A machine readable medium storing a program for processing requests for performing an operation on resources in a datacenter, the program comprising sets of instructions which, when executed on one or more processors, cause the one or more processors to carry out the steps of: receiving an application programming interface 'API' call that comprises a plurality of requests regarding the resources in the datacenter, wherein the resources in the datacenter are arranged in a resource hierarchy; parsing the API call into the plurality of requests with each request specifying at least one operation to perform with respect to at least one resource in the datacenter; for each parsed request, calling a policy checking engine: i) to identify at least one policy applicable to the request from a plurality of policies that are expressed for a plurality of resources at different hierarchal resource levels in the datacenter and that place constraints on operations specified for the plurality of resources, said identifying comprising comparing a set of attributes of the request with sets of attributes of a set of policies to identify the applicable policy; and ii) to determine whether the request violates the policy identified for the request; rejecting the API call as an unauthorized API when at least one particular request violates a particular policy identified for the particular request; and directing a set of one or more resource managers to perform a plurality of operations based on the plurality of requests when the plurality of requests do not violate any of the identified policies. receiving an application programming interface 'API' call that comprises a plurality of requests regarding the resources in the datacenter, wherein the resources in the datacenter are arranged in a resource hierarchy; parsing the API call into the plurality of requests with each request specifying at least one operation to perform with respect to at least one resource in the datacenter; for each parsed request, calling a policy checking engine: i) to identify at least one policy applicable to the request from a plurality of policies that are expressed for a plurality of resources at different hierarchal resource levels in the datacenter and that place constraints on operations specified for the plurality of resources, said identifying comprising comparing a set of attributes of the request with sets of attributes of a set of policies to identify the applicable policy; and ii) to determine whether the request violates the policy identified for the request; i) to identify at least one policy applicable to the request from a plurality of policies that are expressed for a plurality of resources at different hierarchal resource levels in the datacenter and that place constraints on operations specified for the plurality of resources, said identifying comprising comparing a set of attributes of the request with sets of attributes of a set of policies to identify the applicable policy; and ii) to determine whether the request violates the policy identified for the request; rejecting the API call as an unauthorized API when at least one particular request violates a particular policy identified for the particular request; and directing a set of one or more resource managers to perform a plurality of operations based on the plurality of requests when the plurality of requests do not violate any of the identified policies.