Release v6.0.0

This version of the Pinecone Go SDK depends on version 2026-04 of the Pinecone API. You can read more about versioning here. This v6 SDK release line should continue to receive fixes as long as the 2026-04 API version is in support.

The primary addition in this release is full Admin API / RBAC support on AdminClient.

Features

Admin API: Role-Based Access Control (RBAC)

AdminClient now covers the four new 2026-04 admin resources, exposing them as sub-clients alongside the existing Project, Organization, and APIKey clients. Each is instantiated automatically in NewAdminClientWithContext and follows the established sub-client pattern (interface + Default* implementation), typed models, cursor-based pagination, and input validation used across the rest of the SDK.

Sub-client	Interface	Operations
RoleBinding	RoleBindingClient	Create, List, Describe, Delete
ServiceAccount	ServiceAccountClient	Create, List, Describe, Update, RotateSecret, Delete
Invite	InviteClient	Create, List, Describe, Resend, Delete
User	UserClient	List, Describe, Delete

Operations are implicitly scoped to the service account caller's organization.

New public types in models.go include RoleBinding, RoleBindingInput, ServiceAccount, ServiceAccountWithSecret, Invite, and User, each with a paginated *List envelope. New typed enums are also included: PrincipalType (user / service_account / api_key / invite), ResourceType (organization / project), and InviteStatus (pending / expired / processed). Role remains an open-ended string (mirroring APIKey.Roles), with valid values enumerated in its GoDoc.

⚠️ Note: ServiceAccountWithSecret.ClientSecret is returned only once at service-account creation and secret rotation. Store it securely and never log it; it cannot be retrieved again.

import (
	"context"
	"fmt"
	"log"
	"os"

	"github.com/pinecone-io/go-pinecone/v6/pinecone"
)

func AdminRBAC() {
	ctx := context.Background()

	adminClient, err := pinecone.NewAdminClientWithContext(ctx, pinecone.NewAdminClientParams{
		ClientId:     os.Getenv("PINECONE_CLIENT_ID"),
		ClientSecret: os.Getenv("PINECONE_CLIENT_SECRET"),
	})
	if err != nil {
		log.Fatalf("Failed to create AdminClient: %v", err)
	}

	// Create a service account with an initial organization-scoped role.
	sa, err := adminClient.ServiceAccount.Create(ctx, &pinecone.CreateServiceAccountParams{
		Name: "ci-deployer",
		RoleBindings: []pinecone.RoleBindingInput{
			{ResourceType: pinecone.ResourceTypeOrganization, Role: "OrgMember"},
		},
	})
	if err != nil {
		log.Fatalf("Failed to create service account: %v", err)
	}
	// ClientSecret is returned only once — store it securely, never log it.
	fmt.Printf("Created service account: %s\n", sa.ServiceAccount.Id)

	// Grant the service account an additional project-scoped role.
	projectId := "my-project-id"
	_, err = adminClient.RoleBinding.Create(ctx, &pinecone.CreateRoleBindingParams{
		PrincipalId:   sa.ServiceAccount.Id,
		PrincipalType: pinecone.PrincipalTypeServiceAccount,
		ResourceType:  pinecone.ResourceTypeProject,
		ResourceId:    &projectId,
		Role:          "ProjectEditor",
	})
	if err != nil {
		log.Fatalf("Failed to create role binding: %v", err)
	}

	// Invite a teammate to the organization.
	invite, err := adminClient.Invite.Create(ctx, &pinecone.CreateInviteParams{
		Email: "teammate@example.com",
		RoleBindings: []pinecone.RoleBindingInput{
			{ResourceType: pinecone.ResourceTypeOrganization, Role: "OrgMember"},
		},
	})
	if err != nil {
		log.Fatalf("Failed to create invite: %v", err)
	}
	fmt.Printf("Invited %s (status: %s)\n", invite.Email, invite.Status)
}

Bug Fixes

Default namespace coercion

Fixed how the SDK represents the default namespace on the gRPC data plane. Previously the SDK coerced "" → "__default__" client-side when creating an IndexConnection. In addition, FetchVectors, FetchVectorsByMetadata, and QueryVectors now return the Namespace value the server actually sent in the response, rather than echoing the connection's stored namespace.

Because the server maps "" → "__default__" in responses at the current API version, callers still see "__default__" in response Namespace fields, and observable behavior should be unchanged.

Breaking Changes

This release moves the module to a new major version. Per Go's module versioning rules, the module path now carries a /v6 suffix, so consumers must update their import paths:

// before
import "github.com/pinecone-io/go-pinecone/v5/pinecone"

// after
import "github.com/pinecone-io/go-pinecone/v6/pinecone"

Update your dependency with:

go get github.com/pinecone-io/go-pinecone/v6/pinecone@latest

The public API surface is otherwise backward compatible with the v5 release line — the Admin API additions are purely additive, and the default-namespace fix leaves observable behavior unchanged.

What's Changed

• Fix default namespace coercion by @austin-denoble in #140
• refactor: use slices.Contains to simplify code by @caltechustc in #141
• chore: fix some comments to improve readability by @solunolab in #142
• test: fix pre-existing integration-test failures blocking CI (PIN-37) by @jhamon in #149
• Enable Dependabot version updates (PIN-4) by @jhamon in #144
• ci: add least-privilege workflow permissions (CodeQL) by @jhamon in #146
• regenerate client internals off of 2026-04 specifications by @austin-denoble in #143
• security: clear ALL Dependabot on go-pinecone (grpc CRITICAL + x/net + tooling) by @jhamon in #147
• test(smoke): mocked critical-path gate that runs keyless on every PR by @jhamon in #150
• Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in #151
• Bump the gomod-minor-and-patch group across 1 directory with 4 updates by @dependabot[bot] in #156
• Implement Admin API / RBAC by @austin-denoble in #159
• build(deps): combine dependabot updates (gomod + github-actions) by @austin-denoble in #160
• release: bump module path to /v6 for v6.0.0 by @austin-denoble in #161

New Contributors

• @caltechustc made their first contribution in #141
• @solunolab made their first contribution in #142
• @dependabot[bot] made their first contribution in #151

Full Changelog: v5.4.1...v6.0.0