--- title: PingOne Identity Governance API reference description: Identity Governance has many features, including access requests, the governance glossary (catalog), and entitlements. component: pingoneaic page_id: pingoneaic:identity-governance:rest-api/endpoints/rest-iga canonical_url: https://docs.pingidentity.com/pingoneaic/identity-governance/rest-api/endpoints/rest-iga.html keywords: ["REST API", "API reference", "endpoints", "identity governance", "access requests", "certification", "workflows"] section_ids: yaml_file: YAML file access_token: Access token rest-api-gov-endpoints: Endpoints rest-api-application: Application rest-api-certification: Certification rest-api-access-request: Access request rest-api-access-request-form: Access request form rest-api-access-request-type: Access request type rest-api-account: Account rest-api-audit: Audit rests-api-catalog: Catalog rest-api-config: Config rest-api-entitlement: Entitlement rest-api-event: Event rest-api-job: Job rest-api-provisioning: Provisioning rest-api-recommendation: Recommendations rest-api-scope: Scope rest-api-sod: Segregation of Duty rest-api-task: Task rest-api-user: User rest-api-workflow: Workflow rest-api-notification: Notifications rest-api-evolving: Evolving rest-api-deprecated: Deprecated rest-api-glossary: Glossary rest-api-roles: Roles rest-api-role-mining: Role mining rest-api-rules: Rules --- # PingOne Identity Governance API reference Identity Governance has many features, including access requests, the governance glossary (catalog), and entitlements. The following sections comprehensively explore the Identity Governance REST API endpoints. ## YAML file The REST APIs contain many parameters and, in some instances, large request bodies. For your convenience, you can view the entire API using a YAML file based on the [OpenAPI specification](https://www.openapis.org). To download the YAML file, [click here](../../_attachments/identity-governance-openapi.yaml). Learn more in the [API reference documentation](../../../_attachments/api/identity-governance-openapi.html). | | | | - | ----------------------------------------------------------------------------------------------------------------------- | | | Adjust the configurations of the file to match your specific details, such as your Advanced Identity Cloud tenant FQDN. | ## Access token You need to obtain an access token to authenticate to the Advanced Identity Cloud REST API. Learn more about obtaining an access token in [Authenticate to Advanced Identity Cloud REST API with access token](../../../developer-docs/authenticate-to-rest-api-with-access-token.html). After you obtain an access token, you can access the Identity Governance API using the specific HTTP methods: `GET`, `POST`, `PUT`, `PATCH`, and `DELETE`. You can use client command-line tools, such as [cURL](https://curl.se) or API platforms, such as [Postman](https://www.postman.com) to transfer data to and from the IGA server. For example, using cURL: ```json curl \ --request GET \ --header 'Authorization: Bearer ' \ "https:///iga/governance/application?_pageSize=10&_queryFilter=true" ``` > **Collapse: Show example response** > > ```json > { > "result": [ > { > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > ... > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > ... > } > ], > "searchAfterKey": "string", > "resultCount": 0, > "totalCount": 0 > } > ``` ## Endpoints The following sections present the Identity Governance endpoints. | | | | - | ---------------------------------------------------------------------------------------------------- | | | The output and examples presented in this section are based on a test dataset and are not real data. | ### Application | URI | HTTP method | Description | | ------------------------------------------------------ | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/application` | GET | Query Identity Governance applications. This endpoint is subject to the end user's scoped permissions.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter.> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example to get a list of applications** > > Media type: `application/json` > > ```json > GET iga/governance/application?_pageSize=1&_queryFilter=true > { > "result": [ > { > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > ... > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > ... > } > ], > "searchAfterKey": "string", > "resultCount": 0, > "totalCount": 0 > } > ``` | | `/iga/governance/application/{id}/{objectType}/schema` | GET | Returns the schema of a given application's object type.This endpoint helps identify the required payload structure for the request endpoint. It's for the object key that holds the entitlement details. The UI also uses the endpoint to generate forms for creating and modifying entitlements.> **Collapse: Parameters** > > Name Description id string \* required ID of the application. objectType string \* required Object type to get the schema.> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example to get the object type schema** > > Media type: `application/json` > > ```json > GET iga/governance/application/{applicationId}/{objectType}/schema > > For example: > > GET iga/governance/application/e35d09cd-2b9b-41bc-8246-dc23d4a36502/Department/schema" > { > "$schema": "http://json-schema.org/draft-03/schema", > "id": "department", > "nativeType": "department", > "properties": { > "__NAME__": { > "flags": [ > "NOT_UPDATEABLE", > "NOT_CREATABLE" > ], > "nativeName": "__NAME__", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 11, > "displayName": "__NAME__" > }, > "company": { > "nativeName": "company", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 4, > "displayName": "company" > }, > "cost_center": { > "nativeName": "cost_center", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 0, > "displayName": "cost_center" > }, > "dept_head": { > "nativeName": "dept_head", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 15, > "displayName": "dept_head" > }, > "description": { > "nativeName": "description", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 7, > "displayName": "description" > }, > "head_count": { > "nativeName": "head_count", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 1, > "displayName": "head_count" > }, > "id": { > "nativeName": "id", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 14, > "displayName": "id" > }, > "name": { > "nativeName": "name", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 3, > "displayName": "name" > }, > "parent": { > "nativeName": "parent", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 8, > "displayName": "parent" > }, > "primary_contact": { > "nativeName": "primary_contact", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 10, > "displayName": "primary_contact" > }, > "sys_created_by": { > "nativeName": "sys_created_by", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 12, > "displayName": "sys_created_by" > }, > "sys_created_on": { > "nativeName": "sys_created_on", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 6, > "displayName": "sys_created_on" > }, > "sys_mod_count": { > "flags": [ > "NOT_UPDATEABLE", > "NOT_CREATABLE" > ], > "nativeName": "sys_mod_count", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 5, > "displayName": "sys_mod_count" > }, > "sys_tags": { > "flags": [ > "NOT_UPDATEABLE", > "NOT_CREATABLE" > ], > "nativeName": "sys_tags", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 13, > "displayName": "sys_tags" > }, > "sys_updated_by": { > "flags": [ > "NOT_UPDATEABLE", > "NOT_CREATABLE" > ], > "nativeName": "sys_updated_by", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 9, > "displayName": "sys_updated_by" > }, > "sys_updated_on": { > "flags": [ > "NOT_UPDATEABLE", > "NOT_CREATABLE" > ], > "nativeName": "sys_updated_on", > "nativeType": "string", > "type": "string", > "userSpecific": true, > "order": 2, > "displayName": "sys_updated_on" > } > }, > "type": "object", > "applicationId": "e35d09cd-2b9b-41bc-8246-dc23d4a36502" > } > ``` | ### Certification | URI | HTTP method | Description | | -------------------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/certification/template` | GET | Query existing certification templates.> **Collapse: Parameters** > > Name Description queryString string String to search name and description. pageSize string Number of results per page. pageNumber string Page number of results to display. searchAfter string An alternate of pageNumber, corresponds to the searchAfterKey value sent in the previous page's results. sortBy string Property to sort results by. sortDesc string Direction to sort results by. certificationType string Filter by certification type. The available values are identity, roleMembership, and entitlement.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > GET /iga/governance/certification/template?_pageSize=1 > { > "result": [ > { > "status": "active", > "certObjectType": "user", > "name": "Biometrical Identity Scan v0.1", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "identity", > "ownerId": "managed/user/d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5", > "certifierScript": null, > "certifierInfo": { > "givenName": "Luis Ye", > "id": "d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5", > "mail": "awd@asd.asd", > "sn": "Herrera", > "userName": "ye" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": "emailTemplate/certificationAssigned", > "assignmentNotificationIncludeManager": false, > "reassignNotification": "emailTemplate/certificationReassigned", > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "accountGrant", > "entitlementGrant", > "roleMembership", > "AccountGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "EQUALS", > "operand": { > "targetName": "authoritative", > "targetValue": false > } > }, > "account": { > "operator": "ALL", > "operand": [] > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "role": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "Luis Ye", > "id": "d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5", > "mail": "awd@asd.asd", > "sn": "Herrera", > "userName": "ye" > }, > "id": "afbd1e00-6b17-425b-a7e8-b34816b20174", > "metadata": { > "modifiedDate": "2025-03-20T21:47:32.325Z", > "createdDate": "2025-03-20T21:47:13.329365134Z" > } > }, > { > "status": "active", > "certObjectType": "user", > "name": "Bookmark App Test", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": true, > "selfCertificationRule": "all", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": "BasicRevocation", > "initializeRule": "", > "finalizeRule": "", > "certificationType": "identity", > "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "certifierScript": null, > "certifierInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "assignmentNotificationIncludeManager": false, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "accountGrant", > "AccountGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "OR", > "operand": [ > { > "operand": { > "targetName": "id", > "targetValue": "06ad7fa8-b0c3-412e-a8af-7d27367dc4d3" > }, > "operator": "EQUALS" > } > ] > }, > "account": { > "operator": "ALL", > "operand": [] > }, > "memberOfOrg": [], > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > }, > "id": "cf31dc2f-96bc-4b9d-baca-a25b6fcd2b6c", > "metadata": { > "modifiedDate": "2025-03-26T16:10:54.979Z", > "createdDate": "2025-03-26T16:10:48.375561804Z" > } > }, > { > "status": "pending", > "certObjectType": "user", > "name": "Bookmark App Test (copy)", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": true, > "selfCertificationRule": "all", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": "BasicRevocation", > "initializeRule": "", > "finalizeRule": "", > "certificationType": "identity", > "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "certifierScript": null, > "certifierInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "assignmentNotificationIncludeManager": false, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "accountGrant", > "AccountGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "OR", > "operand": [ > { > "operand": { > "targetName": "id", > "targetValue": "06ad7fa8-b0c3-412e-a8af-7d27367dc4d3" > }, > "operator": "EQUALS" > } > ] > }, > "account": { > "operator": "ALL", > "operand": [] > }, > "memberOfOrg": [], > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > }, > "id": "e92b134a-4843-41e1-89c3-eed7a21061a1", > "scheduleId": null, > "metadata": { > "modifiedDate": "2025-05-09T11:20:37.22Z", > "createdDate": "2025-03-26T16:45:03.022653856Z" > } > }, > { > "status": "active", > "certObjectType": "user", > "name": "EC CV", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "entitlement", > "ownerId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "certifierScript": null, > "certifierInfo": { > "givenName": "Carlos", > "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "mail": "carlos.vibancoo@forgerock.com", > "sn": "Vibanco", > "userName": "cvibanco" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": "emailTemplate/certificationAssigned", > "assignmentNotificationIncludeManager": false, > "reassignNotification": "emailTemplate/certificationReassigned", > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "entitlementGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "EQUALS", > "operand": { > "targetName": "authoritative", > "targetValue": false > } > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "Carlos", > "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "mail": "carlos.vibancoo@forgerock.com", > "sn": "Vibanco", > "userName": "cvibanco" > }, > "id": "7526e7b6-6580-497c-817b-64e05e54d1dc", > "scheduleId": null, > "metadata": { > "modifiedDate": "2025-03-27T03:26:27.344Z", > "createdDate": "2025-03-27T03:25:49.018057675Z" > } > }, > { > "status": "pending", > "certObjectType": "user", > "name": "EC CV (copy)", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": "", > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "entitlement", > "ownerId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "certifierScript": null, > "certifierInfo": { > "givenName": "Carlos", > "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "mail": "carlos.vibancoo@forgerock.com", > "sn": "Vibanco", > "userName": "cvibanco" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": "emailTemplate/certificationAssigned", > "assignmentNotificationIncludeManager": false, > "reassignNotification": "emailTemplate/certificationReassigned", > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "entitlementGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "EQUALS", > "operand": { > "targetName": "authoritative", > "targetValue": false > } > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "Carlos", > "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c", > "mail": "carlos.vibancoo@forgerock.com", > "sn": "Vibanco", > "userName": "cvibanco" > }, > "id": "9cd17b0f-6c92-4a2f-842f-dec592b47227", > "metadata": { > "modifiedDate": "2025-03-27T16:57:32.813732253Z", > "createdDate": "2025-03-27T16:57:32.813730761Z" > } > }, > { > "status": "active", > "certObjectType": "user", > "name": "EntitlementCert", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "entitlement", > "ownerId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395", > "certifierScript": null, > "certifierInfo": { > "givenName": "mike", > "id": "991cddde-a0ff-4da2-b01b-080e182ff395", > "mail": "test@test.com", > "sn": "test", > "userName": "mikeTest" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": "emailTemplate/certificationAssigned", > "assignmentNotificationIncludeManager": false, > "reassignNotification": "emailTemplate/certificationReassigned", > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "entitlementGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "EQUALS", > "operand": { > "targetName": "authoritative", > "targetValue": false > } > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "mike", > "id": "991cddde-a0ff-4da2-b01b-080e182ff395", > "mail": "test@test.com", > "sn": "test", > "userName": "mikeTest" > }, > "id": "5357fe84-db54-4853-bca7-e28580617830", > "metadata": { > "modifiedDate": "2025-03-21T18:20:38.449Z", > "createdDate": "2025-03-21T18:20:19.686794893Z" > } > }, > { > "status": "active", > "certObjectType": "user", > "name": "Entra Groups", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 0, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "entitlement", > "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "certifierScript": null, > "certifierInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "assignmentNotificationIncludeManager": false, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "entitlementGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "OR", > "operand": [ > { > "operand": { > "targetName": "id", > "targetValue": "89feff34-86e3-4c00-b0ff-376c772ba1b7" > }, > "operator": "EQUALS" > } > ] > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": false, > "exceptionAllowed": false > }, > "ownerInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > }, > "id": "94b71f9e-f5a1-488f-8d9a-fed558ed74d8", > "metadata": { > "modifiedDate": "2025-03-25T05:39:42.616Z", > "createdDate": "2025-03-25T05:39:36.35029936Z" > } > }, > { > "status": "pending", > "certObjectType": "user", > "name": "Entra Groups (copy)", > "description": "", > "isEventBased": false, > "stagingEnabled": false, > "schedule": "", > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 0, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "entitlement", > "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "certifierScript": null, > "certifierInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "assignmentNotificationIncludeManager": false, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "entitlementGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "OR", > "operand": [ > { > "operand": { > "targetName": "id", > "targetValue": "89feff34-86e3-4c00-b0ff-376c772ba1b7" > }, > "operator": "EQUALS" > } > ] > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": false, > "exceptionAllowed": false > }, > "ownerInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > }, > "id": "569ccdb3-5583-4d7b-9c10-20ae76dd74ab", > "metadata": { > "modifiedDate": "2025-03-25T06:04:33.45811308Z", > "createdDate": "2025-03-25T06:04:33.458111794Z" > } > }, > { > "status": "active", > "certObjectType": "user", > "name": "MikeTest", > "description": "test", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "identity", > "ownerId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395", > "certifierScript": null, > "certifierInfo": { > "givenName": "mike", > "id": "991cddde-a0ff-4da2-b01b-080e182ff395", > "mail": "test@test.com", > "sn": "test", > "userName": "mikeTest" > } > } > ], > "defaultCertifierId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395", > "assignmentNotification": "emailTemplate/certificationAssigned", > "assignmentNotificationIncludeManager": false, > "reassignNotification": "emailTemplate/certificationReassigned", > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "accountGrant", > "entitlementGrant", > "roleMembership", > "AccountGrant", > "ResourceGrant" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "application": { > "operator": "EQUALS", > "operand": { > "targetName": "authoritative", > "targetValue": false > } > }, > "account": { > "operator": "ALL", > "operand": [] > }, > "memberOfOrg": [], > "entitlement": { > "operator": "ALL", > "operand": [] > }, > "role": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "expirationNotificationDay": 5, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "mike", > "id": "991cddde-a0ff-4da2-b01b-080e182ff395", > "mail": "test@test.com", > "sn": "test", > "userName": "mikeTest" > }, > "defaultCertifierInfo": { > "givenName": "mike", > "id": "991cddde-a0ff-4da2-b01b-080e182ff395", > "mail": "test@test.com", > "sn": "test", > "userName": "mikeTest" > }, > "id": "f3a5ee0f-975a-443f-8a94-a70bca08f9af", > "scheduleId": null, > "metadata": { > "modifiedDate": "2025-03-20T16:04:26.713Z", > "createdDate": "2025-03-18T23:46:41.305877852Z" > } > }, > { > "status": "active", > "certObjectType": "user", > "name": "Role Membership Certification", > "description": "Role Membership Certification", > "isEventBased": false, > "stagingEnabled": false, > "schedule": null, > "skipInactiveCertifiers": false, > "allowSelfCertification": true, > "selfCertificationRule": "all", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "claim": true, > "delegate": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "save": true, > "signoff": true > }, > "exceptionDuration": 14, > "allowBulkCertify": true, > "allowPartialSignoff": false, > "remediationRule": null, > "initializeRule": "", > "finalizeRule": "", > "certificationType": "roleMembership", > "ownerId": "managed/user/75982e79-40dc-4ad2-8b85-abe1ebd2e2b9", > "stageDuration": 14, > "expirationAction": null, > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "certifierScript": null, > "certifierInfo": { > "givenName": "Abel", > "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa", > "mail": "abel.tuter@example.com", > "sn": "Tuter", > "userName": "abel.tuter" > } > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "assignmentNotificationIncludeManager": false, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "type": [ > "roleMembership" > ], > "user": { > "operator": "ALL", > "operand": [] > }, > "memberOfOrg": [], > "role": { > "operator": "ALL", > "operand": [] > }, > "decision": { > "operator": "ALL", > "operand": [] > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "requireJustification": { > "revoke": true, > "exceptionAllowed": true > }, > "ownerInfo": { > "givenName": "Frank", > "id": "75982e79-40dc-4ad2-8b85-abe1ebd2e2b9", > "mail": "fyork@example.com", > "sn": "York", > "userName": "fyork" > }, > "id": "deb85d50-170b-4c5a-abb8-defa3ed8baef", > "metadata": { > "modifiedDate": "2025-03-26T15:46:19.528Z", > "createdDate": "2025-03-26T15:45:57.050282486Z" > } > } > ], > "resultCount": 10, > "totalHits": 21, > "searchAfterKey": [ > "Role Membership Certification", > "deb85d50-170b-4c5a-abb8-defa3ed8baef" > ] > } > ``` | | `/iga/governance/certification/template` | POST | Create a new certification template.> **Collapse: Parameters** > > No parameters> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "Active Directory Certification", > "description": "Certifying the accounts within active directory applications", > "stagingEnabled": false, > "schedule": null, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "exceptionDuration": 7, > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": "", > "initializeRule": "", > "finalizeRule": "", > "certificationType": "identity", > "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6", > "stageDuration": 14, > "expirationAction": "revoke", > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/79cc9f29-8d89-4958-8074-ce0df88979a2" > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "user": { > "operator": "ALL", > "operand": [] > }, > "type": [ > "accountGrant" > ], > "application": { > "operator": "CONTAINS", > "operand": { > "targetName": "name", > "targetValue": "Active Directory" > } > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "includeChildOrganizations": true > } > ```> **Collapse: Responses** > > Code Description 201 Creation success. Returns the saved template object. 400 Invalid data provided. 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > POST iga/governance/certification/template > { > "name": "Active Directory Certification", > "description": "Certifying the accounts within active directory applications", > "stagingEnabled": false, > "schedule": null, > "allowSelfCertification": false, > "selfCertificationRule": "none", > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "exceptionDuration": 7, > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": "", > "initializeRule": "", > "finalizeRule": "", > "certificationType": "identity", > "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6", > "stageDuration": 14, > "expirationAction": "revoke", > "expirationActionDelay": 0, > "expirationReassignee": null, > "stages": [ > { > "certifierType": "user", > "certifierId": "managed/user/79cc9f29-8d89-4958-8074-ce0df88979a2" > } > ], > "defaultCertifierId": null, > "assignmentNotification": null, > "reassignNotification": null, > "expirationNotification": null, > "reminderNotification": null, > "reminderFrequency": 0, > "escalationNotification": null, > "escalationFrequency": null, > "escalationOwner": null, > "remediationDelay": 0, > "targetFilter": { > "user": { > "operator": "ALL", > "operand": [] > }, > "type": [ > "accountGrant", > "AccountGrant" > ], > "application": { > "operator": "CONTAINS", > "operand": { > "targetName": "name", > "targetValue": "Active Directory" > } > } > }, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "includeChildOrganizations": true, > "status": "pending", > "id": "5626c308-250f-4b50-9f92-0c7e122e95c9" > } > ``` | | `/iga/governance/certification/template/{id}/duplicate` | POST | Duplicate an existing certification template.> **Collapse: Parameters** > > Name Description id string \* required ID of the template object to copy> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Template not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > POST /iga/governance/certification/template/afbd1e00-6b17-425b-a7e8-b34816b20174/duplicate > { > "message": "Cert Template duplicated successfully" > } > ``` | | `/iga/governance/certification/template/{id}` | PUT | Updates a single certification template.> **Collapse: Parameters** > > Name Description id string \* required ID of the template object> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "description": "string", > "certificationType": "identity", > "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6", > "ownerId": "string", > "schedule": { > "id": "string", > "type": "simple", > "startTime": "string", > "endTime": "string", > "repeatCount": 0, > "repeatInterval": 0, > "schedule": "string", > "invokeContext": {}, > "enabled": true > }, > "allowSelfCertification": false, > "targetFilter": { > "user": { > "operator": "EQUALS", > "operand": { > "targetName": "accountStatus", > "targetValue": "active" > } > }, > "application": { > "operator": "CONTAINS", > "operand": { > "targetName": "name", > "targetValue": "SalesForce" > } > }, > "type": [ > "accountGrant" > ], > "memberOfOrg": [ > "52cf01b4-288e-4c21-aed6-f992be073988" > ] > }, > "stages": [ > { > "name": "string", > "certifierType": "user", > "certifierId": "managed/user/79cc9f29-8d89-4958-8074-ce0df88979a" > } > ], > "stageDuration": 0, > "expirationAction": "certify", > "expirationActionDelay": 0, > "expirationReassignee": null, > "stagingEnabled": true, > "defaultCertifierId": "string", > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": "string", > "initializeRule": "", > "finalizeRule": "", > "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6", > "exceptionDuration": 0, > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "selfCertificationRule": "all", > "assignmentNotification": "string", > "reassignNotification": "string", > "expirationNotification": "string", > "expirationNotificationDay": "string", > "reminderNotification": "string", > "reminderFrequency": 0, > "escalationNotification": "string", > "escalationFrequency": 0, > "escalationOwner": "string", > "remediationDelay": 0, > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "includeChildOrganizations": true, > "parameters": [ > { > "id": "string", > "displayName": "string", > "path": "string" > } > ], > "templateEventType": "user" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Template not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > PUT /iga/governance/certification/template/5626c308-250f-4b50-9f92-0c7e122e95c9 > [ > { > "id": "string", > "name": "string", > "description": "string", > "certificationType": "identity", > "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6", > "schedule": { > "id": "string", > "type": "simple", > "startTime": "string", > "endTime": "string", > "repeatCount": 0, > "repeatInterval": 0, > "schedule": "string", > "invokeContext": {}, > "enabled": true > }, > "targetFilter": { > "user": { > "operator": "EQUALS", > "operand": { > "targetName": "accountStatus", > "targetValue": "active" > } > }, > "application": { > "operator": "CONTAINS", > "operand": { > "targetName": "name", > "targetValue": "SalesForce" > } > }, > "type": [ > "accountGrant" > ], > "memberOfOrg": [ > "52cf01b4-288e-4c21-aed6-f992be073988" > ] > }, > "stages": [ > { > "name": "string", > "certifierType": "user", > "certifierId": "string" > } > ], > "stageDuration": 0, > "expirationAction": "certify", > "expirationActionDelay": "string", > "expirationReassignee": "string", > "stagingEnabled": true, > "defaultCertifierId": "string", > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": "string", > "remediationDelay": 0, > "exceptionDuration": 0, > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "selfCertificationRule": "all", > "assignmentNotification": "string", > "reassignNotification": "string", > "expirationNotification": "string", > "expirationNotificationDay": "string", > "reminderNotification": "string", > "reminderFrequency": 0, > "escalationNotification": "string", > "escalationFrequency": 0, > "escalationOwner": "string", > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "includeChildOrganizations": true, > "parameters": [ > { > "id": "string", > "displayName": "string", > "path": "string" > } > ], > "templateEventType": "user", > "status": "active", > "scheduleId": "string", > "ownerInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "defaultCertifierInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "escalationOwnerInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "expirationReassigneeInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string", > "name": "string" > } > } > ] > ``` | | []()`/iga/governance/certification/template/{id}` | DELETE | Deletes a single certification template at the requested ID in the path. Campaigns are created as copies of templates. These copies preserve the campaign's template information, even if the original template is deleted.> **Collapse: Parameters** > > Name Description id string \* required ID of the template object> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "name": "string", > "description": "string", > "certificationType": "identity", > "ownerId": "string", > "schedule": { > "id": "string", > "type": "simple", > "startTime": "string", > "endTime": "string", > "repeatCount": 0, > "repeatInterval": 0, > "schedule": "string", > "invokeContext": {}, > "enabled": true > }, > "targetFilter": { > "user": { > "operator": "EQUALS", > "operand": { > "targetName": "accountStatus", > "targetValue": "active" > } > }, > "application": { > "operator": "CONTAINS", > "operand": { > "targetName": "name", > "targetValue": "SalesForce" > } > }, > "type": [ > "accountGrant" > ], > "memberOfOrg": [ > "52cf01b4-288e-4c21-aed6-f992be073988" > ] > }, > "stages": [ > { > "name": "string", > "certifierType": "user", > "certifierId": "string" > } > ], > "stageDuration": 0, > "expirationAction": "certify", > "expirationActionDelay": "string", > "expirationReassignee": "string", > "stagingEnabled": true, > "defaultCertifierId": "string", > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": "string", > "remediationDelay": 0, > "exceptionDuration": 0, > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "selfCertificationRule": "all", > "assignmentNotification": "string", > "reassignNotification": "string", > "expirationNotification": "string", > "expirationNotificationDay": "string", > "reminderNotification": "string", > "reminderFrequency": 0, > "escalationNotification": "string", > "escalationFrequency": 0, > "escalationOwner": "string", > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "includeChildOrganizations": true, > "parameters": [ > { > "id": "string", > "displayName": "string", > "path": "string" > } > ], > "templateEventType": "user", > "status": "active", > "scheduleId": "string", > "ownerInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "defaultCertifierInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "escalationOwnerInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "expirationReassigneeInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string", > "name": "string" > } > } > ] > ``` | | `/iga/governance/certification/get-filter-schema` | POST | Get the available schema on which to filter certification templates.Returns a collection of schema properties that are available to populate the certification templates target filter property, including properties of application, user, entitlement, role, and other objects.> **Collapse: Parameters** > > No parameters> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Template not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "application": [ > { > "key": "application.description", > "name": "description", > "displayName": "Description", > "description": "Application Description", > "type": "string", > "isMultiValue": false > }, > { > "key": "application.name", > "name": "name", > "displayName": "Name", > "description": "Application name", > "type": "string", > "isMultiValue": false > } > ], > "entitlement": [ > { > "key": "glossary.idx./entitlement.description", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": null, > "searchable": true, > "isInternal": true, > "displayName": "Description", > "name": "description", > "description": "Description of entitlement", > "objectType": "/openidm/managed/assignment", > "type": "string" > }, > { > "key": "entitlement.displayName", > "name": "displayName", > "displayName": "Display Name", > "description": "", > "type": "text", > "isMultiValue": false > }, > { > "key": "glossary.idx./entitlement.entitlementOwner", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": "/openidm/managed/user", > "searchable": true, > "isInternal": true, > "displayName": "Entitlement Owner", > "name": "entitlementOwner", > "description": "Entitlement Owner of Object", > "objectType": "/openidm/managed/assignment", > "type": "managedObject" > }, > { > "key": "glossary.idx./entitlement.requestable", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": null, > "searchable": true, > "isInternal": true, > "displayName": "Requestable", > "name": "requestable", > "description": "Can the entitlement be requested", > "objectType": "/openidm/managed/assignment", > "type": "boolean" > } > ], > "role": [ > { > "key": "role.applications._ref", > "name": "applications", > "displayName": "Applications", > "description": "Role Applications", > "type": "managedObject", > "isMultiValue": true, > "managedObjectType": "/openidm/managed/alpha_application" > }, > { > "key": "role.description", > "name": "description", > "displayName": "Description", > "description": "The role description, used for display purposes.", > "type": "string", > "isMultiValue": false > }, > { > "key": "role.id", > "name": "_id", > "displayName": "Name", > "description": "Role ID", > "type": "string", > "isMultiValue": false > }, > { > "key": "role.name", > "name": "name", > "displayName": "Name", > "description": "The role name, used for display purposes.", > "type": "string", > "isMultiValue": false > }, > { > "key": "glossary.idx./role.requestable", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": null, > "searchable": true, > "isInternal": true, > "displayName": "Requestable", > "name": "requestable", > "description": "Can the role be requested", > "objectType": "/openidm/managed/role", > "type": "boolean" > }, > { > "key": "role.members._ref", > "name": "members", > "displayName": "Role Members", > "description": "Role Members", > "type": "managedObject", > "isMultiValue": true, > "managedObjectType": "/openidm/managed/alpha_user" > } > ] > } > ``` | | `/iga/governance/certification` | GET | Query existing certification instances. Returns certificate campaigns based on query parameter.> **Collapse: Parameters** > > Name Description queryString string String to search name and description. \_pageSize integer Number of response results to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc or desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are: date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry from which to continue searching. Comma-separated for multiple values. status string Filter by certification status. The available values are: active and closed. certificationType string Filter by certification type. The available values are identity, roleMembership, and entitlement.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/certification/{certId}` | GET | Returns a certification campaign based on the provided campaign ID.> **Collapse: Parameters** > > Name Description {certId} string required Certification campaign ID.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Certification not found 500 Server error | | `/iga/governance/certification/{certId}/tasks` | GET | Returns the tasks assigned to different certifiers for a specific certification campaign.> **Collapse: Parameters** > > Name Description {certId} string required Certification campaign ID. queryString string Search tasks based on reviewer information. For example, userName, sn, givenName, and mail. pageSize string Number of results per page. pageNumber string Page number of results to display. sortBy string Property to sort results by. For example, actor.userName, progress. sortDir string Direction to sort results by: asc or desc.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/certification/{certId}/update-deadline` | POST | Updates a certification's deadline.> **Collapse: Parameters** > > Name Description {certId} string required Certification campaign ID.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "newDeadline": "2026-07-31T23:59:59Z" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Certification could not be found. 500 Server error | | `/iga/governance/certification/{certId}/cancel` | POST | Cancels a certification campaign at the requested ID in the path. This only cancels existing in-progress action items. It won't revert any decisions that have been signed off and acted on.> **Collapse: Parameters** > > Name Description certId string \* required ID of the certification campaign> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "name": "string", > "description": "string", > "certificationType": "identity", > "ownerId": "string", > "schedule": { > "id": "string", > "type": "simple", > "startTime": "string", > "endTime": "string", > "repeatCount": 0, > "repeatInterval": 0, > "schedule": "string", > "invokeContext": {}, > "enabled": true > }, > "targetFilter": { > "user": { > "operator": "EQUALS", > "operand": { > "targetName": "accountStatus", > "targetValue": "active" > } > }, > "application": { > "operator": "CONTAINS", > "operand": { > "targetName": "name", > "targetValue": "SalesForce" > } > }, > "type": [ > "accountGrant" > ], > "memberOfOrg": [ > "52cf01b4-288e-4c21-aed6-f992be073988" > ] > }, > "stages": [ > { > "name": "string", > "certifierType": "user", > "certifierId": "string" > } > ], > "stageDuration": 0, > "expirationAction": "certify", > "expirationActionDelay": "string", > "expirationReassignee": "string", > "stagingEnabled": true, > "defaultCertifierId": "string", > "allowBulkCertify": true, > "allowPartialSignoff": true, > "remediationRule": "string", > "remediationDelay": 0, > "exceptionDuration": 0, > "enableForward": true, > "enableReassign": true, > "reassignPermissions": { > "certify": true, > "comment": true, > "exception": true, > "forward": true, > "reassign": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "selfCertificationRule": "all", > "assignmentNotification": "string", > "reassignNotification": "string", > "expirationNotification": "string", > "expirationNotificationDay": "string", > "reminderNotification": "string", > "reminderFrequency": 0, > "escalationNotification": "string", > "escalationFrequency": 0, > "escalationOwner": "string", > "excludeConditionalAccess": true, > "excludeRoleBasedAccess": true, > "includeChildOrganizations": true, > "parameters": [ > { > "id": "string", > "displayName": "string", > "path": "string" > } > ], > "templateEventType": "user", > "status": "active", > "scheduleId": "string", > "ownerInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "defaultCertifierInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "escalationOwnerInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string" > }, > "expirationReassigneeInfo": { > "id": "string", > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string", > "name": "string" > }, > "templateId": "string", > "startDate": "string", > "deadline": "string", > "completionDate": "string", > "completedBy": {}, > "expirationNotificationDate": "string", > "reminderNotificationDate": "string", > "escalationNotificationDate": "string", > "etlJobId": "string", > "systemMessages": { > "info": [ > {} > ], > "errors": [ > {} > ] > } > } > ] > ``` | | `/iga/governance/certification/items` | GET | Query the review items (tasks) that are assigned to you. Returns the certification tasks currently assigned to the signed-on end user.> **Collapse: Parameters** > > Name Description status string \* required Status of the certification campaign. The available values are active, expired, and complete.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "results": [ > { > "status": "in-progress", > "campaignId": "19cf170e-5dd8-4159-a467-c4f018f1a0c8", > "certifierId": "managed/user/f7089551-b8c6-402f-a4f7-5f8f0724ff30", > "startDate": "2024-11-19T17:52:30+00:00", > "deadline": "2024-12-03T17:52:30+00:00", > "campaignName": "Quarterly Review", > "totals": { > "in-progress": 53, > "total": 53 > }, > "progress": 0, > "certifier": { > "givenName": "Bernice", > "id": "f7089551-b8c6-402f-a4f7-5f8f0724ff30", > "mail": "Bernice@IGATestQA.onmicrosoft.com", > "sn": "Hablot", > "userName": "Bernice@IGATestQA.onmicrosoft.com", > "type": "user", > "key": "managed/user/f7089551-b8c6-402f-a4f7-5f8f0724ff30" > } > } > ], > "totalCount": 0 > } > ``` | | `/iga/governance/certification/{certId}/items` | GET | Returns the certification line items that belong to this campaign, filtered by parameters. Certifier sign-off is indicated by status. The certifier's decision is indicated by decision.> **Collapse: Parameters** > > Name Description certId string \* required ID of the certification campaign. targetId string ID of the target line item. \_pageSize string Number of response result to return. \_pageNumber string Number of response result to return. \_searchAfter string An alternative to pageNumber, corresponds to the searchAfterKey value sent in previous page's results. status string Status of the line item.The available values are in-progress, signed-off, pending, cancelled, and expired. decision string Decision taken on the line item. The available values are certify, revoke, exception, and abstain. ownerId string Owner ID of the line item. user string ID of the user the line items are certifying. resource string ID of the resource the line items are certifying. application string ID of the application the line items(s) are certifying. actorId string ID of any actor (certifier) in the line items actor list. primaryReviewerId string ID of the primary reviewer or certifier of the line items. user.userName string Username of the user the line items are certifying. itemType string Item type of the line item. The available values are Account Grant and Resource Grant. account string ID of the account the line items(s) are certifying. groupBy string Aggregates the results to allow the frontend to group line items. appendUserPermissions boolean Appends the logged in user permissions for each line item. Used by frontend. taskStatus string Task level alternative to status (which is item level). The available values are active, complete, closed, cancelled, and expired. getCount boolean If true, returns the line item count based on the query. isAdmin boolean If true and if the user has permission, returns the results as an admin.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 ID or value sent in parameters was not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "decision": { > "certification": { > "campaignId": "string", > "targetId": "string", > "status": "in-progress", > "decision": "certify", > "completionDate": "string", > "completedBy": {}, > "decisionDate": "string", > "decisionBy": {}, > "remediationDate": "string", > "remediated": true, > "remediationStatus": "pending", > "confidenceScore": 0, > "stageIndex": 0, > "deadline": "string", > "isExpired": true, > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": [ > { > "id": "string", > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true, > "certify": true, > "exception": true, > "forward": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string", > "name": "string" > } > ] > } > } > } > ], > "resultCount": 0, > "totalHits": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | | `/iga/governance/certification/{certId}/items/search` | POST | Returns the certification line items that belong to the specified campaign, filtered by parameters.> **Collapse: Parameters** > > Name Description certId string \* required ID of the certification campaign. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc and desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are: date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry from which to continue searching. Comma-separated for multiple values. appendUserPermissions boolean Appends the logged in user permissions for each line item. taskStatus string Task level status search. The available values are :\`active\`, complete, closed, cancelled, and expired.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "decision.certification.primaryReviewer.id", > "targetValue": "managed/user/c1147059-b6ab-4cf6-937c-b93202c6cec8" > } > }, > { > "operator": "EQUALS", > "operand": { > "targetName": "item.type", > "targetValue": "accountGrant" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 ID or value sent in parameters was not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "decision": { > "certification": { > "campaignId": "string", > "targetId": "string", > "status": "in-progress", > "decision": "certify", > "completionDate": "string", > "completedBy": {}, > "decisionDate": "string", > "decisionBy": {}, > "remediationDate": "string", > "remediated": true, > "remediationStatus": "pending", > "confidenceScore": 0, > "stageIndex": 0, > "deadline": "string", > "isExpired": true, > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": [ > { > "id": "string", > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true, > "certify": true, > "exception": true, > "forward": true, > "reset": true, > "revoke": true, > "signoff": true > }, > "userName": "string", > "mail": "string", > "givenName": "string", > "sn": "string", > "name": "string" > } > ] > } > } > } > ], > "resultCount": 0, > "totalCount": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | | `/iga/governance/certification/{certId}/items/{action}` | POST | Take action on line items.> **Collapse: Parameters** > > Name Description certId string \* required ID of the certification campaign. action string \* required The specific action to take. The available values are: certify, revoke, exception, comment, forward, and signoff. selectAllActorId string When provided, the action targets all decision items the given actor is the primary reviewer for. The IDs array can be left empty.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "ids": [ > "e9e4d260-1b55-4331-8468-5824344b8bc3", > "01d8ccf0-e132-49f1-9c82-c52a6fea0154" > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "string", > "idsNotActedOn": [ > "string" > ] > } > ``` | | `/iga/governance/certification/{certId}/items/{lineItemId}/{action}` | POST | Take action on a single line item.> **Collapse: Parameters** > > Name Description certId string \* required ID of the certification campaign. lineItemId string \* required ID of the line item. action string \* required The specific action to take. The available values are: certify, revoke, exception, comment, reassign, and forward.> **Collapse: Request body** > > Example: `certify` Media type: `application/json` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "string", > "idsNotActedOn": [ > "string" > ] > } > ``` | ### Access request In Identity Governance, end users can request access to resources. Resources are target applications, entitlements, or roles. You define which resources are requestable. Learn more in [access requests](../../administration/access-request-preface.html). | URI | HTTP method | Description | | --------------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/requests` | POST | Create or validate a new access request for a list of users. When you submit a new request for access, the system validates the request's contents. If no issues are found, IGA creates a request for each pairing of user and catalog items included in the request.You can choose to only validate the request by using the `validate` action. This action displays any errors in the current request payload without creating any requests.> **Collapse: Parameters** > > Name Description action string \* required Action to perform for the requests endpoint. The available values are create and validate. runPreventativeScan boolean Check whether the requested access violates any policies. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "users": [ > "52cf01b4-288e-4c21-aed6-f992be073988" > ], > "catalogs": [ > { > "type": "application", > "id": "ea412dc4804ae80e625fdd8f7b7521d9ae3f7cae30f2401cf8f3be43d985176843404f1022c44537edeedc0bf11b5e5a028082cc05a7d90843b882c7c4b5d988", > "data": {} > } > ], > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "expiryDate": "2023-09-05T12:00:00+00:00", > "priority": "low", > "justification": "I need this access to start working on a new project.", > "accessModifier": "add", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "requestIdPrefix": "REQ" > } > ```> **Collapse: Responses** > > Code Description 200 Success 400 Request error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > "f70b1565-8d42-4492-93dd-90173fa62635" > ], > "errors": [ > { > "error": "DUPLICATE", > "message": "Duplicate request already exists.", > "user": "e7c38019-844f-4b70-93d1-9bdbfa00f1da", > "requestId": "3cd52fdd-9725-411f-bcae-0f5f3254e24d", > "catalogId": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1" > } > ] > } > ``` | | `/iga/governance/requests/{requestTypeId}` | POST | Create request for the given request type.> **Collapse: Parameters** > > Name Description requestTypeId string \* required ID of the request type.> **Collapse: Request body** > > Payload for creating the request. Properties must match the request type schema definition. Media type: `application/json` > > ```json > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requests/{requestId}` | GET | Retrieve the details of a single access request using a unique identifier, `requestId`.> **Collapse: Parameters** > > Name Description requestId string \* required Unique identifier of the request. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Request can't be found> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requests/{requestId}` | PUT | Replace the content of a request. You can change only the properties that are defined in the request schema and not in the `nonModifiableProperties`.> **Collapse: Parameters** > > Name Description requestId string \* required Unique identifier of the request. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > The payload for replacing request content. Properties must match the request type schema definition of this request. Media type: `application/json` > > ```json > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requests/{requestId}` | PATCH | Update the contents of a request. You can update only properties that are defined in the request schema and not in the `nonModifiableProperties`.> **Collapse: Parameters** > > Name Description requestId string \* required Unique identifier of the request. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Payload for updating the request. Media type: `application/json` > > ```json > [ > { > "operation": "add", > "field": "/type", > "value": "string" > } > ] > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example** > > Media type: `application/json` > > ```json > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requests/{requestId}` | POST | Perform various actions on a specific request, such as `approve`, `reject`, `comment`, `cancel`, `update`, or `reassign`. Each action could have different payloads depending on the information the caller needs to provide.> **Collapse: Parameters** > > Name Description requestId string \* required Unique identifier of the request. phaseName string For approval task-specific actions. The name of the task that the action applies to. \_action string \* required Action to perform on a single request. The available values are cancel, approve, reject, comment, reassign, update, and modify. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Example: `modify` Media type: `application/json` > > ```json > { > "common": { > "priority": "low", > "justification": "Request justification", > "roleId": "3030d401-90f2-4219-82ea-4f71b3ed4abc", > "userId": "f5dcd246-92f6-4e32-a696-7ec3253cec16", > "externalRequestId": "237", > "isDraft": false > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid action 401 User isn't authorized to use this endpoint. 404 Request can't be found. | | `/iga/governance/requests/{requestId}/phases/{phaseName}` | PATCH | Update the phase properties of a specific phase in an access request (currently only events are supported).> **Collapse: Parameters** > > Name Description requestId string \* required Unique identifier of the request. phaseName string \* required For approval task-specific actions. The name of the task that the action applies to.> **Collapse: Request body** > > Example value: schema Media type: `application/json` > > ```json > { > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "view": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > }, > "scheduled": { > "date": "2025-06-27T12:00:00+00:00" > } > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Bad Request. Invalid payload. 404 Request or phase not found. 500 Internal server error. | | `/iga/governance/user/{userId}/requests` | GET | Get requests for which the authenticated user has permissions to view. For additional search capabilities, use the `POST /governance/user/{userId}/requests?_action=search` API.> **Collapse: Parameters** > > Name Description userId \* required Unique identifier of the user. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | | `/iga/governance/user/{userId}/requests` | POST | Get requests for which the authenticated user has permissions to view. The `targetFilter` property in the API payload can be used to filter the requests based on the desired criteria.> **Collapse: Parameters** > > Name Description \_action \* required Action to perform on user requests endpoint. The available value is search. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. actorStatus string Status of the approver to search on, for example, "active", "inactive". Active shows tasks that are currently assigned to the user, while inactive shows tasks that were assigned and have been completed. userId string \* required Unique identifier of the user. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "phases": [ > { > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | | `/iga/governance/user/{userId}/approvals` | POST | Get requests for which the authenticated user is assigned, either directly, through a role, or through a delegate. You can use the `targetFilter` property in the API payload to filter the requests based on the desired criteria.> **Collapse: Parameters** > > Name Description \_action \* required Action to perform on user requests endpoint. The available value is search. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. actorStatus string Status of the approver to search on, for example, "active", "inactive". Active shows tasks that are currently assigned to the user, while inactive shows tasks that were assigned and have been completed. userId string \* required Unique identifier of the user. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "phases": [ > { > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | ### Access request form Identity Governance enables administrators to create custom forms for users during request workflows. | URI | HTTP method | Description | | ---------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/requestForms` | GET | Search request forms.> **Collapse: Parameters** > > Name Description \_queryFilter string Search query filter. \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_pageSize integer Number of response result objects to return. \_sortKeys string Property on which to sort the results.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requestForms` | POST | Create a request form.> **Collapse: Parameters** > > No parameters> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requestForms/{id}` | GET | Get a request form by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the request form.> **Collapse: Responses** > > Code Description 200 OK 404 Request form not found> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requestForms/{id}` | PUT | Replace an existing request form by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the request form.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requestForms/{id}` | PATCH | Update an existing request form by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the request form.> **Collapse: Request body** > > Media type: `application/json` > > ```json > [ > { > "operation": "add", > "field": "/type", > "value": "string" > } > ] > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "type": "request", > "categories": { > "applicationType": "active.directory", > "objectType": "__ACCOUNT__", > "operation": "create" > }, > "form": {}, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/requestFormAssignments` | GET | Search the request form assignments.> **Collapse: Parameters** > > Name Description \_queryFilter string Search query filter. \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_pageSize integer Number of response result objects to return. \_sortKeys string Property on which to sort the results.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "objectId": "string", > "formId": "string" > } > ``` | | `/iga/governance/requestFormAssignments` | POST | Assign and unassign a request form.> **Collapse: Parameters** > > Name Description \_action string \* required Action to take. The available values are assign and unassign.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "objectId": "string", > "formId": "string" > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "objectId": "string", > "formId": "string" > } > ``` | ### Access request type | URI | HTTP method | Description | | ---------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/requestTypes` | GET | Get a list of supported request types.> **Collapse: Parameters** > > Name Description \_queryFilter string Search query filter. \_pageSize integer Number of response result objects to return. \_pageNumber string Page number of results to show. \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_sortBy string The property to sort by. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ] > ``` | | `/iga/governance/requestTypes` | POST | Create a new custom request type.> **Collapse: Parameters** > > No parameters> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Missing required properties> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ``` | | `/iga/governance/requestTypes/{requestTypeId}` | GET | Get a request type by ID.> **Collapse: Parameters** > > Name Description requestTypeId string \* required ID of the request type.> **Collapse: Responses** > > Code Description 200 OK 400 Request type ID not found> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ``` | | `/iga/governance/requestTypes/{requestTypeId}` | PUT | Replace an existing request type.> **Collapse: Parameters** > > Name Description requestTypeId string \* required ID of the request type.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Missing required properties> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ``` | | `/iga/governance/requestTypes/{requestTypeId}` | PATCH | Update an existing request type.> **Collapse: Parameters** > > Name Description requestTypeId string \* required ID of the request type.> **Collapse: Request body** > > Media type: `application/json` > > ```json > [ > { > "operation": "add", > "field": "/type", > "value": "string" > } > ] > ```> **Collapse: Responses** > > Code Description 200 OK 400 Missing required properties> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "schemas": { > "custom": [ > { > "_meta": { > "type": "string", > "displayName": "string", > "properties": {} > }, > "properties": {} > } > ] > } > } > ``` | | `/iga/governance/requestTypes/{requestTypeId}` | DELETE | Delete a request type.> **Collapse: Parameters** > > Name Description requestTypeId string \* required ID of the request type.> **Collapse: Responses** > > Code Description 200 OK 404 Request type ID not found | ### Account Accounts are user profiles in applications. For example, when you provision an end user to an application, the system creates an account for them. | URI | HTTP method | Description | | -------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/account` | GET | Retrieve all account objects across all applications that have been onboarded as part of any application.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 400 Request error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609", > "keys": { > "type": "accountGrant", > "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259", > "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3", > "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363" > }, > "account": { > "state": "PA", > "status": "3", > "isManager": "no", > "depName": "Human Resources", > "__UID__": "2014", > "phone": "555-1212", > "city": "Allentown", > "jobCode": "2002", > "address": "1234 Spruce St", > "__NAME__": "2014", > "uid": "2014", > "lastName": "Hart", > "firstName": "Jeremy", > "country": "US", > "depId": "200", > "email": "jhart@forgerock.com", > "empType": "1", > "postalCode": "12345", > "_id": "2014" > }, > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "descriptor": { > "idx": { > "/account": { > "displayName": "Example Account" > } > } > }, > "glossary": { > "idx": { > "/account": { > "accountType": "normal", > "accountStatus": "active" > }, > "/application": { > "requestable": true, > "classification": "internal" > } > } > }, > "item": { > "decision": { > "campaignId": "string", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "string", > "decision": "certify", > "decisionBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decisionDate": "string" > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 1, > "resultCount": 1 > } > ``` | | `/iga/governance/account` | POST | Retrieve all account objects across all applications that have been onboarded as part of any application. You can provide additional filter criteria to search by application, user, or glossary data.> **Collapse: Parameters** > > Name Description \_action \* required Action to perform on user requests endpoint. The available value is search. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Request error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609", > "keys": { > "type": "accountGrant", > "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259", > "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3", > "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363" > }, > "account": { > "state": "PA", > "status": "3", > "isManager": "no", > "depName": "Human Resources", > "__UID__": "2014", > "phone": "555-1212", > "city": "Allentown", > "jobCode": "2002", > "address": "1234 Spruce St", > "__NAME__": "2014", > "uid": "2014", > "lastName": "Hart", > "firstName": "Jeremy", > "country": "US", > "depId": "200", > "email": "jhart@forgerock.com", > "empType": "1", > "postalCode": "12345", > "_id": "2014" > }, > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "descriptor": { > "idx": { > "/account": { > "displayName": "Example Account" > } > } > }, > "glossary": { > "idx": { > "/account": { > "accountType": "normal", > "accountStatus": "active" > }, > "/application": { > "requestable": true, > "classification": "internal" > } > } > }, > "item": { > "decision": { > "campaignId": "string", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "string", > "decision": "certify", > "decisionBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decisionDate": "string" > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 1, > "resultCount": 1 > } > ``` | | `/iga/governance/account/{accountId}` | GET | Retrieve by details of a single account object using its unique identifier.> **Collapse: Parameters** > > Name Description accountId string \* required Unique identifier of the account to get. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Request can't be found.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609", > "keys": { > "type": "accountGrant", > "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259", > "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3", > "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363" > }, > "account": { > "state": "PA", > "status": "3", > "isManager": "no", > "depName": "Human Resources", > "__UID__": "2014", > "phone": "555-1212", > "city": "Allentown", > "jobCode": "2002", > "address": "1234 Spruce St", > "__NAME__": "2014", > "uid": "2014", > "lastName": "Hart", > "firstName": "Jeremy", > "country": "US", > "depId": "200", > "email": "jhart@forgerock.com", > "empType": "1", > "postalCode": "12345", > "_id": "2014" > }, > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "descriptor": { > "idx": { > "/account": { > "displayName": "Example Account" > } > } > }, > "glossary": { > "idx": { > "/account": { > "accountType": "normal", > "accountStatus": "active" > }, > "/application": { > "requestable": true, > "classification": "internal" > } > } > }, > "item": { > "decision": { > "campaignId": "string", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "string", > "decision": "certify", > "decisionBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decisionDate": "string" > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ``` | | `/iga/governance/account/{accountId}` | DELETE | Delete a single account object using its unique identifier.> **Collapse: Parameters** > > Name Description accountId string \* required Unique identifier of the account to get. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Request can't be found. 500 Internal server error.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Account with id {:id} deleted successfully." > } > ``` | | `/iga/governance/account/{accountId}/entitlements` | GET | Search for the entitlements of a single account object using its unique identifier.> **Collapse: Parameters** > > Name Description accountId string \* required Unique identifier of the account to get. \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 400 Request error 404 Account couldn't be found.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "application": { > "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-819546", > "authoritative": false, > "connectorId": "TargetApp", > "description": "Testing 3", > "fr": { > "realm": "alpha" > }, > "icon": "https://img.freepik.com/free-vector/vector-logo-unique-letter-e-colorful-gradient-design-illustration_474888-2292.jpg", > "id": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "name": "TargetApp", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "Department", > "accountAttribute": "department" > }, > { > "name": "Company", > "accountAttribute": "company" > }, > { > "name": "User" > }, > { > "name": "CostCenter", > "accountAttribute": "costCenter" > }, > { > "name": "Location", > "accountAttribute": "location" > } > ], > "templateName": "servicenow", > "templateVersion": "3.3" > }, > "applicationOwner": [ > { > "id": "d09f3dda-bd62-4c73-95fa-b1cb8daa438e", > "userName": "fyork", > "givenName": "Frank", > "sn": "York", > "mail": "fyork@example.com" > } > ], > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "tracked_file_reader" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "16ccd5fee802121087debb3e47d14fbf", > "grantable": true, > "description": "Read role for tracked configuration files", > "sys_name": "tracked_file_reader", > "sys_scope": "global", > "__NAME__": "80b4cd57c3013300daa79624a1d3aea1", > "elevated_privilege": false, > "_id": "80b4cd57c3013300daa79624a1d3aea1", > "sys_class_name": "sys_user_role" > }, > "entitlementOwner": [ > { > "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "userName": "christian.marnell", > "givenName": "Christian", > "sn": "Marnell", > "mail": "christian.marnell@example.com" > } > ], > "glossary": { > "idx": { > "/entitlement": { > "complianceObjective": "HIPAA", > "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "lob": "Finance", > "requestable": true > }, > "/application": { > "requestable": true > } > } > }, > "id": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1", > "item": { > "type": "entitlementGrant", > "objectType": "Role" > }, > "permissions": { > "modifyEntitlement": true, > "viewGrants": true > }, > "metadata": { > "modifiedDate": "2025-01-29T14:33:09.168Z", > "createdDate": "2025-01-22T18:15:48.763702117Z" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 1, > "resultCount": 1 > } > ``` | | `/iga/governance/account/{accountId}/glossary` | GET | Retrieve the glossary-specific details of a single account object using its unique identifier.> **Collapse: Parameters** > > Name Description accountId string \* required Unique identifier of the account to get. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Request can't be found.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "accountType": "normal", > "accountStatus": "active" > } > ``` | | `/iga/governance/account/{accountId}/glossary` | POST | Create glossary entry for a single account object using its unique identifier.> **Collapse: Parameters** > > Name Description accountId string \* required Unique identifier of the account to get. \_action string \* required Action to perform on user requests endpoint. The available value is create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "accountType": "normal", > "accountStatus": "active" > } > ```> **Collapse: Responses** > > Code Description 200 Success. 400 Request error.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "accountType": "normal", > "accountStatus": "active" > } > ``` | | `/iga/governance/account/{accountId}/glossary` | PUT | Create or update a glossary entry for a single account object using its unique identifier.> **Collapse: Parameters** > > Name Description accountId string \* required Unique identifier of the account to get. \_action string \* required Action to perform on user requests endpoint. The available value is create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "accountType": "normal", > "accountStatus": "active" > } > ```> **Collapse: Responses** > > Code Description 200 Success. 400 Request error.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "accountType": "normal", > "accountStatus": "active" > } > ``` | ### Audit Endpoints associated with IDM's audit functionality. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | To use the `iga/governance/workflow` and `iga/governance/audit` endpoints, your authorization token must have the following scope:`fr:idc:analytics.*`This is a temporary requirement and will be removed in a future release. | | URI | HTTP method | Description | | ------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/audit` | GET | Get audit reports.> **Collapse: Parameters** > > Name Description objectId string ID of the object to retrieve the report. startDate First date to include in the report. endDate string Last date to include in the report. actor string Actor associated with the audit events. objectType string Type of object involved in the audit events. eventType string Type of event to filter by. action string Type of action to filter by. pageSize integer Number of results per page (default is 20). order string Order of results. The available values are asc and desc (default is desc). page integer Page number for pagination. searchAfter string A JSON-encoded array for deep pagination. Example: \[1742976841833].> **Collapse: Responses** > > Code Description 200 OK 400 Bad request 500 Internal service error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "actor": "string", > "eventType": "string", > "objectId": "string", > "objectType": "string", > "action": "string", > "timestamp": "2025-04-19T10:54:08.584Z", > "changes": [ > { > "after_value": "string", > "field_name": "string" > } > ], > "metadata": { > "modifiedDate": "2025-04-19T10:54:08.585Z", > "createdDate": "2025-04-19T10:54:08.585Z" > } > } > ], > "resultCount": 0, > "totalCount": 0, > "pagination": { > "page": 0, > "pageSize": 0, > "totalPages": 0, > "searchAfter": [ > 0 > ] > } > } > ``` | | `/iga/governance/user/{userId}/audit` | GET | Get the audit reports for a given user.> **Collapse: Parameters** > > Name Description userId string \* string ID of the user to retrieve the report. queryId Required parameter for pagination. Use the value from previous response. dataSetId string Required parameter for pagination. Use the value from previous response. pagedResultCookie string Used for pagination of results.> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Job not found 500 Server error> **Collapse: Click for an example response** > > endDate string (query) Last date to include in the report > > ```json > { > "result": [ > { > "actor": "string", > "eventType": "string", > "objectId": "string", > "action": "string", > "timestamp": "string", > "changes": [ > { > "after_value": "New City", > "before_value": "Old City", > "field_name": "city" > } > ] > } > ], > "resultCount": 0, > "totalCount": 0, > "queryId": "string", > "dataSetId": "string", > "pageToken": "string" > } > ``` | ### Catalog The Catalog endpoint provides a list of requestable access items. The supported types of requestable access are `application`, `entitlement`, and `role`. | URI | HTTP method | Description | | -------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `/iga/governance/catalog` | GET | Get a list of items from the Identity Governance access catalog. Each entry represents a single type of requestable access that can be added to a request. The supported types of requestable access are `application`, `entitlement`, and `role`.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. \_ignoreRequestable string For admin use: allow admin to view catalog items not marked as requestable when set to true. userId string For admin use: when provided, returns the scoped catalog access that matches the given user ID. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Example: `application` Media type: `application/json` > > ```json > { > "id": "26f2bd6b-3d23-4fbb-92f7-9aecd0183852", > "item": { > "type": "accountGrant" > }, > "application": { > "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-50136", > "authoritative": true, > "connectorId": "AzureADAuth1", > "description": "AD Auth App1", > "fr": { > "realm": "alpha" > }, > "icon": "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "26f2bd6b-3d23-4fbb-92f7-9aecd0183852", > "mappingNames": [ > "systemAzureadauth1User_managedAlpha_user" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-06-09T15:01:49.259Z" > }, > "name": "AzureADAuth1", > "templateName": "azure.ad", > "templateVersion": "2.0" > }, > "applicationOwner": [ > { > "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944", > "accountStatus": "active", > "cn": "iga admin", > "fr": { > "realm": "alpha" > }, > "givenName": "iga", > "id": "b409de90-dc24-42ee-b315-7e133c7cfaca", > "mail": "iga-admin@fr.net", > "metadata": { > "entityType": "/openidm/managed/user", > "created": "2023-06-08T23:02:15.385Z" > }, > "sn": "admin", > "userName": "iga-admin" > } > ] > } > ``` | | `/iga/governance/catalog` | POST | Get a list of items from the Identity Governance access catalog using additional filter criteria. Each entry represents a single type of requestable access that can be added to a request. The supported types of requestable access are `application`, `entitlement`, and `role`.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. \_ignoreRequestable string For admin use: allow admin to view catalog items not marked as requestable when set to true. userId string For admin use: when provided, returns the scoped catalog access that matches the given user ID. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4", > "item": { > "type": "entitlementGrant" > }, > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "Directory Readers" > } > } > }, > "glossary": { > "idx": { > "/entitlement": { > "requestable": true > } > } > }, > "entitlement": { > "_id": "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4", > "description": "Can read basic directory information. Commonly used to grant directory read access to applications and guests.", > "displayName": "Directory Readers" > }, > "assignment": { > "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-72216", > "attributes": [ > { > "name": "__roles__", > "value": [ > "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4" > ] > } > ], > "description": "Can read basic directory information. Commonly used to grant directory read access to applications and guests.", > "fr": { > "realm": "alpha" > }, > "id": "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4", > "mapping": "managedAlpha_user_systemTargetadapp2User", > "metadata": { > "entityType": "/openidm/managed/assignment", > "created": "2023-06-09T22:09:42.877Z" > }, > "name": "Directory Readers", > "type": "__ENTITLEMENT__" > }, > "application": { > "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-67718", > "authoritative": false, > "connectorId": "TargetADApp2", > "description": "Target AD App2", > "fr": { > "realm": "alpha" > }, > "icon": "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a4e54fcb-9088-4d42-bb4a-138d69b2486e", > "mappingNames": [ > "systemTargetadapp2User_managedAlpha_user", > "systemTargetadapp2Directoryrole_managedAlpha_assignment", > "systemTargetadapp2__group___managedAlpha_assignment", > "managedAlpha_user_systemTargetadapp2User" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-06-09T20:43:57.74Z" > }, > "name": "TargetADApp2", > "ssoIdentities": { > "oidcId": "TargetADApp2" > }, > "templateName": "azure.ad", > "templateVersion": "2.0" > }, > "applicationOwner": [ > { > "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944", > "accountStatus": "active", > "cn": "iga admin", > "fr": { > "realm": "alpha" > }, > "givenName": "iga", > "id": "b409de90-dc24-42ee-b315-7e133c7cfaca", > "mail": "iga-admin@fr.net", > "metadata": { > "entityType": "/openidm/managed/user", > "created": "2023-06-08T23:02:15.385Z" > }, > "sn": "admin", > "userName": "iga-admin" > } > ], > "metadata": { > "firstCreated": "2024-01-11T12:00:00+00:00", > "created": "2024-04-24T12:00:00+00:00" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 1, > "resultCount": 1 > } > ``` | | `/iga/governance/search/schema` | GET | Retrieve all configured properties eligible to be used for search or sort when searching against the catalog API. Each property includes additional metadata about the property, such as its datatype and whether it's multivalued.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 201 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "application": [ > { > "key": "application.description", > "name": "description", > "displayName": "Description", > "description": "Application Description", > "type": "string", > "isMultiValue": false > }, > { > "key": "application.name", > "name": "name", > "displayName": "Name", > "description": "Application name", > "type": "string", > "isMultiValue": false > } > ], > "entitlement": [ > { > "key": "glossary.idx./entitlement.description", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": null, > "searchable": true, > "isInternal": true, > "displayName": "Description", > "name": "description", > "description": "Description of entitlement", > "objectType": "/openidm/managed/assignment", > "type": "string" > }, > { > "key": "entitlement.displayName", > "name": "displayName", > "displayName": "Display Name", > "description": "", > "type": "text", > "isMultiValue": false > }, > { > "key": "glossary.idx./entitlement.entitlementOwner", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": "/openidm/managed/user", > "searchable": true, > "isInternal": true, > "displayName": "Entitlement Owner", > "name": "entitlementOwner", > "description": "Entitlement Owner of Object", > "objectType": "/openidm/managed/assignment", > "type": "managedObject" > }, > { > "key": "glossary.idx./entitlement.requestable", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": null, > "searchable": true, > "isInternal": true, > "displayName": "Requestable", > "name": "requestable", > "description": "Can the entitlement be requested", > "objectType": "/openidm/managed/assignment", > "type": "boolean" > } > ], > "role": [ > { > "key": "role.applications._ref", > "name": "applications", > "displayName": "Applications", > "description": "Role Applications", > "type": "managedObject", > "isMultiValue": true, > "managedObjectType": "/openidm/managed/alpha_application" > }, > { > "key": "role.description", > "name": "description", > "displayName": "Description", > "description": "The role description, used for display purposes.", > "type": "string", > "isMultiValue": false > }, > { > "key": "role.id", > "name": "_id", > "displayName": "Name", > "description": "Role ID", > "type": "string", > "isMultiValue": false > }, > { > "key": "role.name", > "name": "name", > "displayName": "Name", > "description": "The role name, used for display purposes.", > "type": "string", > "isMultiValue": false > }, > { > "key": "glossary.idx./role.requestable", > "allowedValues": [], > "isIndexed": true, > "isMultiValue": false, > "managedObjectType": null, > "searchable": true, > "isInternal": true, > "displayName": "Requestable", > "name": "requestable", > "description": "Can the role be requested", > "objectType": "/openidm/managed/role", > "type": "boolean" > }, > { > "key": "role.members._ref", > "name": "members", > "displayName": "Role Members", > "description": "Role Members", > "type": "managedObject", > "isMultiValue": true, > "managedObjectType": "/openidm/managed/alpha_user" > } > ] > } > ``` | | `/iga/governance/search/schema/{objectType}` | GET | Retrieve all configured properties eligible for search or sort for a single object when searching against the catalog API. For example, you can use the endpoint to search for all specific entitlement properties. Each property includes additional metadata about the property, such as whether it is multivalued or not and its datatype.> **Collapse: Parameters** > > Name Description objectType string \* required Type of object involved in the audit events. The available values are application, entitlement, and role. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "key": "application.description", > "name": "description", > "displayName": "Description", > "description": "Application Description", > "type": "string", > "isMultiValue": false > }, > { > "key": "application.name", > "name": "name", > "displayName": "Name", > "description": "Application name", > "type": "string", > "isMultiValue": false > } > ] > ``` | ### Config Identity Governance has overarching configurations, such as requiring a justification when rejecting an access request. | URI | HTTP method | Description | | ----------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/commons/config` | GET | Reads and returns all Identity Governance configuration properties across all categories.Only access request-related properties are available. For example, access request features contain configuration on whether justification is required to reject a request or whether a user can approve their own access.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 IGA configuration settings can't be read.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "iga_access_request": { > "requireRequestJustification": true, > "requireRejectJustification": true, > "requireApproveJustification": true, > "preventRequestWithViolation": true, > "requireRequestJustificationWithViolation": true, > "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4", > "allowSelfApproval": true > }, > "iga_global": { > "enableScoping": false > }, > "iga_autoid_integration": { > "enableAutoId": true, > "highScorePercentThreshold": 0, > "mediumScorePercentThreshold": 0, > "lowScorePercentThreshold": 0, > "training_features_filter": [ > "user.managerId" > ] > }, > "iga_ui_config": {} > } > ``` | | `/commons/config` | PUT | Update all Identity Governance configuration properties across all categories. Only access request-related properties are available. You must include all current configurations when saving changes, Identity Governance replaces any omitted keys with default values.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "iga_access_request": { > "requireRequestJustification": true, > "requireRejectJustification": true, > "requireApproveJustification": true, > "preventRequestWithViolation": true, > "requireRequestJustificationWithViolation": true, > "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4", > "allowSelfApproval": true > }, > "iga_global": { > "enableScoping": false > }, > "iga_autoid_integration": { > "enableAutoId": true, > "highScorePercentThreshold": 0, > "mediumScorePercentThreshold": 0, > "lowScorePercentThreshold": 0, > "training_features_filter": [ > "user.managerId" > ] > }, > "iga_ui_config": {} > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid settings or error saving. 401 User isn't authorized to use this endpoint.> **Collapse: Click for an example response** > > ```json > { > "iga_access_request": { > "requireRequestJustification": true, > "requireRejectJustification": true, > "requireApproveJustification": true, > "preventRequestWithViolation": true, > "requireRequestJustificationWithViolation": true, > "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4", > "allowSelfApproval": true > }, > "iga_global": { > "enableScoping": false > }, > "iga_autoid_integration": { > "enableAutoId": true, > "highScorePercentThreshold": 0, > "mediumScorePercentThreshold": 0, > "lowScorePercentThreshold": 0, > "training_features_filter": [ > "user.managerId" > ] > }, > "iga_ui_config": {} > } > ``` | | `/commons/config/{key}` | GET | Get Identity Governance configuration settings for a given category (for example, `iga_access_request`).> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API processes the request. key string \* required  > **Collapse: Responses** > > Code Description 200 OK 400 IGA configuration settings can't be read> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "requireRequestJustification": true, > "requireRejectJustification": true, > "requireApproveJustification": true, > "preventRequestWithViolation": true, > "requireRequestJustificationWithViolation": true, > "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4", > "allowSelfApproval": true > } > ``` | | `/commons/config/{key}` | PUT | Update Identity Governance configuration settings for a given category (for example, `iga_access_request`).> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API processes the request. key string \* required  > **Collapse: Request body** > > Example: `iga_access_request` Media type: `application/json` > > ```json > { > "requireRequestJustification": true, > "requireRejectJustification": true, > "requireApproveJustification": true, > "preventRequestWithViolation": true, > "requireRequestJustificationWithViolation": true, > "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4", > "allowSelfApproval": true > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid settings or error saving. 401 User isn't authorized to use this endpoint> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "requireRequestJustification": true, > "requireRejectJustification": true, > "requireApproveJustification": true, > "preventRequestWithViolation": true, > "requireRequestJustificationWithViolation": true, > "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4", > "allowSelfApproval": true > } > ``` | ### Entitlement All users can access the query entitlements endpoint, but the system filters the results they see based on their granted authorizations. For example, administrators can see all entitlements. An application owner can see all entitlements that belong to their applications but not other applications' entitlements. An entitlement owner of three entitlements can see the entitlements that they own. A user who has been scoped permissions to view or act on a subset of entitlements can access that subset. This endpoint also supports all standard pagination and query filtering abilities of other search APIs. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Every entitlement object in Identity Governance now includes an additional property at the `item.objectType` path. This attribute stores the object type of the entitlement and can be used in searching and filtering options. | | URI | HTTP method | Description | | ------------------------------------------------------ | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/entitlement` | GET | Search for all entitlements provided by the query parameters.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter> **Collapse: Responses** > > Code Description 200 OK 400 Error with request 500 Server error> **Collapse: Click for an example to query entitlements** > > Media type: `application/json` > > ```json > GET iga/governance/entitlement?_pageSize=10&_queryFilter=true > { > "result": [ > { > "application": { > "authoritative": false, > "connectorId": "SNOW", > "description": "Sanjay's SNOW", > "icon": "", > "id": "e35d09cd-2b9b-41bc-8246-dc23d4a36502", > "name": "SNOW", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "Department", > "accountAttribute": "department" > }, > { > "name": "Company", > "accountAttribute": "company" > }, > { > "name": "User" > }, > { > "name": "CostCenter", > "accountAttribute": "costCenter" > }, > { > "name": "Location", > "accountAttribute": "location" > } > ], > "templateName": "servicenow", > "templateVersion": "3.3" > }, > "applicationOwner": [ > { > "id": "75982e79-40dc-4ad2-8b85-abe1ebd2e2b9", > "userName": "fyork", > "givenName": "Frank", > "sn": "York", > "mail": "fyork@example.com" > } > ], > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "web_analytics_viewer" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "3b5ad2be150022104f3415f71eacd930", > "grantable": true, > "sys_name": "web_analytics_viewer", > "description": "Web Analytics Viewer", > "sys_scope": "global", > "__NAME__": "0a7f57c053101010d69cddeeff7b12b7", > "elevated_privilege": false, > "_id": "0a7f57c053101010d69cddeeff7b12b7", > "sys_class_name": "sys_user_role" > }, > "glossary": { > "idx": { > "/application": { > "num": 0 > } > } > }, > "id": "system_SNOW_Role_0a7f57c053101010d69cddeeff7b12b7", > "item": { > "type": "entitlementGrant", > "objectType": "Role", > "accountAttribute": "__user_role_ids__" > }, > "metadata": { > "modifiedDate": "2025-04-23T17:30:52.031Z", > "createdDate": "2025-03-24T16:35:34.005468359Z" > }, > "permissions": { > "modifyEntitlement": true, > "viewGrants": true > } > } > ], > "searchAfterKey": [ > "10240914227d6fbbd85000df72f39d812975f30825f1eb4bf847c1a222fc7a96c58baffb7a31fbf0eee6e40ab3add5f73c87d2e7ead7915e06daec7cd2311d18" > ], > "totalCount": 400, > "resultCount": 1 > } > ``` An important part of the response is the permissions key. This key provides additional details for each entitlement in the list, indicating the specific permissions the authorized user has been granted. This allows the UI and other API consumers to understand what actions the user is allowed to perform. | | `/iga/governance/entitlement` | POST | Create a new entitlement.Users can submit a request using the `Create Entitlement` request type. The request type accepts four properties when submitting a new request, all under the `entitlement` key payload:- `applicationID`: type string. Displays the application ID to which the entitlement belongs. - `objectType`: type string. Displays the object type of the entitlement (for example, `GROUP`). - `object`: type object. Displays the contents of the entitlement that follows the object type schema as defined in the application. - `glossary`: type object. Displays the contents of the entitlement's glossary data, if present.This endpoint creates the entitlement in the target system, creates the associated entry (if required), and ensures the entitlement is available in Identity Governance.> **Collapse: Parameters** > > Name Description \_action string \* required Action to perform on a single request. The available value is create.> **Collapse: Request body** > > Example: `create` Media type: `application/json` > > ```json > { > "applicationId": "7174f301-dc29-4cbe-bf95-a1cba356fc6c", > "objectType": "__GROUP__", > "object": { > "description": "HR Approvers", > "displayName": "HR Approvers", > "id": "8989f1f4-1518-49bf-8a45-7a84d3c6b17f", > "mailEnabled": false, > "proxyAddresses": [], > "securityEnabled": true > }, > "glossary": { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Entitlement not found 500 Server error> **Collapse: Click for an example to submit a Create entitlement request** > > Media type: `application/json` > > ```json > POST iga/governance/requests/createEntitlement?_action=publish > { > "common": { > "justification": "Need to create this new entitlement" > }, > "entitlement": { > "objectType": "Role", > "applicationId": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "object": { > "can_delegate": true, > "sys_package": "b1c465bee8c2121087debb3e47d14f22", > "grantable": true, > "sys_name": "entitlement_lcm_role", > "description": "Entitlement Demo Role 333", > "sys_scope": "global", > "elevated_privilege": false, > "sys_class_name": "sys_user_role" > }, > "glossary": { > "requestable": true, > "entitlementOwner": "managed/user/8d24a6ff-bd37-4e49-bbb6-52168bf2a69c" > } > } > } > ``` By default, the workflow for Create Entitlement is set to the out-of-the-box example workflow, CreateEntitlement. After the workflow's approval process is completed, it calls the Identity Governance API directly creating the entitlement within a scripted task. | | `/iga/governance/entitlement/{id}` | GET | Return a single entitlement object by ID. Reading an entitlement specifically by ID returns the full object type scheme under the entitlement key. For normal query use cases, the entitlement key only shows the keys that have actual values persisted. For get entitlement by ID, the response has all object type schema keys present. If no value is stored, the keys display a null value.> **Collapse: Parameters** > > Name Description id string \* required ID of the entitlement> **Collapse: Responses** > > Code Description 200 OK 404 Entitlement not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "application": { > "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-819546", > "authoritative": false, > "connectorId": "TargetApp", > "description": "Testing 3", > "fr": { > "realm": "alpha" > }, > "icon": "https://img.freepik.com/free-vector/vector-logo-unique-letter-e-colorful-gradient-design-illustration_474888-2292.jpg", > "id": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "name": "TargetApp", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "Department", > "accountAttribute": "department" > }, > { > "name": "Company", > "accountAttribute": "company" > }, > { > "name": "User" > }, > { > "name": "CostCenter", > "accountAttribute": "costCenter" > }, > { > "name": "Location", > "accountAttribute": "location" > } > ], > "templateName": "servicenow", > "templateVersion": "3.3" > }, > "applicationOwner": [ > { > "id": "d09f3dda-bd62-4c73-95fa-b1cb8daa438e", > "userName": "fyork", > "givenName": "Frank", > "sn": "York", > "mail": "fyork@example.com" > } > ], > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "tracked_file_reader" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "16ccd5fee802121087debb3e47d14fbf", > "grantable": true, > "description": "Read role for tracked configuration files", > "sys_name": "tracked_file_reader", > "sys_scope": "global", > "__NAME__": "80b4cd57c3013300daa79624a1d3aea1", > "elevated_privilege": false, > "_id": "80b4cd57c3013300daa79624a1d3aea1", > "sys_class_name": "sys_user_role" > }, > "entitlementOwner": [ > { > "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "userName": "christian.marnell", > "givenName": "Christian", > "sn": "Marnell", > "mail": "christian.marnell@example.com" > } > ], > "glossary": { > "idx": { > "/entitlement": { > "complianceObjective": "HIPAA", > "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "lob": "Finance", > "requestable": true > }, > "/application": { > "requestable": true > } > } > }, > "id": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1", > "item": { > "type": "entitlementGrant", > "objectType": "Role" > }, > "permissions": { > "modifyEntitlement": true, > "viewGrants": true > }, > "metadata": { > "modifiedDate": "2025-01-29T14:33:09.168Z", > "createdDate": "2025-01-22T18:15:48.763702117Z" > } > } > ``` | | `/iga/governance/entitlement/{id}` | PUT | Modify an existing entitlement.Users can submit a request using the `Modify Entitlement` request type. The request type accepts three properties when submitting a new request, all under the `entitlement` key payload. The endpoint takes the `entitlementId` for the existing entitlement:- `object`: type object. Displays the contents of the entitlement that follows the object type schema as defined in the application. - `glossary`: type object. Displays the contents of the entitlement's glossary data, if present. To modify an entitlement, you must include the full technical and glossary details in the request API call, as the entire object provided is used as the contents.> **Collapse: Parameters** > > Name Description id string \* required ID of the entitlement> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "object": { > "description": "HR Approvers", > "displayName": "HR Approvers", > "id": "8989f1f4-1518-49bf-8a45-7a84d3c6b17f", > "mailEnabled": false, > "proxyAddresses": [], > "securityEnabled": true > }, > "glossary": { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Entitlement not found 500 Server error> **Collapse: Click for an example to submit a Modify entitlement request** > > Media type: `application/json` > > ```json > POST iga/governance/requests/modifyEntitlement?_action=publish > { > "common": { > "justification": "Need to modify this entitlement" > }, > "entitlement": { > "entitlementId": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1", > "object": { > "can_delegate": true, > "sys_package": "b1c465bee8c2121087debb3e47d14f22", > "grantable": true, > "sys_name": "entitlement_lcm_role", > "description": "Entitlement Demo Role 333", > "sys_scope": "global", > "elevated_privilege": false, > "sys_class_name": "sys_user_role" > }, > "glossary": { > "requestable": true, > "entitlementOwner": "managed/user/8d24a6ff-bd37-4e49-bbb6-52168bf2a69c" > } > } > } > ``` By default, the workflow for the Create Entitlement is set to the out-of-the-box example workflow, CreateEntitlement. After the workflow's approval process is completed, it calls the Identity Governance modify API directly using the entitlementId, object, and glossary contents in the payload.> **Collapse: Click for an example to modify an entitlement directly** > > Media type: `application/json` > > ```json > PUT iga/governance/entitlement/\{entitlementId} (example: system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1) > { > "object": { > "can_delegate": true, > "sys_package": "b1c465bee8c2121087debb3e47d14f22", > "grantable": true, > "sys_name": "entitlement_lcm_role", > "description": "Entitlement Demo Role 333", > "sys_scope": "global", > "elevated_privilege": false, > "sys_class_name": "sys_user_role" > }, > "glossary": { > "requestable": true, > "entitlementOwner": "managed/user/8d24a6ff-bd37-4e49-bbb6-52168bf2a69c" > } > } > ``` | | `/iga/governance/entitlement/{id}/grants` | GET | Returns the entitlement grants for the given entitlement ID.Users who have the permissions can view the users who are currently granted a given entitlement. Administrators, application owners, and entitlement owners are granted this privilege implicitly. You can also scope additional end users to have this permission.> **Collapse: Parameters** > > Name Description id string \* required ID of the entitlement. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example to view grants** > > Media type: `application/json` > > ```json > GET iga/governance/entitlement/\{entitlementId}/grants?_pageSize=10&_queryFilter=true > { > "result": [ > { > "account": { > "calendar_integration": "1", > "user_name": "guillermo.frohich", > "sys_updated_on": "2025-01-02 21:29:47", > "__user_group_ids__": [ > "0a52d3dcd7011200f2d224837e6103f2" > ], > "title": "Chief Financial Officer", > "sys_class_name": "sys_user", > "notification": "2", > "sys_updated_by": "developer.program.hop@snc", > "sys_created_on": "2024-11-30 15:04:03", > "sys_domain": "global", > "__NAME__": "62526fa1d701120035ae23c7ce6103c6", > "vip": false, > "department": "221f3db5c6112284009f4becd3039cc9", > "first_name": "Guillermo", > "sys_created_by": "admin", > "email": "guillermo.frohlich@example.com", > "__user_role_ids__": [ > "cc6f85b5ebc31300a210a2505206fec0", > "45af8773d7002200c1ed0fbc5e61037a", > "20d2eaa35320330030c3ddeeff7b1213", > "ba4509c60a00070400cc0f3a60a0d30a", > "a47f56c15310330030c3ddeeff7b1295", > "7423767053ef0010763eddeeff7b12c0", > "408934d18733320025fbd1a936cb0b88", > "d18b9793c0a80a6b00ac0456923a1c0f", > "fc32695d73e3a410960c6039faf6a7f1", > "b523f1d037001300a213a7f07e41f15b", > "8536f54bc713330072b211d4d8c26080", > "6d3c40d33b981300ad3cc9bb34efc415", > "b3dd3ccec32203003e76741e81d3ae95", > "959c82e3535201109ea3ddeeff7b1227", > "d8e675e8532323008ef67c2c0fc587f6", > "ceb92b8153c833004558ddeeff7b12df", > "a731753ee886121087debb3e47d14f00", > "260c203a870033000e56d61e36cb0bbc", > "20803f15870033000e56d61e36cb0b7d", > "64c3259d73e3a410960c6039faf6a7d6", > "edd0b83353520110610bddeeff7b12e8", > "f98446040f103300402c6b198b767e1e", > "3bf8d5b65344130084acddeeff7b122b", > "f3feb8a577831010d7159b71a9106123", > "80b4cd57c3013300daa79624a1d3aea1", > "0956f6390a0a0bc50064623d5d51c556", > "14fa2dc39f230200ee6219eb552e7006", > "3c4bc8f5534330108e4dddeeff7b12a7", > "0d6c490a3b2010108ed00d8044efc40e", > "ca27b5e8532323008ef67c2c0fc5879c", > "f13ae18b3bc63300c869c2c703efc418", > "a5d7367c5b5320104db40a8a3d81c771", > "ab250967b31213005e3de13516a8dc26", > "71cb2cf2530033004558ddeeff7b126a", > "e776c6af531201109ea3ddeeff7b12aa", > "553b1f166723220097eeff5557415a6a", > "89d4c6040f103300402c6b198b767e3c", > "c627309e53722010af64ddeeff7b1232", > "282bf1fac6112285017366cb5f867469", > "1bc156f3771000101ecaff046910619e", > "8a454be00a0a0b8c00de7dae26869165" > ], > "locked_out": "false", > "sys_mod_count": "3", > "active": "true", > "last_name": "Frohlich", > "time_zone": "Europe/London", > "name": "Guillermo Frohlich", > "_id": "62526fa1d701120035ae23c7ce6103c6" > }, > "application": { > "name": "TargetApp", > "description": "Testing 3", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "Department", > "accountAttribute": "department" > }, > { > "name": "Company", > "accountAttribute": "company" > }, > { > "name": "User" > }, > { > "name": "CostCenter", > "accountAttribute": "costCenter" > }, > { > "name": "Location", > "accountAttribute": "location" > } > ] > }, > "catalog": { > "id": "1195eadf8cf40105f2c91976f32834b31bfdb1661e8c8680b7d7f59c27f9978dedd53b8171237ff6d056c79b6e77679ccc1da21ec611b3ac6c6d4ffda5e90827" > }, > "compositeId": "ae4dc3705eab9887753a2b6027748979d789ffc4b34cb28872613600764c75d74dad6802db54f3841cc7341c9a0c1b7a61eb25cf3d99f4d9b6161ed422330b96", > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "tracked_file_reader" > }, > "/account": { > "displayName": "guillermo.frohich" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "16ccd5fee802121087debb3e47d14fbf", > "grantable": true, > "description": "Read role for tracked configuration files", > "sys_name": "tracked_file_reader", > "sys_scope": "global", > "__NAME__": "80b4cd57c3013300daa79624a1d3aea1", > "elevated_privilege": false, > "_id": "80b4cd57c3013300daa79624a1d3aea1", > "sys_class_name": "sys_user_role" > }, > "glossary": { > "idx": { > "/entitlement": { > "complianceObjective": [ > "HIPAA", > "test" > ], > "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "lob": "Finance", > "multiUser": "managed/user/95648547-febc-4757-9b31-7b24fe36db24", > "requestable": true > }, > "/application": { > "requestable": true > } > }, > "types": [ > { > "attrKey": "/assignment", > "modified": "2025-02-07T17:58:12.384Z", > "type": "entityType/id/realm" > }, > { > "attrKey": "/application", > "modified": "2025-02-03T22:08:38.874Z", > "type": "entityType/id/realm" > } > ] > }, > "item": { > "type": "entitlementGrant", > "objectType": "Role" > }, > "keys": { > "type": "entitlementGrant", > "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219", > "applicationId": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "accountId": "system/TargetApp/User/62526fa1d701120035ae23c7ce6103c6", > "entitlementId": "system/TargetApp/Role/80b4cd57c3013300daa79624a1d3aea1" > }, > "relationship": { > "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-61186", > "properties": { > "grantTypes": [ > { > "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-61186", > "grantType": "recon" > } > ] > } > }, > "user": { > "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-20187", > "accountStatus": "active", > "assignedDashboard": [ > "TargetApp" > ], > "cn": "Guillermo Frohlich", > "fr": { > "realm": "alpha" > }, > "givenName": "Guillermo", > "id": "ff1d2def-b44e-468f-9079-3b5a2a7dd219", > "mail": "guillermo.frohlich@example.com", > "metadata": { > "created": "2025-01-22T18:17:03.931Z", > "entityType": "/openidm/managed/user", > "version": 10 > }, > "scopes": { > "view": [ > { > "id": "e8abd5fb-64c2-493d-8415-e7a0e4a35984", > "timestamp": "2025-01-28T14:45:52.119497214Z" > } > ] > }, > "sn": "Frohlich", > "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219", > "userName": "guillermo.frohich" > }, > "metadata": { > "modifiedDate": "2025-02-08T01:35:24.671Z", > "createdDate": "2025-01-22T18:16:04.268082497Z" > } > } > ], > "searchAfterKey": [ > "ae4dc3705eab9887753a2b6027748979d789ffc4b34cb28872613600764c75d74dad6802db54f3841cc7341c9a0c1b7a61eb25cf3d99f4d9b6161ed422330b96" > ], > "totalCount": 1, > "resultCount": 1 > } > ``` | | `/iga/governance/entitlement/{entitlementId}/glossary` | GET | Get an entitlement's glossary metadata by ID.> **Collapse: Parameters** > > Name Description entitlementId string \* required Unique identifier of the entitlement for which to get glossary information. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Request can't be found> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > ``` | | `/iga/governance/entitlement/{entitlementId}/glossary` | POST | Create a glossary entry for a single entitlement using its unique identifier.> **Collapse: Parameters** > > Name Description entitlementId string \* required Unique identifier of the entitlement for which to get glossary information. \_\_action string \*required Action to perform for entitlement glossary endpoint. The available value is create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > ```> **Collapse: Responses** > > Code Description 200 Success 400 Request error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > ``` | | `/iga/governance/entitlement/{entitlementId}/glossary` | PUT | Create or update a glossary entry for a single entitlement using its unique identifier.> **Collapse: Parameters** > > Name Description entitlementId string \* required Unique identifier of the entitlement to get. \_\_action string \*required Action to perform for entitlement glossary endpoint. The available values is create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > ```> **Collapse: Responses** > > Code Description 200 Success 400 Request error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > ``` | | `/iga/governance/entitlement/{entitlementId}/glossary` | DELETE | Delete a glossary entry for a single entitlement using its unique identifier.> **Collapse: Parameters** > > Name Description entitlementId string \* required Unique identifier of the entitlement to get. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 Success 400 Request error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "requestable": true, > "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > ``` | ### Event Events are rules defined to detect a change in the IGA system. Each rule has two core parts: a condition for the event and the action taken when that event occurs. For example, a rule might define that whenever someone creates a user in IGA, they should also generate a certification for that user. | URI | HTTP method | Description | | --------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/event` | GET | Get and search for a list of event rules defined in IGA. Each entry represents a single event rule defined to detect a change in the system.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc or desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Error with request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active", > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ], > "resultCount": 0, > "totalCount": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | | `/iga/governance/event` | POST | Create a single IGA event rule. A single event rule is defined to detect a change in the system.> **Collapse: Parameters** > > Name Description \_action string \* required Action to perform for the event endpoint. The available value is create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Example: `orchestration` Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will kick off an orchestration for a new user upon creation.", > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "name": "IdentityCertificationKickOff" > }, > "status": "active", > "owners": [ > { > "id": "managed/user/02612d23-2f7e-4fd0-98f2-3c3d0988df27", > "mail": "aparsons@frgov.net", > "givenName": "Alvin", > "sn": "Parsons", > "userName": "aparsons" > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Event not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active", > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/event/{id}` | GET | Get a single IGA event by ID. The response is a single event rule defined to detect a change in the system.> **Collapse: Parameters** > > Name Description id string \* required ID of the event. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Event not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active", > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/event/{id}` | PUT | Update a single IGA event by ID. This call requires that you provide the entire object and that it replaces the entire existing event definition.> **Collapse: Parameters** > > Name Description id string \* required ID of the event. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Event not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active", > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/event/{id}` | PATCH | Update a single IGA event by ID. This call allows the caller to update specific properties of the event only without providing the entire object.> **Collapse: Parameters** > > Name Description id string \* required ID of the event. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Example: `patchArray` Media type: `application/json` > > ```json > [ > { > "operation": "replace", > "field": "/status", > "value": "active" > } > ] > ```> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Event not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active", > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/event/{id}` | DELETE | Delete a single IGA event by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the event. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 404 Event not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "User Creation Event", > "description": "This event will create an identity certification for a new user upon creation", > "owners": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entityType": "user", > "mutationType": "create", > "condition": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.after.country", > "right": { > "literal": "USA" > } > } > } > ] > } > }, > "action": { > "type": "orchestration", > "template": { > "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357" > }, > "name": "IdentityCertificationKickOff", > "parameters": {} > }, > "status": "active", > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/event/entity` | GET | Get the list of available event entities from which you can define a condition.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "entities": [ > "user" > ] > } > ``` | | `/iga/governance/event/entity/{object}` | GET | Get the available schema for defining a condition on a given object. For example, `user` returns the attributes available for defining an event for users in IGA.> **Collapse: Parameters** > > Name Description object string \* required Type of object for which to return the schema. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 404 Event rule schema not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "schema": { > "user.after.profileImage": { > "class": "json", > "type": "string" > }, > "user.before.description": { > "class": "json", > "type": "string" > }, > "user.before._id": { > "class": "json", > "type": "string" > }, > "user.after.manager": { > "class": "json", > "reference": "/openidm/managed/alpha_user", > "type": "reference" > }, > "user.before.postalAddress": { > "class": "json", > "type": "string" > }, > "user.after.applications": { > "class": "json", > "item": { > "type": "reference", > "reference": "/openidm/managed/alpha_application" > }, > "type": "array" > }, > "user.before.accountStatus": { > "class": "json", > "type": "string" > }, > "user.before.groups": { > "class": "json", > "item": { > "type": "reference", > "reference": "/openidm/managed/alpha_group" > }, > "type": "array" > }, > "user.before.adminOfOrg": { > "class": "json", > "item": { > "type": "reference", > "reference": "/openidm/managed/alpha_organization" > }, > "type": "array" > }, > "user.after.country": { > "class": "json", > "type": "string" > }, > "user.after.telephoneNumber": { > "class": "json", > "type": "string" > }, > "user.after.reports": { > "class": "json", > "item": { > "type": "reference", > "reference": "/openidm/managed/alpha_user" > }, > "type": "array" > }, > "user.before.frUnindexedMultivalued4": { > "class": "json", > "item": { > "type": "string" > }, > "type": "array" > }, > "user.before.ownerOfApp": { > "class": "json", > "item": { > "type": "reference", > "reference": "/openidm/managed/alpha_application" > }, > "type": "array" > }, > "user.before.frUnindexedMultivalued5": { > "class": "json", > "item": { > "type": "string" > }, > "type": "array" > }, > "user.before.frUnindexedMultivalued2": { > "class": "json", > "item": { > "type": "string" > }, > "type": "array" > }, > "user.after.givenName": { > "class": "json", > "type": "string" > }, > "user.before.frUnindexedMultivalued3": { > "class": "json", > "item": { > "type": "string" > }, > "type": "array" > }, > "user.before.manager": { > "class": "json", > "reference": "/openidm/managed/alpha_user", > "type": "reference" > }, > "user.after.mail": { > "class": "json", > "type": "string" > } > } > } > ``` | ### Job You can trigger a governance job. | URI | HTTP method | Description | | --------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `/iga/governance/jobs/{id}` | POST | Trigger a governance job by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the scope. The available value is autoIdTraining. \_action string \* required Action to take. The available value is trigger. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 200 OK 400 Bad request 404 Workflow with ID wasn't found 500 Internal service error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "string" > } > ``` | ### Provisioning In the Advanced Identity Cloud admin console, you can add or remove, or *provision*, resources from end users. You can do the same through REST APIs. | URI | HTTP method | Description | | -------------------------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/user/{userId}/applications` | POST | Provision or de-provision applications for an end user.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. action string \* required Action to perform for the requests endpoint. The available values are add and remove. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "applicationId": "0c067d47-f07c-46d6-9162-14476d18d87a", > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "grantType": "request" > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > {} > ``` | | `/iga/governance/user/{userId}/roles` | POST | Provision or de-provision roles for an end user.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. action string \* required Action to perform for the requests endpoint. The available values are add and remove. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "roleId": "0c067d47-f07c-46d6-9162-14476d18d87a", > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "grantType": "request" > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > {} > ``` | | `/iga/governance/user/{userId}/entitlements` | POST | Provision or de-provision entitlements for an end user.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. action string \* required Action to perform for the requests endpoint. The available values are add and remove. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "entitlementId": "0c067d47-f07c-46d6-9162-14476d18d87a", > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "grantType": "request" > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > {} > ``` | ### Recommendations Use this endpoint to retrieve access recommendations for end users. | URI | HTTP method | Description | | --------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/recommendations` | GET | Get the recommendations provided for access that end users should have.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated values for multiple values. \_pageSize integer Number of entries to return in the response result. The default value is 10. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. The default value is 10. \_sortKeys string Property on which to sort the results. Default value is application.name. \_sortDir string Direction to sort the results. The available values are asc and desc. The default value is asc. \_sortType string Type of sorting to perform. Special types of fields need to use this parameter to be sorted correctly. The available values are date and integer. The default value is date. \_searchAfter string Sort property values of the last entry to continue searching from. Comma-separated values for multiple values. \_queryFilter string Query filter to apply on the results. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "prediction": { > "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b", > "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e", > "confidence": 0.75, > "rule": [ > "12_CHIEF_YES_NO_Yes", > "12_USR_EMP_TYPE_Employee", > "14_USR_MANAGER_ID_benjamin.rosenfield", > "19_USR_DEPARTMENT_NAME_Customer Operations South" > ], > "freq": 5, > "freqUnion": 4 > }, > "glossary": { > "idx": { > "/application": { > "requestable": true, > "testInt": "0" > } > }, > "types": [ > { > "attrKey": "/application", > "modified": "2024-06-05T22:12:51.892Z", > "type": "entityType/id/realm" > } > ] > }, > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "Customer Support - QA" > } > } > }, > "entitlement": { > "__NAME__": "Customer Support - QA", > "_id": "ac77bdcb-659f-4276-beb9-14604d62986e", > "displayName": "Customer Support - QA", > "id": "ac77bdcb-659f-4276-beb9-14604d62986e", > "mailEnabled": false, > "securityEnabled": true > }, > "assignment": { > "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21526", > "attributes": [ > { > "name": "memberOf", > "value": [ > "ac77bdcb-659f-4276-beb9-14604d62986e" > ] > } > ], > "description": "ac77bdcb-659f-4276-beb9-14604d62986e", > "fr": { > "realm": "alpha" > }, > "id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e", > "mapping": "managedAlpha_user_systemTargettestigaautom1User", > "metadata": { > "entityType": "/openidm/managed/assignment", > "created": "2024-04-17T00:50:43.452Z" > }, > "name": "Customer Support - QA", > "type": "__ENTITLEMENT__" > }, > "application": { > "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21516", > "authoritative": false, > "connectorId": "Targettestigaautom1", > "description": "Target AD App", > "fr": { > "realm": "alpha" > }, > "icon": "", > "id": "bb97f388-8c11-4314-9691-22a9f1a799df", > "mappingNames": [ > "systemTargettestigaautom1User_managedAlpha_user", > "systemTargettestigaautom1__group___managedAlpha_assignment", > "managedAlpha_user_systemTargettestigaautom1User", > "systemTargettestigaautom1Directoryrole_managedAlpha_assignment" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2024-06-05T22:12:40.911Z" > }, > "name": "Targettestigaautom1", > "templateName": "azure.ad", > "templateVersion": "2.2" > }, > "catalog": { > "id": "81cbcb5edbb422f68b5407ccf0987714c6418051fffdb132649eafaa4b436d02f4402a9820d48af843230186cfb033ec4e21431778ef1796fef2ad47423957e0" > }, > "keys": { > "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b", > "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e" > }, > "compositeId": "bae206ad1fa95d701344e2a7050cd2ee54e607d4fe1da2cdcd2b07b6522b5deafb1ab03326d95f18b6ca659fa0a84539ce3cb54a80ddbf6f7284e73e4caec274", > "latestCreationTime": 1731096658.93 > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | ### Scope Scope determines which specific users can view or interact with particular target objects. Scoping rules have two core parts: a condition for the source object (who or what the scope applies to) and a condition for the target object that can be viewed or acted upon. | URI | HTTP method | Description | | --------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/scope` | GET | Get and search for a list of scoping rules defined in IGA. Each entry represents a single scoping rule defined to assign conditions that allow a subset of users visibility on a subset of target objects.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. The supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Responses** > > Code Description 200 Success 400 Error with request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ], > "resultCount": 0, > "totalCount": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | | `/iga/governance/scope` | POST | Create a single scoping rule in IGA. Each scoping rule is defined to assign conditions that allow a subset of users visibility on a subset of target objects. IGA scoping rules consist of two core parts: a condition for the source object (who/what the scope applies to) and a condition for the target object that can be viewed or acted upon.> **Collapse: Parameters** > > Name Description \_action string \* required Action to be performed on a single request. The available value is create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Error with provided payload 404 Scope not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/scope/{id}` | GET | Get a single scoping rule in IGA by ID. Each scoping rule is defined to assign conditions that allow a subset of users visibility on a subset of target objects.> **Collapse: Parameters** > > Name Description id string \* required ID of the scope. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Scope not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/scope/{id}` | PUT | Update a single IGA scope by ID. This call expects the entire object to be provided and replaces the entire existing scope definition.> **Collapse: Parameters** > > Name Description id string \* required ID of the scope. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 404 Error with provided payload 404 Scope not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/scope/{id}` | PATCH | Update a single IGA scope by ID. This call allows the caller to update specific properties of the scope only without providing the entire object.> **Collapse: Parameters** > > Name Description id string \* required ID of the scope. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Request body** > > Example: `patchArray` Media type: `application/json` > > ```json > [ > { > "operation": "replace", > "field": "/status", > "value": "active" > } > ] > ```> **Collapse: Responses** > > Code Description 200 OK 404 Error with provided payload 404 Scope not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/scope/{id}` | DELETE | Delete a single IGA scope by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the scope. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Scope not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "Contractor Scope", > "description": "This event will create a scoping rule for users who are contractors", > "status": "active", > "sourceCondition": { > "user": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "user.employeeType", > "right": { > "literal": "contractor" > } > } > } > ] > } > } > }, > "targetCondition": { > "application": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "application.templateName", > "right": { > "literal": "azure.ad" > } > } > } > ] > } > }, > "role": { > "version": "v2", > "filter": { > "and": [ > { > "contains": { > "search_string_array": [ > { > "literal": "contractor" > }, > { > "literal": "temp" > } > ], > "in_string": "role.name" > } > } > ] > } > }, > "entitlement": { > "version": "v2", > "filter": { > "and": [ > { > "equals": { > "left": "entitlement.name", > "right": { > "literal": "Directory Admin" > } > } > } > ] > } > } > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > }, > "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d" > } > ``` | | `/iga/governance/scope/entity` | GET | Get a list of available entities on which you can define a condition.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "entities": [ > "user", > "catalog" > ] > } > ``` | | `/iga/governance/scope/entity/{object}` | GET | Get the available schema to define a condition on a given object. For example, 'user' returns the attributes available for defining a scope for users in IGA.> **Collapse: Parameters** > > Name Description object string \* required Type of object for which to return the schema. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Scope schema not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "schema": { > "user.userName": { > "class": "json", > "type": "string" > }, > "user.description": { > "class": "json", > "type": "string" > }, > "user._id": { > "class": "json", > "type": "string" > }, > "user.givenName": { > "class": "json", > "type": "string" > }, > "user.sn": { > "class": "json", > "type": "string" > } > } > } > ``` | ### Segregation of Duty Segregation of Duties (SoD) is an internal control process that ensures no single individual has privileges that could lead to a conflict of interest or fraud. Administrators can configure SoD using policies and policy rules that let them identify violations and run actions, such as create an exception, allow or remediate the violation, and others. You can view the entire API using a YAML file based on the [OpenAPI specification](https://www.openapis.org). | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Adjust the configurations of the file to match your specific details, such as your Advanced Identity Cloud tenant [FQDN](../../../tenants/environments.html#tenant-environment-fqdns). | | URI | HTTP method | Description | | -------------------------------------------------------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/policy` | GET | Search policies. The endpoint returns policies stored within the Identity Governance store, based on multiple query parameters.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ] > ``` | | `/iga/governance/policy` | POST | Create a new policy object within Identity Governance.> **Collapse: Parameters** > > Name Description \_action string \* required Action to take. The available values are create and duplicate. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ], > "schedule": { > "type": "simple", > "scheduled": true, > "schedule": "string", > "repeatInterval": 864000000, > "repeatCount": -1, > "startTime": "2023-12-21T22:41:00.000Z", > "endTime": "2024-01-01T22:41:00.000Z" > } > } > ```> **Collapse: Responses** > > Code Description 201 Creation success. Returns the saved policy object. 400 Invalid data provided. 500 Server error on save.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ``` | | `/iga/governance/policy/search` | POST | Query policy objects using a targeted search filter.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string Sort property values of the last entry to continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ] > ``` | | `/iga/governance/policy/{id}` | GET | Get policy by ID. The endpoint returns the policy with the provided ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Policy doesn't exist 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ``` | | `/iga/governance/policy/{id}` | PUT | Update an existing policy object within Identity Governance.> **Collapse: Parameters** > > Name Description id string \* required ID of the event. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ```> **Collapse: Responses** > > Code Description 200 Update success. Returns the saved policy object. 400 Invalid data provided. 404 Policy doesn't exist. 500 Server error on save.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ``` | | `/iga/governance/policy/{id}` | DELETE | Delete an existing policy object within Identity Governance.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid data provided 404 Policy doesn't exist 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > } > ``` | | `/iga/governance/policy/{id}/scan` | POST | Run a scan on all given rules of a policy and create violations if desired.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy. simulate string Indicates if this scan is a simulation, true means no violation tasks are created; false or not present creates violations. waitForCompletion string Specifies if you should wait for the completion of the scan before returning. true waits; false or not present returns after scan creation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 201 Policy scan started 400 Invalid data provided 404 Policy doesn't exist 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ``` | | `/iga/governance/policy/{id}/rules` | GET | Get policy rules associated with a policy ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy rule. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid data provided 404 Policy doesn't exist 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ] > } > ``` | | `/iga/governance/policy/rule` | GET | Query policy rules based on multiple query parameters.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ] > ``` | | `/iga/governance/policy/rule` | POST | Create a new policy rule object within Identity Governance.> **Collapse: Parameters** > > Name Description \_action string \* required Action to perform on a single request. The available values are create and duplicate. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user" > } > ```> **Collapse: Responses** > > Code Description 201 Creation success. Returns the saved policy rule object. 400 Invalid data provided 500 Server error on save.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ``` | | `/iga/governance/policy/rule/search` | POST | Query the policy rule objects using a targeted search filter.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ] > ``` | | `/iga/governance/policy/rule/{id}` | GET | Get policy rule by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy rule. resolveSchemas string When true, enrich the remediation.schemas property with the full schema objects rather than just the IDs. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Policy doesn't exist 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ``` | | `/iga/governance/policy/rule/{id}` | POST | Duplicate a given policy rule. The rule will be set as `inactive` by default.> **Collapse: Parameters** > > Name Description \_action string \* required Action to perform on a single request. The available values are create and duplicate id string \* required ID of the policy rule. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 201 Returns new policy rule. NOTE: Rule is set to inactive by default. 400 Invalid request 404 Policy doesn't exist 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user" > } > ``` | | `/iga/governance/policy/rule/{id}` | PUT | Update an existing policy rule object.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy rule to update. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user" > } > ```> **Collapse: Responses** > > Code Description 200 Update success. Returns the saved policy rule object. 400 Invalid data provided 404 Policy doesn't exist 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ``` | | `/iga/governance/policy/rule/{id}` | DELETE | Delete an existing policy rule.> **Collapse: Parameters** > > Name Description id string \* required ID of policy rule to delete. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 Delete success. Returns the removed policy rule object 400 Invalid data provided 404 Policy doesn't exist 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > } > ``` | | `/iga/governance/policy/rule/{id}/scan` | POST | Run a scan the given policy for violations and create violations if desired.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy rule to scan. simulate string Indicates if this scan is a simulation: true means no violation tasks are created; false or not present creates violations. waitForCompletion string Specifies if you should wait for the completion of the scan before returning: true means wait; false or not present returns after scan creation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 201 Policy rule scan started 400 Invalid data provided 404 Policy doesn't exist 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ``` | | `/iga/governance/policy/user/{id}/scan` | POST | Run a scan on a given user rule and return potential violations.> **Collapse: Parameters** > > Name Description id string \* required ID of the user to scan. simulate string Indicate if this scan is a simulation: true means no violation tasks are created; false or not present creates violations. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "additionalAccess": [ > { > "type": "string", > "entitlementId": "string", > "accountId": "string" > } > ], > "policyRuleFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 201 User policy scan started 400 Invalid data provided 500 Server error on save> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ``` | | `/iga/governance/policy/scan` | GET | Query policy scans with the Identity Governance store based on multiple query parameters.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ] > ``` | | `/iga/governance/policy/scan/search` | POST | Query policy scan objects using a targeted search filter.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ] > ``` | | `/iga/governance/policy/scan/{id}` | GET | Get policy scan by ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy to scan. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 ID not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ``` | | `/iga/governance/policy/scan/{id}` | DELETE | Delete an existing policy scan object within Identity Governance.> **Collapse: Parameters** > > Name Description id string \* required ID of the policy to scan to delete. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 Delete success. Returns the removed policy scan object 400 Invalid data provided 404 ID not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "policy": { > "id": "string", > "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1", > "name": "string", > "description": "string", > "policyOwner": { > "id": "string" > }, > "policyRuleIds": [ > "string" > ] > }, > "policyRule": { > "name": "string", > "description": "string", > "documentationUrl": "string", > "policyRuleOwner": { > "id": "string" > }, > "violationOwner": { > "id": "string" > }, > "active": true, > "scanTypes": { > "preventative": true, > "detective": true > }, > "maxExceptionDuration": 0, > "decisionOptions": { > "allow": true, > "exception": true, > "remediate": true > }, > "remediation": { > "type": "string", > "id": "string", > "schemas": [ > "string" > ] > }, > "userFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > }, > "ruleDefinition": [ > { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > ], > "workflow": { > "type": "bpmn", > "id": "BasicViolationProcess" > }, > "violationOwnerType": "user", > "id": "string", > "ruleDefinitionTags": [ > "targetName=entitlement.displayName&targetValue=IT%20Admin", > "targetValue=IT%20Admin&targetName=entitlement.displayName" > ] > }, > "isSimulation": true, > "status": "string", > "startDate": "string", > "completionDate": "string", > "scanTarget": "string", > "results": [ > {} > ] > } > ``` | | `/iga/governance/user/violation` | GET | Query the signed-in user's violation objects.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ] > ``` | | `/iga/governance/violation` | GET | Query the violation objects.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ] > ``` | | `/iga/governance/violation` | POST | Creates a violation with the given body.> **Collapse: Parameters** > > Name Description \_action string \* required Action to take. The available values are create and duplicate. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ] > ``` | | `/iga/governance/violation/allow` | POST | Once a phase (or phases) have chosen to allow a violation, close and complete the violations with the outcome of `allow`.> **Collapse: Parameters** > > Name Description waitForCompletion string Specifies if you should wait the completion of the scan before returning. true waits; false or not present returns after scan creation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "ids": [ > "e9e4d260-1b55-4331-8468-5824344b8bc3", > "01d8ccf0-e132-49f1-9c82-c52a6fea0154" > ], > "comment": "Justification for this action." > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to allow violations 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Action 'allow' complete.", > "idsNotActedOn": [ > { > "id": "09e01632-b22f-407b-bacb-aa1e2cac8214", > "errorMessage": "This violation is not eligible to be allowed.", > "errorCode": 400 > } > ] > } > ``` | | `/iga/governance/violation/cancel-exception` | POST | As a user who can take action on violations, cancel existing exceptions, reverting the violations to in-progress.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "ids": [ > "e9e4d260-1b55-4331-8468-5824344b8bc3", > "01d8ccf0-e132-49f1-9c82-c52a6fea0154" > ], > "comment": "Justification for this action." > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to comment violations 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Action 'allow' complete.", > "idsNotActedOn": [ > { > "id": "09e01632-b22f-407b-bacb-aa1e2cac8214", > "errorMessage": "This violation is not eligible to be allowed.", > "errorCode": 400 > } > ] > } > ``` | | `/iga/governance/violation/comment` | POST | As a user who can take action on violations, add a comment to the violation objects.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "ids": [ > "e9e4d260-1b55-4331-8468-5824344b8bc3", > "01d8ccf0-e132-49f1-9c82-c52a6fea0154" > ], > "comment": "Justification for this action." > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to comment violations 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Action 'allow' complete.", > "idsNotActedOn": [ > { > "id": "09e01632-b22f-407b-bacb-aa1e2cac8214", > "errorMessage": "This violation is not eligible to be allowed.", > "errorCode": 400 > } > ] > } > ``` | | `/iga/governance/violation/exception` | POST | As a user who can take action on violations, grant an exception to the violating access.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "ids": [ > "e9e4d260-1b55-4331-8468-5824344b8bc3", > "01d8ccf0-e132-49f1-9c82-c52a6fea0154" > ], > "comment": "Justification for this action.", > "exceptionExpirationDate": "2024-04-24T20:36:14+00:00" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to comment violations 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Action 'allow' complete.", > "idsNotActedOn": [ > { > "id": "09e01632-b22f-407b-bacb-aa1e2cac8214", > "errorMessage": "This violation is not eligible to be allowed.", > "errorCode": 400 > } > ] > } > ``` | | `/iga/governance/violation/reassign` | POST | As a user who can take action on violations, edit the list of active actors on the violation tasks.> **Collapse: Parameters** > > Name Description Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "ids": [ > "e9e4d260-1b55-4331-8468-5824344b8bc3", > "01d8ccf0-e132-49f1-9c82-c52a6fea0154" > ], > "comment": "Justification for this action.", > "updatedActors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true, > "allow": true, > "exception": true, > "remediate": true > } > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to comment violations 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Action 'allow' complete.", > "idsNotActedOn": [ > { > "id": "09e01632-b22f-407b-bacb-aa1e2cac8214", > "errorMessage": "This violation is not eligible to be allowed.", > "errorCode": 400 > } > ] > } > ``` | | `/iga/governance/violation/search` | POST | Query the violation objects using a targeted search filter.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ] > ``` | | `/iga/governance/user/violation/search` | POST | Query the signed-in user's violation object using a targeted search filter.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. \_queryFilter string Search query filter. actorStatus string Actor status to search. Comma-separated for multiple values. For example: active, inactive, or active, inactive. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > !`_searchAfter` string !The sort property values of the last entry to continue searching from. Comma-separated for multiple values. > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: \`application/json\`å > > ```json > [ > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ] > ``` | | `/iga/governance/violation/{id}` | GET | Query the contents of a single violation object.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. resolveSchemas string When true, enrich the policyRule remediation schemas property with the full schema objects rather than just the IDs. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Violation doesn't exist 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}` | PUT | Updates a given violation with the given body.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > [ > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ] > ``` | | `/iga/governance/violation/{id}` | DELETE | Deletes a violation with a given ID.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > "string" > ``` | | `/iga/governance/violation/{id}/allow` | POST | Once a phase (or phases) have chosen to allow a violation, close and complete the violation with an outcome of `allow`.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User not authorized to allow violation 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/#{id}/comment` | POST | As an actor on a violation, add a comment to a violation object.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 201 Comment added 400 Invalid request 403 User not authorized to comment on violation 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/remediate` | POST | Once a phase (or phases) have chosen to remediate a violation, complete the violation with an outcome of `remediate` and continue the workflow on to either the automated or manual process for fulfilling the remediation.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string" > } > ```> **Collapse: Responses** > > Code Description 200 Remediation process begun 400 Invalid request 403 User not authorized to remediate violation 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/remediation/status/{status}` | POST | For violations with an outcome of `remediate`, allow the `remediationStatus` key to be updated. For example, from `in-progress` to `complete` and finalize the violation when appropriate.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. status string \* required Status to update remediationStatus to. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Violation ID not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{violationId}/phases` | POST | Add a phase to a violation. A phase is a task that must be completed to move the violation forward, which depends on the task configuration, such as expiration, assignee, notifications, and others. For type=`violation`, the task allows users to select `allow` or `remediate`.> **Collapse: Parameters** > > Name Description violationId string \* required ID of the violation. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "phase": { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > }, > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true, > "allow": true, > "exception": true, > "remediate": true > } > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Violation not found 500 Server error | | `/iga/governance/violation/{id}/phases/{phaseName}/allow` | POST | As an actor on a violation, allow the user to continue to violate the defined rule in perpetuity.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User not authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/cancel-exception` | POST | As an actor on a violation, cancel an existing exception, reverting the violation to `in-progress`.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 200 Exception canceled 400 Invalid request 403 User isn't authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/comment` | POST | Add a comment to a violation object.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 200 Comment added 400 Invalid request 403 User isn't authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/exception` | POST | As an actor on a violation, grant an exception to the violating access.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "exceptionExpirationDate": "string", > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 200 Exception granted 400 Invalid request 401 User isn't authorized to make exception on violation 403 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/reassign` | POST | As an actor on a violation, edit the actors and permissions on a violation task.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "updatedActors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true, > "allow": true, > "exception": true, > "remediate": true > } > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 Actors reassigned 400 Invalid request 403 User isn't authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/remediate` | POST | As an actor on a violation, choose to remediate the access, kicking off the remediation workflow assigned to the violation.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string" > } > ```> **Collapse: Responses** > > Code Description 200 Remediation process begun 400 Invalid request 403 User isn't authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/complete` | POST | As an actor on a manual provisioning task to handle the violation remediation, mark the action as completed.> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | | `/iga/governance/violation/{id}/phases/{phaseName}/cancel` | POST | As an actor on a manual provisioning task to handle the violation remediation, mark the action as canceled (not completed).> **Collapse: Parameters** > > Name Description id string \* required ID of the violation. phaseName string \* required Name of the phase. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "comment": "string" > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 403 User isn't authorized to take action 404 Violation not found 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "user": {}, > "policyRule": {}, > "decision": { > "status": "pending", > "decision": "exception", > "comments": [ > {} > ], > "events": { > "assignment": {}, > "expiration": {}, > "escalation": {}, > "reminder": {} > }, > "actors": { > "active": [ > {} > ], > "inactive": [ > {} > ] > }, > "completionDate": "string", > "completedBy": {} > } > } > ``` | ### Task Endpoints for fulfillment tasks. | URI | HTTP method | Description | | ------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/user/{userId}/tasks` | GET | Get the tasks for which the authenticated user has permissions to view.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. Type string The type of task to filter by. The available values are request, violation, and fulfillment \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | | `/iga/governance/user/{userId}/tasks` | POST | Get the tasks for which the authenticated user has permissions to view. You can use the `targetFilter` property in the payload to filter requests based on the desired criteria.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. Type string The type of task to filter by. The available values are request, violation, and fulfillment \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. userId string \* string Unique identifier of the user. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Request body** > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "string", > "requester": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "requestType": "applicationGrant", > "request": { > "common": { > "startDate": "2023-09-11T12:00:00+00:00", > "endDate": "2023-12-11T12:00:00+00:00", > "justification": "I need this access to start working on a new project.", > "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63", > "isDraft": false, > "requestIdPrefix": "REQ" > } > }, > "application": { > "authoritative": false, > "connectorId": "AzureAD", > "description": "AzureAD application", > "fr": { > "realm": "alpha" > }, > "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg", > "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1", > "mappingNames": [ > "systemAzureadUser_managedAlpha_user", > "systemAzureadDirectoryrole_managedAlpha_assignment", > "systemAzuread__group___managedAlpha_assignment", > "managedAlpha_user_systemAzureadUser" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2023-08-31T21:23:35.809Z" > }, > "name": "AzureAD", > "templateName": "azure.ad", > "templateVersion": "2.0", > "objectTypes": [ > { > "name": "__ACCOUNT__" > }, > { > "name": "__GROUP__", > "accountAttribute": "memberOf" > } > ] > }, > "applicationOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "entitlementOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "roleOwner": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > } > ], > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "decision": { > "status": "in-progress", > "decision": "approved", > "outcome": "provisioned", > "startDate": "2023-09-10T12:00:00+00:00", > "completionDate": "2023-09-10T12:00:00+00:00", > "comments": [ > { > "user": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "comment": "I need to find out more information before approving. Will check back later.", > "action": "comment", > "timeStamp": "2023-09-11T12:00:00+00:00", > "phase": "ManagerApproval" > } > ], > "actors": { > "active": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ], > "inactive": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > }, > "phase": "ManagerApproval" > } > ] > }, > "phases": [ > { > "phase": { > "name": "ManagerApproval", > "type": "request", > "status": "in-progress", > "decision": "approve", > "startDate": "2023-09-10T12:00:00+00:00", > "events": { > "assignment": { > "notification": "requestAssigned" > }, > "reassign": { > "notification": "requestReassigned" > }, > "expiration": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestExpired", > "action": "reassign", > "actors": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > }, > { > "id": "string", > "name": "string", > "permissions": { > "approve": true, > "comment": true, > "modify": true, > "reassign": true, > "reject": true > } > } > ] > }, > "escalation": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestEscalated", > "actors": [ > { > "id": "875bbc8f-e868-451f-a690-453473205ca1" > } > ], > "frequency": 3 > }, > "reminder": { > "date": "2023-09-04T12:00:00+00:00", > "notification": "requestReminder", > "frequency": 3 > } > }, > "justification": "string", > "workflowTaskId": "1025", > "completedBy": { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith" > }, > "completionDate": "2023-09-10T12:00:00+00:00" > } > } > ] > }, > "metadata": { > "createdDate": "2024-01-11T12:00:00+00:00", > "modifiedDate": "2024-04-24T12:00:00+00:00" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | ### User Endpoint for a user's grants and recommendations. | URI | HTTP method | Description | | ----------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/user` | GET | Searches for all users that match the provided query parameters.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. Default is 10. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. Default is \`10. \_sortKeys string Property on which to sort the results. Default is application.name. \_sortDir string Direction of sort: asc, desc. Default is asc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. Default is date. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter.> **Collapse: Responses** > > Code Description 200 OK 400 Error with request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761", > "userName": "asmith", > "mail": "asmith01@forgerock.com", > "givenName": "Aaron", > "sn": "Smith", > "permissions": { > "view": true > } > } > ], > "resultCount": 0, > "totalCount": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | | `/iga/governance/user/{userId}/privileges` | GET | Get the user's current privileges.The endpoint returns the Identity Governance-related authorization details for the authenticated users and includes the following information:* `userInfo`: Displayable information of the user. * `owner`: Identity Governance entities for which the user is an owner. * `groups`: Groups the user belongs to (via their authorization token). * `permissions`: List of Identity Governance permissions that apply to the user * `scopes`: List of scopes that apply to this user.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example to get a user's privileges** > > Media type: `application/json` > > ```json > GET iga/governance/user/{userId}/privileges > { > "userInfo": { > "userName": "christian.marnell", > "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "givenName": "Christian", > "sn": "Marnell", > "mail": "christian.marnell@example.com" > }, > "owner": { > "certification": false, > "entitlement": true, > "policy": false > }, > "groups": [], > "permissions": [ > "createEntitlement", > "modifyEntitlement" > ], > "scopes": [ > "e8abd5fb-64c2-493d-8415-e7a0e4a35984" > ] > } > ``` | | `/iga/governance/user/{userId}/grants` | GET | Get the user's current grants.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. queryString string \* required Search term. Searches against display names of the grant being targeted. grantType string Type of grant being searched for. The available values are entitlement, account, and role \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error> **Collapse: Click for an example to get a user's privileges** > > Media type: `application/json` > > ```json > { > "result": [ > { > "account": { > "calendar_integration": "1", > "user_name": "guillermo.frohich", > "sys_updated_on": "2025-01-02 21:29:47", > "__user_group_ids__": [ > "0a52d3dcd7011200f2d224837e6103f2" > ], > "title": "Chief Financial Officer", > "sys_class_name": "sys_user", > "notification": "2", > "sys_updated_by": "developer.program.hop@snc", > "sys_created_on": "2024-11-30 15:04:03", > "sys_domain": "global", > "__NAME__": "62526fa1d701120035ae23c7ce6103c6", > "vip": false, > "department": "221f3db5c6112284009f4becd3039cc9", > "first_name": "Guillermo", > "sys_created_by": "admin", > "email": "guillermo.frohlich@example.com", > "__user_role_ids__": [ > "cc6f85b5ebc31300a210a2505206fec0", > "8a454be00a0a0b8c00de7dae26869165" > ], > "locked_out": "false", > "sys_mod_count": "3", > "active": "true", > "last_name": "Frohlich", > "time_zone": "Europe/London", > "name": "Guillermo Frohlich", > "_id": "62526fa1d701120035ae23c7ce6103c6" > }, > "application": { > "name": "TargetApp", > "description": "Testing 3", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "User" > } > ] > }, > "catalog": { > "id": "16758965550a4cf40f25c0f6a8bb7a5b347292785141e7f4e59644f77cf0811010cd55da8f1f27e3401676ada5b57734682167d3ef5fb26c98acb660390f44b4" > }, > "compositeId": "12b505cfad20126bf03f49106aeeff3d85a9cb8fe4f882e5422e408a82d85a75dcb78ef282cc90a32259c64b0a4990eb55cec5adfbf22817aabe43152c2e183", > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "interaction_agent" > }, > "/account": { > "displayName": "guillermo.frohich" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "7db62d76e806121087debb3e47d14f20", > "grantable": true, > "description": "A required role to perform interaction agent and interaction queue transfer", > "sys_name": "interaction_agent", > "sys_scope": "global", > "__NAME__": "b523f1d037001300a213a7f07e41f15b", > "elevated_privilege": false, > "_id": "b523f1d037001300a213a7f07e41f15b", > "sys_class_name": "sys_user_role" > }, > "glossary": { > "idx": { > "/entitlement": { > "entitlementOwner": "managed/user/e8e8636e-33ad-4764-8c13-feba9a973bb1" > }, > "/application": { > "requestable": true > } > }, > "types": [ > { > "attrKey": "/assignment", > "modified": "2025-02-04T14:22:27.287176855Z", > "type": "entityType/id/realm" > }, > { > "attrKey": "/application", > "modified": "2025-02-03T22:08:38.874Z", > "type": "entityType/id/realm" > } > ] > }, > "item": { > "type": "entitlementGrant", > "objectType": "Role" > }, > "keys": { > "type": "entitlementGrant", > "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219", > "applicationId": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "accountId": "system/TargetApp/User/62526fa1d701120035ae23c7ce6103c6", > "entitlementId": "system/TargetApp/Role/b523f1d037001300a213a7f07e41f15b" > }, > "relationship": { > "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-60718", > "properties": { > "grantTypes": [ > { > "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-60718", > "grantType": "recon" > } > ] > } > }, > "user": { > "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-20187", > "accountStatus": "active", > "assignedDashboard": [ > "TargetApp" > ], > "cn": "Guillermo Frohlich", > "fr": { > "realm": "alpha" > }, > "givenName": "Guillermo", > "id": "ff1d2def-b44e-468f-9079-3b5a2a7dd219", > "mail": "guillermo.frohlich@example.com", > "metadata": { > "created": "2025-01-22T18:17:03.931Z", > "entityType": "/openidm/managed/user", > "version": 8 > }, > "scopes": { > "view": [ > { > "id": "e8abd5fb-64c2-493d-8415-e7a0e4a35984", > "timestamp": "2025-01-28T14:45:52.119497214Z" > } > ] > }, > "sn": "Frohlich", > "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219", > "userName": "guillermo.frohich" > }, > "metadata": { > "modifiedDate": "2025-02-04T14:30:59.277Z", > "createdDate": "2025-01-22T18:16:03.576225515Z" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | | `/iga/governance/user/{userId}/recommendations` | GET | Get the access recommendations for a given user.> **Collapse: Parameters** > > Name Description userId string \* required Unique identifier of the user. \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc, desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. \_queryFilter string Search query filter. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of API processes the request.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "prediction": { > "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b", > "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e", > "confidence": 0.75, > "rule": [ > "12_CHIEF_YES_NO_Yes", > "12_USR_EMP_TYPE_Employee", > "14_USR_MANAGER_ID_benjamin.rosenfield", > "19_USR_DEPARTMENT_NAME_Customer Operations South" > ], > "freq": 5, > "freqUnion": 4 > }, > "glossary": { > "idx": { > "/application": { > "requestable": true, > "testInt": "0" > } > }, > "types": [ > { > "attrKey": "/application", > "modified": "2024-06-05T22:12:51.892Z", > "type": "entityType/id/realm" > } > ] > }, > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "Customer Support - QA" > } > } > }, > "entitlement": { > "__NAME__": "Customer Support - QA", > "_id": "ac77bdcb-659f-4276-beb9-14604d62986e", > "displayName": "Customer Support - QA", > "id": "ac77bdcb-659f-4276-beb9-14604d62986e", > "mailEnabled": false, > "securityEnabled": true > }, > "assignment": { > "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21526", > "attributes": [ > { > "name": "memberOf", > "value": [ > "ac77bdcb-659f-4276-beb9-14604d62986e" > ] > } > ], > "description": "ac77bdcb-659f-4276-beb9-14604d62986e", > "fr": { > "realm": "alpha" > }, > "id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e", > "mapping": "managedAlpha_user_systemTargettestigaautom1User", > "metadata": { > "entityType": "/openidm/managed/assignment", > "created": "2024-04-17T00:50:43.452Z" > }, > "name": "Customer Support - QA", > "type": "__ENTITLEMENT__" > }, > "application": { > "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21516", > "authoritative": false, > "connectorId": "Targettestigaautom1", > "description": "Target AD App", > "fr": { > "realm": "alpha" > }, > "icon": "", > "id": "bb97f388-8c11-4314-9691-22a9f1a799df", > "mappingNames": [ > "systemTargettestigaautom1User_managedAlpha_user", > "systemTargettestigaautom1__group___managedAlpha_assignment", > "managedAlpha_user_systemTargettestigaautom1User", > "systemTargettestigaautom1Directoryrole_managedAlpha_assignment" > ], > "metadata": { > "entityType": "/openidm/managed/application", > "created": "2024-06-05T22:12:40.911Z" > }, > "name": "Targettestigaautom1", > "templateName": "azure.ad", > "templateVersion": "2.2" > }, > "catalog": { > "id": "81cbcb5edbb422f68b5407ccf0987714c6418051fffdb132649eafaa4b436d02f4402a9820d48af843230186cfb033ec4e21431778ef1796fef2ad47423957e0" > }, > "keys": { > "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b", > "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e" > }, > "compositeId": "bae206ad1fa95d701344e2a7050cd2ee54e607d4fe1da2cdcd2b07b6522b5deafb1ab03326d95f18b6ca659fa0a84539ce3cb54a80ddbf6f7284e73e4caec274", > "latestCreationTime": 1731096658.93 > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | ### Workflow | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | To use the `iga/governance/workflow` and `iga/governance/audit` endpoints, your authorization token must have the following scope:`fr:idc:analytics.*`This is a temporary requirement and will be removed in a future release. | | URI | HTTP method | Description | | ---------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/workflow` | GET | Get the workflow definitions.> **Collapse: Parameters** > > Name Description \_searchAfter string Elasticsearch after key. Used for pageNumber. \_pagedResultsOffset string Offset number of the record from which to start the paginated results. \_pageSize string Number of documents to return. \_queryString string String to filter the workflows. Matches the workflow displayName, description, and name keys.> **Collapse: Responses** > > Code Description 201 Creation success. Returns the saved workflow object. | | `/iga/governance/workflow` | Post | Create or publish workflow definitions.> **Collapse: Parameters** > > Name Description \_action string \* required Action to be performed for the workflow endpoint. The available values are create, validate, publish, and execute.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "displayName": "string", > "description": "string", > "type": "provisioning", > "steps": [ > { > "name": "string", > "displayName": "string", > "type": "scriptTask", > "scriptTask": { > "language": "javascript", > "gatewayType": "inclusive", > "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ] > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid data provided. 500 Server error on save.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > {} > ``` | | `/iga/governance/workflow/{id}/{status}` | GET | Get the workflow definition.> **Collapse: Parameters** > > Name Description id string \* required ID of the workflow. status string \* required Status of the workflow.> **Collapse: Responses** > > Code Description 200 OK 400 Bad request 404 Workflow with ID wasn't found 500 Internal service error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "displayName": "string", > "description": "string", > "type": "provisioning", > "steps": [ > { > "name": "string", > "displayName": "string", > "type": "scriptTask", > "scriptTask": { > "language": "javascript", > "gatewayType": "inclusive", > "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ] > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > } > ] > } > ``` | | `/iga/governance/workflow/{id}/{status}` | DELETE | Delete the workflow definition. If the status is published, it will try to delete the workflow model and process the definition in IDM.> **Collapse: Parameters** > > Name Description id string \* required ID of the workflow. status string \* required Status of the workflow.> **Collapse: Responses** > > Code Description 200 OK> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "role": { > "_rev": "9b32dc1c-c0fe-4cf6-a24c-2b9374dd15ad-820870", > "description": "Test", > "fr": { > "realm": "alpha" > }, > "id": "7136a3c4-0c12-488a-8cfd-2fd71a24e4bd", > "metadata": { > "entityType": "/openidm/managed/role", > "created": "2024-09-09T15:28:28.887Z" > }, > "name": "Approver Role" > }, > "user": { > "_rev": "9b32dc1c-c0fe-4cf6-a24c-2b9374dd15ad-1200974", > "accountStatus": "active", > "cn": "Ariela Stonuary", > "custom_debugObj": { > "task-started": "2024-09-04T21:08:01.019057006" > }, > "custom_debugObjTwo": { > "task-completed": "2024-09-04T21:08:01.290865442" > }, > "description": "updateNow1", > "fr": { > "realm": "alpha" > }, > "givenName": "Ariela", > "id": "e8224d8b-a5b6-4120-83d4-fd9b69844aca", > "mail": "Ariela@IGATestQA.onmicrosoft.com", > "metadata": { > "created": "2024-09-06T15:31:18.399Z", > "entityType": "/openidm/managed/user", > "version": 7 > }, > "preferences": { > "marketing": false, > "updates": false > }, > "sn": "Stonuary", > "userId": "e8224d8b-a5b6-4120-83d4-fd9b69844aca", > "userName": "Ariela@IGATestQA.onmicrosoft.com" > }, > "catalog": { > "id": "87b51036e699e772f9e4f81617f5e3adb6c012974a594e6aa4bc50254419be7ccf7d26c85b42df8fa7147798a75966cad432528eef9e9f32f4f78c4a4607c4c" > }, > "compositeId": "e546e458a04626344e478139309b21f35fcba24e1f9429a19c769897d3928c66408cdd50f9e08170fb810751bd70ca929840c894e346d11126c57326e7d9a33d", > "glossary": { > "idx": { > "/role": { > "requestable": true, > "roleOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea" > } > }, > "types": [ > { > "attrKey": "/role", > "modified": "2024-09-12T12:51:42.108Z", > "type": "entityType/id/realm" > } > ] > }, > "item": { > "type": "roleMembership" > }, > "keys": { > "type": "roleMembership", > "roleId": "7136a3c4-0c12-488a-8cfd-2fd71a24e4bd", > "userId": "e8224d8b-a5b6-4120-83d4-fd9b69844aca" > }, > "relationship": { > "id": "7065a955-275f-4e70-969b-4cf19c479af6-8621418", > "conditional": false > }, > "metadata": { > "modifiedDate": "2024-09-12T12:57:46.847Z", > "createdDate": "2024-09-03T13:08:13.306772183Z" > } > } > ], > "searchAfterKey": [ > "a321329c-a7e6-47ad-8349-99b6e38f9a59" > ], > "totalCount": 0, > "resultCount": 0 > } > ``` | | `/iga/governance/workflow/{id}` | PUT | Update or publish the workflow definition.> **Collapse: Parameters** > > Name Description id string \* required ID of the workflow.> **Collapse: Request body** > > ```json > { > "id": "string", > "name": "string", > "displayName": "string", > "description": "string", > "type": "provisioning", > "steps": [ > { > "name": "string", > "displayName": "string", > "type": "scriptTask", > "scriptTask": { > "language": "javascript", > "gatewayType": "inclusive", > "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ] > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Bad request 404 Workflow with ID wasn't found 500 Internal service error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "id": "string", > "name": "string", > "displayName": "string", > "description": "string", > "type": "provisioning", > "steps": [ > { > "name": "string", > "displayName": "string", > "type": "scriptTask", > "scriptTask": { > "language": "javascript", > "gatewayType": "inclusive", > "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ] > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > }, > { > "name": "string", > "displayName": "string", > "type": "approvalTask", > "nextStep": [ > { > "condition": "string", > "outcome": "string", > "step": "string" > } > ], > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "events": { > "assignment": { > "notification": "string" > }, > "reassign": { > "notification": "string" > }, > "reminder": { > "notification": "string", > "frequency": 0, > "date": { > "isExpression": true, > "value": "string" > } > }, > "escalation": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > } > }, > "expiration": { > "notification": "string", > "actors": [ > { > "id": { > "value": "string", > "isExpression": true > }, > "permissions": { > "approve": true, > "reject": true, > "reassign": true, > "modify": true, > "comment": true > } > } > ], > "date": { > "isExpression": true, > "value": "string" > }, > "action": "string" > } > } > } > ] > } > ``` | ### Notifications Endpoint for notification tasks and template endpoints. | URI | HTTP method | Description | | ------------------------------------ | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/notification/task/` | GET | Query all notification system tasks.> **Collapse: Parameters** > > Name Description \_fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of entries to return in the response result. The default value is 10. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. The default value is 10. \_sortKeys string Property on which to sort the results. Default value is applicaition.name. \_sortDir string Direction to sort the results. The available values are asc and desc. The default value is asc. \_sortType string Type of sorting to perform. Special types of fields need to use this parameter to be sorted correctly. The available values are date and integer. The default value is date. \_searchAfter string Sort property values of the last entry to continue searching from. Comma-separated for multiple values. \_queryFilter string Query filter to apply on the results.> **Collapse: Responses** > > Code Description 200 Success. Returns notification system task objects.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "taskData": {}, > "date": "string", > "remainingAttempts": 0, > "status": "pending", > "context": {}, > "systemMessages": [ > { > "date": "string", > "message": "string" > } > ] > } > ], > "searchAfterKey": "string", > "resultCount": 0, > "totalCount": 0 > } > ``` | | `/iga/governance/notification/task/` | POST | Task action on notification tasks.> **Collapse: Parameters** > > Name Description \_action string \* required Action to take. The available value is process.> **Collapse: Responses** > > Code Description 200 Success. Action for notification tasks started.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "message": "Process action started successfully" > } > ``` | ### Evolving | | | | - | ----------------------------------------------------------------------------------------------------------------- | | | The APIs referenced in this section are evolving, which means they might change or become deprecated at any time. | The current evolving APIs focus on entitlements. You can find more information in [Entitlements](../../administration/entitlements.html). | URI | HTTP method | Description | | ------------------------------------------------ | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `/iga/governance/resource/{id}` | GET | Get an entitlement by an ID.> **Collapse: Parameters** > > Name Description id string \* required Unique identifier for the entitlement.> **Collapse: Responses** > > Code Description 200 OK 404 Entitlement with the specified ID was not found. 500 Internal server error.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "application": { > "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-819546", > "authoritative": false, > "connectorId": "TargetApp", > "description": "Testing 3", > "fr": { > "realm": "alpha" > }, > "icon": "https://img.freepik.com/free-vector/vector-logo-unique-letter-e-colorful-gradient-design-illustration_474888-2292.jpg", > "id": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "name": "TargetApp", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "Department", > "accountAttribute": "department" > }, > { > "name": "Company", > "accountAttribute": "company" > }, > { > "name": "User" > }, > { > "name": "CostCenter", > "accountAttribute": "costCenter" > }, > { > "name": "Location", > "accountAttribute": "location" > } > ], > "templateName": "servicenow", > "templateVersion": "3.3" > }, > "applicationOwner": [ > { > "id": "d09f3dda-bd62-4c73-95fa-b1cb8daa438e", > "userName": "fyork", > "givenName": "Frank", > "sn": "York", > "mail": "fyork@example.com" > } > ], > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "tracked_file_reader" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "16ccd5fee802121087debb3e47d14fbf", > "grantable": true, > "description": "Read role for tracked configuration files", > "sys_name": "tracked_file_reader", > "sys_scope": "global", > "__NAME__": "80b4cd57c3013300daa79624a1d3aea1", > "elevated_privilege": false, > "_id": "80b4cd57c3013300daa79624a1d3aea1", > "sys_class_name": "sys_user_role" > }, > "entitlementOwner": [ > { > "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "userName": "christian.marnell", > "givenName": "Christian", > "sn": "Marnell", > "mail": "christian.marnell@example.com" > } > ], > "glossary": { > "idx": { > "/entitlement": { > "complianceObjective": "HIPAA", > "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "lob": "Finance", > "requestable": true > }, > "/application": { > "requestable": true > } > } > }, > "id": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1", > "item": { > "type": "entitlementGrant", > "objectType": "Role" > }, > "permissions": { > "modifyEntitlement": true, > "viewGrants": true > }, > "metadata": { > "modifiedDate": "2025-01-29T14:33:09.168Z", > "createdDate": "2025-01-22T18:15:48.763702117Z" > } > } > ``` | | `/iga/governance/resource/search` | POST | Search for a list of all entitlements that match the target filter.> **Collapse: Parameters** > > Name Description pageSize integer Number of response result objects to return. pageNumber string Page number of the response result to return. fields string List of fields to return for each entry in the response result. Comma-separated for multiple values. sortBy string Property on which to sort the results. sortDir string Direction to sort the results. The available values are asc and desc. sortType string Type of sorting to perform. Special types of fields need to use this parameter to be sorted correctly. The available values are date and integer. searchAfter string Sort property values of the last entry to continue searching from. Comma-separated values for multiple values.> **Collapse: Responses** > > Code Description 201 Created 400 Invalid request 500 Internal server error> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "targetFilter": { > "operator": "AND", > "operand": [ > { > "operator": "EQUALS", > "operand": { > "targetName": "user.userName", > "targetValue": "ljones" > } > }, > { > "operator": "CONTAINS", > "operand": { > "targetName": "application.name", > "targetValue": "Active Directory" > } > } > ] > } > } > ```> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "application": { > "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-819546", > "authoritative": false, > "connectorId": "TargetApp", > "description": "Testing 3", > "fr": { > "realm": "alpha" > }, > "icon": "https://img.freepik.com/free-vector/vector-logo-unique-letter-e-colorful-gradient-design-illustration_474888-2292.jpg", > "id": "825c6e15-b860-4be4-bef9-55d28a0cd2de", > "name": "TargetApp", > "objectTypes": [ > { > "name": "Role", > "accountAttribute": "__user_role_ids__" > }, > { > "name": "Group", > "accountAttribute": "__user_group_ids__" > }, > { > "name": "Department", > "accountAttribute": "department" > }, > { > "name": "Company", > "accountAttribute": "company" > }, > { > "name": "User" > }, > { > "name": "CostCenter", > "accountAttribute": "costCenter" > }, > { > "name": "Location", > "accountAttribute": "location" > } > ], > "templateName": "servicenow", > "templateVersion": "3.3" > }, > "applicationOwner": [ > { > "id": "d09f3dda-bd62-4c73-95fa-b1cb8daa438e", > "userName": "fyork", > "givenName": "Frank", > "sn": "York", > "mail": "fyork@example.com" > } > ], > "descriptor": { > "idx": { > "/entitlement": { > "displayName": "tracked_file_reader" > } > } > }, > "entitlement": { > "can_delegate": true, > "sys_package": "16ccd5fee802121087debb3e47d14fbf", > "grantable": true, > "description": "Read role for tracked configuration files", > "sys_name": "tracked_file_reader", > "sys_scope": "global", > "__NAME__": "80b4cd57c3013300daa79624a1d3aea1", > "elevated_privilege": false, > "_id": "80b4cd57c3013300daa79624a1d3aea1", > "sys_class_name": "sys_user_role" > }, > "entitlementOwner": [ > { > "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "userName": "christian.marnell", > "givenName": "Christian", > "sn": "Marnell", > "mail": "christian.marnell@example.com" > } > ], > "glossary": { > "idx": { > "/entitlement": { > "complianceObjective": "HIPAA", > "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc", > "lob": "Finance", > "requestable": true > }, > "/application": { > "requestable": true > } > } > }, > "id": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1", > "item": { > "type": "entitlementGrant", > "objectType": "Role" > }, > "permissions": { > "modifyEntitlement": true, > "viewGrants": true > }, > "metadata": { > "modifiedDate": "2025-01-29T14:33:09.168Z", > "createdDate": "2025-01-22T18:15:48.763702117Z" > } > } > ], > "resultCount": 0, > "totalCount": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | | `/iga/governance/resource/{id}/assignments/user` | GET | Gets the users assigned to a specific entitlement.> **Collapse: Parameters** > > Name Description id string \* required Unique identifier of the application. pageSize integer Number of results per page. pageNumber integer Page number of the response result to return. sortBy string Property on which to sort the results. sortDesc string Direction to sort the results. The available values are asc and desc. queryString string Search string to filter the results, for example, userName, givenName, and sn.> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "result": [ > { > "user": { > "id": "string", > "userName": "string", > "givenName": "string", > "sn": "string", > "mail": "string" > }, > "account": {}, > "item": {}, > "relationship": {} > } > ], > "resultCount": 0, > "totalCount": 0, > "searchAfterKey": [ > "string" > ] > } > ``` | ### Deprecated These endpoints are deprecated and are no longer being updated. These endpoints might be removed in a future release. | URI | HTTP method | Description | | ---------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/admin/certification` | GET | Returns certification campaigns based on the provided query parameters.> **Collapse: Parameters** > > Name Description queryString string String to search name and description. \_pageSize integer Number of response results to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string Property on which to sort the results. \_sortDir string Direction of sort: asc or desc. \_sortType string Type of sort value. Special types of fields need this parameter to sort. Currently, the supported special types are: date and integer. This can be omitted for other fields. \_searchAfter string Sort property values of the last entry to which continue searching. Comma-separated for multiple values. status string Filter by certification status. The available values are: active and closed. certificationType string Filter by certification type. The available values are: identity, roleMembership, and entitlement.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/admin/certification/{certId}` | GET | Returns certification campaigns based on the provided campaign ID.> **Collapse: Parameters** > > Name Description {certId} string required Certification campaign ID.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 404 Certification not found 500 Server error | | `/iga/governance/admin/certification/{certId}/tasks` | GET | Returns the tasks assigned to different certifiers for the given certification campaign ID.> **Collapse: Parameters** > > Name Description {certId} string required Certification campaign ID. queryString string Search tasks based on reviewer information. For example, userName, sn, givenName, and mail. pageSize string Number of results per page. pageNumber string Page number of results to display. sortBy string Property to sort results by. For example, actor.userName, progress. sortDir string Direction to sort results by: asc or desc.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/entitlementGrant/glossary` | GET | Returns the glossary specific details of a single entitlement grant using the account and entitlement IDs.> **Collapse: Parameters** > > Name Description accountId string required Account ID. entitlementId string required Entitlement ID. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Responses** > > Code Description 200 OK 404 Request cannot be found. | | `/iga/governance/entitlementGrant/glossary` | POST | Create a glossary entry for a single entitlement grant using the account and entitlement IDs.> **Collapse: Parameters** > > Name Description accountId string required Account ID. entitlementId string required Entitlement ID. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "confidenceScore": 85 > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Request error. | | `/iga/governance/entitlementGrant/glossary` | PUT | Create or update a glossary entry for a single entitlement grant using the account and entitlement IDs.> **Collapse: Parameters** > > Name Description accountId string required Account ID. entitlementId string required Entitlement ID. \_action string required Action to perform for the account endpoint. Available value: create. Accept-API-Version string API version to use for the request. If no value is provided, the latest version of the API is used to process the request.> **Collapse: Request body example** > > Media type: `application/json` > > ```json > { > "confidenceScore": 85 > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Request error. | ### Glossary The glossary endpoints manage the Identity Governance glossary. | URI | HTTP method | Description | | ------------------------------------ | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `/iga/commons/glossary/schemaConfig` | GET | Returns glossary schema entries, organized by object.> **Collapse: Parameters** > > None> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "/openidm/managed/role": [ > { > "name": "string", > "displayName": "string", > "description": "string", > "type": "string", > "managedObjectType": "string", > "searchable": true, > "isMultiValue": true, > "allowedValues": [ > "string" > ] > } > ], > "/openidm/managed/assignment": [ > { > "name": "string", > "displayName": "string", > "description": "string", > "type": "string", > "managedObjectType": "string", > "searchable": true, > "isMultiValue": true, > "allowedValues": [ > "string" > ] > } > ], > "/openidm/managed/application": [ > { > "name": "string", > "displayName": "string", > "description": "string", > "type": "string", > "managedObjectType": "string", > "searchable": true, > "isMultiValue": true, > "allowedValues": [ > "string" > ] > } > ] > } > ``` | ### Roles Roles define privileges for identities. Use the following endpoints to create, view, and manage governance roles. | URI | HTTP method | Description | | ----------------------------------------------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/role` | GET | Query governance roles based on multiple query parameters.> **Collapse: Parameters** > > Name Description \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. For example, user.userName, application.name, id. \_pageSize integer Number of response result objects to return. Default: 10. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. Default: 10. \_sortKeys string The property on which to sort the results. For example, application.name. \_sortDir string The direction of sort, asc or desc. Default: asc. \_sortType string The type of sort value. Use this parameter for special types of fields to be sorted. Supported special types are date and integer. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. \_queryFilter string The search query filter. roleStatus string The status of the role(s) to query (candidate, draft, pending, active). skipEnrichment boolean Skip adding glossary entries to result. forceSearchNonManaged boolean Search for non-managed active roles.> **Collapse: Responses** > > Code Description 200 OK 500 Server error | | `/iga/governance/role` | POST | Create a new draft of a governance role.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "role": { > "roleId": "string", > "status": "draft", > "name": "string", > "normalized_role_name": "string", > "managedRoleId": "string", > "candidateRoleId": "string", > "lastCertified": "string", > "confidenceScore": 0, > "applications": [ > {} > ], > "rolePolicies": [ > { > "id": "string", > "attributes": [ > {} > ], > "entitlements": [ > "string" > ] > } > ], > "justifications": [ > "string" > ], > "entitlements": [ > "string" > ], > "addedRoleMembers": [ > "string" > ] > }, > "glossary": { > "roleOwner": "string", > "requestable": false, > "isApprovalRequired": false, > "description": "string", > "isGrantJustificationRequired": "string", > "approvers": [ > "string" > ], > "riskLevel": 0 > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/role/{roleId}/{status}` | GET | Get a specific governance role object by ID and status.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to retrieve. status string \* required Status of the role to retrieve.> **Collapse: Responses** > > Code Description 200 OK 404 Role entry doesn't exist. 500 Server error | | `/iga/governance/role/{roleId}/{status}` | PUT | Update a role's contents. Provide the full contents to replace the existing contents.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to update. status string \* required Status of the role to update.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "role": { > "roleId": "string", > "status": "draft", > "name": "string", > "normalized_role_name": "string", > "managedRoleId": "string", > "candidateRoleId": "string", > "lastCertified": "string", > "confidenceScore": 0, > "applications": [ > {} > ], > "rolePolicies": [ > { > "id": "string", > "attributes": [ > {} > ], > "entitlements": [ > "string" > ] > } > ], > "justifications": [ > "string" > ], > "entitlements": [ > "string" > ], > "addedRoleMembers": [ > "string" > ] > }, > "glossary": { > "roleOwner": "string", > "requestable": false, > "isApprovalRequired": false, > "description": "string", > "isGrantJustificationRequired": "string", > "approvers": [ > "string" > ], > "riskLevel": 0 > } > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/role/{roleId}/{status}` | PATCH | Publish a governance role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to publish. status string \* required Status of the role to publish.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "addAutoRoleMembers": true, > "updateIdm": true > } > ```> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/role/{roleId}/{status}` | DELETE | Delete an existing governance role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to delete. status string \* required Status of the role to delete.> **Collapse: Responses** > > Code Description 200 OK 400 Invalid request 500 Server error | | `/iga/governance/role/members` | GET | Get role member information. Returns user details for members associated with a role by user features and added members.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to get members for. status string \* required Status of the role to get members for. \_queryFilter string The search query filter. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string The property on which to sort the results. \_sortDir string The direction of sort, asc or desc. \_sortType string The type of sort value. Use this parameter for special types of fields to be sorted. Supported special types are date and integer. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. requestId string The request ID for a role request.> **Collapse: Responses** > > Code Description 200 Query results | | `/iga/governance/role/entitlements` | GET | Get entitlement information. Returns the entitlement details for entitlements associated with a role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to get entitlements for. status string \* required Status of the role to get entitlements for. \_queryFilter string The search query filter. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string The property on which to sort the results. \_sortDir string The direction of sort, asc or desc. \_sortType string The type of sort value. Use this parameter for special types of fields to be sorted. Supported special types are date and integer. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. requestId string The request ID for a role request.> **Collapse: Responses** > > Code Description 200 Query results | | `/iga/governance/role/{roleId}/{status}/members` | GET | Get role member information. Returns user details for members associated with a role by user features and added members.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to get members for. status string \* required Status of the role to get members for. \_queryFilter string The search query filter. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string The property on which to sort the results. \_sortDir string The direction of sort, asc or desc. \_sortType string The type of sort value. Use this parameter for special types of fields to be sorted. Supported special types are date and integer. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. requestId string The request ID for a role request.> **Collapse: Responses** > > Code Description 200 Query results | | `/iga/governance/role/{roleId}/{status}/entitlements` | GET | Get entitlement information. Returns the entitlement details for entitlements associated with a role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to get entitlements for. status string \* required Status of the role to get entitlements for. \_queryFilter string The search query filter. \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. \_pageSize integer Number of response result objects to return. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. \_sortKeys string The property on which to sort the results. \_sortDir string The direction of sort, asc or desc. \_sortType string The type of sort value. Use this parameter for special types of fields to be sorted. Supported special types are date and integer. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. requestId string The request ID for a role request.> **Collapse: Responses** > > Code Description 200 Query results | | `/iga/governance/role/{roleId}/{status}/glossary` | GET | Get the metadata for a governance role's glossary entry. Returns the key-value pairs for all the metadata on a role's glossary entry.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to read entry for. status string \* required Status of the role to read entry for.> **Collapse: Responses** > > Code Description 200 The contents of the glossary entry, key-value pairs. 404 Glossary or role entry doesn't exist. | | `/iga/governance/role/{roleId}/{status}/glossary` | POST | Create a glossary entry for a governance role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to create entry for. status string \* required Status of the role to create entry for.> **Collapse: Request body** > > The contents of the new glossary entry, key-value pairs. > > Media type: `/` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 200 The contents of the new glossary entry, key-value pairs. 400 Invalid data provided or glossary already exists. 404 Glossary or role entry doesn't exist. 500 Server error on save. | | `/iga/governance/role/{roleId}/{status}/glossary` | PUT | Update the glossary data for a governance role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to update entry for. status string \* required Status of the role to update entry for.> **Collapse: Request body** > > The contents of the updated glossary entry, key-value pairs. > > Media type: `/` > > ```json > {} > ```> **Collapse: Responses** > > Code Description 200 The contents of the updated glossary entry, key-value pairs. 400 Invalid data provided. 404 Glossary or role entry doesn't exist. 500 Server error on save. | | `/iga/governance/role/{roleId}/{status}/glossary` | DELETE | Delete the metadata for a governance role's glossary entry.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the role to delete entry for. status string \* required Status of the role to delete entry for.> **Collapse: Responses** > > Code Description 200 The delete ID. 400 Invalid data provided. 404 Glossary or role entry doesn't exist. 500 Server error on save. | | `/iga/governance/role/{roleId}/{status}/statistics` | POST | Get new statistics (for example, member counts, confidence score) based on changes made to a candidate role.> **Collapse: Parameters** > > Name Description roleId string \* required ID of the candidate role to compare against. status string \* required Status of the candidate role.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "justifications": [ > { > "operation": "add", > "justification": "string" > } > ], > "entitlements": [ > { > "operation": "add", > "id": "string" > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 OK. 400 Invalid request. 500 Server error.> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "confidence": 0, > "previousConfidence": 0, > "memberCount": 0, > "previousMemberCount": 0, > "entitlements": [ > {} > ], > "entitlementMetadata": [ > {} > ], > "justifications": [ > {} > ], > "justificationMetadata": [ > {} > ] > } > ``` | ### Role mining The role mining endpoints provide statistics and insights for Identity Governance role discovery and candidate roles. | URI | HTTP method | Description | | --------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/governance/role/metrics` | GET | Get the statistics for a role mining job.> **Collapse: Parameters** > > No parameters> **Collapse: Responses** > > Code Description 200 OK 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "run_id": "string", > "run_date": "Unknown Type: date", > "run_config": { > "conf_threshold": 0, > "ent_threshold": 0, > "freq_threshold": 0, > "job_id": "string", > "stem_enabled": true > }, > "average_confidence": 0, > "covered_assignments_count": 0, > "covered_assignments_percent": 0, > "existing_assignments_count": 0, > "new_assignments_count": 0, > "new_assignments_percent": 0 > } > ``` | | `/iga/governance/role/{roleId}/{status}/statistics` | POST | Get the recalculated statistics for changes made to a candidate role.> **Collapse: Parameters** > > No parameters.> **Collapse: Request body** > > Media type: `application/json` > > ```json > { > "justifications": [ > { > "operation": "add", > "justification": "string" > } > ], > "entitlements": [ > { > "operation": "add", > "id": "string" > } > ] > } > ```> **Collapse: Responses** > > Code Description 200 Query results. 400 Invalid request 500 Server error> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "confidence": 0, > "previousConfidence": 0, > "memberCount": 0, > "previousMemberCount": 0, > "entitlements": [ > {} > ], > "entitlementMetadata": [ > {} > ], > "justifications": [ > {} > ], > "justificationMetadata": [ > {} > ] > } > ``` | ### Rules Get the rules generated by the analytics training job. | URI | HTTP method | Description | | ---------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `/iga/analytics/rules` | GET | Return the rules generated by the analytics training job.> **Collapse: Parameters** > > Name Description \_fields string The list of fields to return for each entry in the response result. Comma-separated for multiple values. For example, user.userName, application.name, id. \_pageSize integer Number of response result objects to return. Default: 10. \_pagedResultsOffset integer Offset number of the record from which to start the paginated results. Default: 10. \_sortKeys string The property on which to sort the results. For example, application.name. \_sortDir string The direction of sort, asc or desc. Default: asc. \_sortType string The type of sort value. Use this parameter for special types of fields to be sorted. Supported special types are date and integer. \_searchAfter string The sort property values of the last entry to continue searching from. Comma-separated for multiple values. \_queryFilter string The search query filter. roleStatus string The status of the role(s) to query (candidate, draft, pending, active). skipEnrichment boolean Skip adding glossary entries to result. forceSearchNonManaged boolean Search for non-managed active roles.> **Collapse: Responses** > > Code Description 200 Query results> **Collapse: Click for an example response** > > Media type: `application/json` > > ```json > { > "totalHits": 0, > "result": [ > { > "antecedent": [ > "string" > ], > "consequent": "string", > "confidence": 0, > "freq": 0, > "freqUnion": 0, > "id": 0 > } > ], > "searchAfterKey": [ > "string" > ] > } > ``` |