITOR,
    ),
)
print(f"Shared to {share.sending_connection_label} at {share.share_level}")

revoke_file_from_sending_remote

V3Client.revoke_file_from_sending_remote(
    remote_id,
    file_id,
) -> RemoteFileShareDto

Stop sharing a resource's file over a Sending Connection. This stops future synchronization and sends a revocation signal across the connection; the partner's platform tombstones its copy on a later sync cycle. Revocation is best-effort and cannot purge data the partner has already exported. See Revocation and Tombstoned Files.

Parameters

Name	Type	Description
`remote_id`	`str`	The ID of the Sending Connection to revoke from.
`file_id`	`str`	The `file_id` of the resource to stop sharing.

Returns: RemoteFileShareDto — the share record with is_archived=True and archived set.

Basic
Full example

resource = client.get_resource("resource-id-here")

revoked = client.revoke_file_from_sending_remote(
    remote_id="sending-connection-id-here",
    file_id=resource.file_id,
)
print(revoked.is_archived)  # True

# Revoke a resource from every connection it is currently shared to.
# Collect every page first so a later-page share is not missed.
resource = client.get_resource("resource-id-here")

shares = []
cursor = None
while True:
    page = client.list_sending_remote_shares_for_resource(
        resource_id=resource.resource_id,
        size=100,
        cursor=cursor,
    )
    shares.extend(page.items)
    cursor = page.next_page
    if not cursor:
        break

for share in shares:
    client.revoke_file_from_sending_remote(
        remote_id=share.sending_connection_id,
        file_id=share.file_id,
    )
    print(f"Revoked from {share.sending_connection_label}")

list_sending_remote_shares_for_resource

V3Client.list_sending_remote_shares_for_resource(
    resource_id,
    *,
    cursor=None,
    size=None,
    include_total=None,
    show_archived=None,
) -> CursorPageRemoteFileShareDto

List the Sending Connections a resource is shared to. This is the SDK equivalent of the Connections row on the resource's details pane. The resource's underlying file is resolved automatically, so pass the resource_id.

Parameters

Name	Type	Description
`resource_id`	`str`	The `resource_id` of the resource to list shares for.

Optional parameters

Name	Type	Default	Description
`cursor`	`str \| None`	`None`	`next_page` from the previous page.
`size`	`int \| None`	`None`	Page size (0–100).
`include_total`	`bool \| None`	`None`	Include total count.
`show_archived`	`bool \| None`	`None`	Include revoked shares when `True`.

Returns: CursorPageRemoteFileShareDto — paginated list of RemoteFileShareDto. By default only active shares are returned.

Basic
Full example

page = client.list_sending_remote_shares_for_resource(resource_id="resource-id-here")
for share in page.items:
    print(share.sending_connection_label, share.share_level)

# Include revoked shares to see the full sharing history of a resource
page = client.list_sending_remote_shares_for_resource(
    resource_id="resource-id-here",
    show_archived=True,
    include_total=True,
)
print(f"{page.total} share(s), including revoked")
for share in page.items:
    state = "revoked" if share.is_archived else "active"
    print(f"{share.sending_connection_label}: {share.share_level} ({state})")

Secure connection governance

Owners, permitted senders, infosec mappings, sync status, and tag-rule checks for a remote created with the Remote connections methods. remote_id is that connection's id.

Starring a Secure Connection is separate from resource and system favorites.

favorite_connection

V3Client.favorite_connection(connection_id) -> None

unfavorite_connection

V3Client.unfavorite_connection(connection_id) -> None

get_receiving_connection_owners

V3Client.get_receiving_connection_owners(remote_id) -> list[ReceivingConnectionOwnerDto]

set_receiving_connection_owners

Replaces the owner list. An owner without access_level is EDITOR.

V3Client.set_receiving_connection_owners(
    remote_id,
    set_receiving_connection_owners_dto,
) -> list[ReceivingConnectionOwnerDto]

SetReceivingConnectionOwnersDto.owners is the complete list.

get_sending_connection_permitted_senders

V3Client.get_sending_connection_permitted_senders(remote_id) -> list[SendingConnectionPermittedSenderDto]

set_sending_connection_permitted_senders

Replaces the permitted-sender list. A sender without access_level is EDITOR.

V3Client.set_sending_connection_permitted_senders(
    remote_id,
    set_sending_connection_permitted_senders_dto,
) -> list[SendingConnectionPermittedSenderDto]

get_receiving_connection_infosec_levels

Incoming infosec levels observed on a receiving connection.

V3Client.get_receiving_connection_infosec_levels(remote_id) -> list[ReceivingConnectionInfosecLevelDto]

get_receiving_connection_infosec_level_mappings

V3Client.get_receiving_connection_infosec_level_mappings(remote_id) -> list[ReceivingConnectionInfosecLevelMappingDto]

set_receiving_connection_infosec_level_mappings

Replaces the mapping list. An empty list removes every mapping.

V3Client.set_receiving_connection_infosec_level_mappings(
    remote_id,
    set_receiving_connection_infosec_level_mappings_dto,
) -> list[ReceivingConnectionInfosecLevelMappingDto]

get_receiving_connection_control_tags

V3Client.get_receiving_connection_control_tags(remote_id) -> list[ReceivingConnectionControlTagDto]

list_receiving_remote_sync_statuses

V3Client.list_receiving_remote_sync_statuses(
    remote_id,
    only_with_updates=None,
    cursor=None,
    size=None,
    include_total=None,
) -> CursorPageSyncStatusUpdateDtoCustomized

list_sending_remote_sync_statuses

Same parameters and return type as list_receiving_remote_sync_statuses, for a sending remote.

list_resource_sync_status_by_connection

Most recent sync status of one resource on each Secure Connection.

V3Client.list_resource_sync_status_by_connection(resource_id) -> list[ResourceSyncStatusByConnectionDto]

evaluate_sending_remote_tag_sets

Previews what a sending remote's tag rules do to the given control-tag sets. Results come back in request order.

V3Client.evaluate_sending_remote_tag_sets(
    remote_id,
    evaluate_sending_tag_sets_with_hypothetical_rule_set_dto,
) -> list[SendingTagSetEvaluationDto]

tag_sets is a list of tag-id lists (at most 1000 sets, 200 ids each). hypothetical_rule_set is optional.

validate_receiving_remote_manifest_catalog

Checks a manifest's control-tag catalog against a receiving remote. Send the tags the manifest reports as unarchived.

V3Client.validate_receiving_remote_manifest_catalog(
    remote_id,
    validate_manifest_catalog_dto,
) -> ManifestCatalogValidationDto

ValidateManifestCatalogDto.control_tag_ids holds at most 1000 ids.

Object stores

list_object_stores

V3Client.list_object_stores(
    cursor=None,
    size=None,
    include_total=None,
) -> CursorPageObjectStoreDto

size is 0–100 and defaults to 10. Pass the previous response's cursor to continue.

Remote Connections​

create_receiving_remote​

create_sending_remote​

get_receiving_remote​

get_sending_remote​

list_receiving_remotes​

list_sending_remotes​

update_receiving_remote​

update_sending_remote​