Skip to main content
GET
Get

Authorizations

Authorization
string
header
required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

id
string
required

Global id of the access assignment.

Response

The access assignment.

An Oleria EntityAssignedAccessToObject relationship represents an entity (Oleria Account, Oleria Role, or Oleria UserGroup) assigned access to an object - an application (Oleria AssignedApplication or Oleria ApplicationDeployment) or a resource (Oleria ResourceClass or Oleria ResourceInstance). Direction: entity to assigned object. globalEntityId/Type identify the entity; globalAssignedObjectId/Type identify the object it is granted access to. It is the connector from the IdP layer to the application and resource layers.

assignedObjectId
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
assignedObjectType
enum<string>
required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:
Account,
AccountRole,
Activity,
AssignedApplication,
Authenticator,
AuthenticatorEnrollment,
Department,
DirectoryProvider,
Employee,
IntegratedApplication,
None,
ObjectDirectory,
PermissionSet,
Person,
ResourceClass,
ResourceInstance,
RiskDefinition,
RiskViolation,
Role,
UserGroup
Example:

"Account"

entitlementSpecification
object
required

The EntitlementSpecification describes the entitlements associated with an AssignedAccessTo relationship used for access control entitlement or SSO entitlement purposes

entityId
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
entityType
enum<string>
required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:
Account,
AccountRole,
Activity,
AssignedApplication,
Authenticator,
AuthenticatorEnrollment,
Department,
DirectoryProvider,
Employee,
IntegratedApplication,
None,
ObjectDirectory,
PermissionSet,
Person,
ResourceClass,
ResourceInstance,
RiskDefinition,
RiskViolation,
Role,
UserGroup
Example:

"Account"

id
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
objectMetadata
object
required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

globalAssignedObjectId
string
required

Global ID of the object the entity is assigned access to. References Oleria AssignedApplication, Oleria ApplicationDeployment, Oleria ResourceClass, or Oleria ResourceInstance.

globalAssignedObjectType
enum<string>
required

Object type of the assigned object. Expected values: Oleria AssignedApplication, Oleria ApplicationDeployment, Oleria ResourceClass, Oleria ResourceInstance.

Available options:
Oleria_Account,
Oleria_AccountRole,
Oleria_Activity,
Oleria_Application,
Oleria_ApplicationDeployment,
Oleria_AssignedApplication,
Oleria_Authenticator,
Oleria_AuthenticatorEnrollment,
Oleria_Department,
Oleria_DirectoryProvider,
Oleria_DiscoveredApplication,
Oleria_Employee,
Oleria_IntegratedApplication,
Oleria_ObjectDirectory,
Oleria_Person,
Oleria_ResourceClass,
Oleria_ResourceInstance,
Oleria_Role,
Oleria_UserGroup
Example:

"Oleria_IntegratedApplication"

globalEntitlementSpecification
object
required

The EntitlementSpecification describes the entitlements associated with an AssignedAccessTo relationship used for access control entitlement or SSO entitlement purposes

globalEntityId
string
required

Global ID of the entity granted access. Valid values reference Oleria Account, Oleria Role, or Oleria UserGroup.

globalEntityType
enum<string>
required

Object type of the entity granted access. Expected values: Oleria Account, Oleria Role, Oleria UserGroup.

Available options:
Oleria_Account,
Oleria_AccountRole,
Oleria_Activity,
Oleria_Application,
Oleria_ApplicationDeployment,
Oleria_AssignedApplication,
Oleria_Authenticator,
Oleria_AuthenticatorEnrollment,
Oleria_Department,
Oleria_DirectoryProvider,
Oleria_DiscoveredApplication,
Oleria_Employee,
Oleria_IntegratedApplication,
Oleria_ObjectDirectory,
Oleria_Person,
Oleria_ResourceClass,
Oleria_ResourceInstance,
Oleria_Role,
Oleria_UserGroup
Example:

"Oleria_IntegratedApplication"

globalId
string
required

Opaque platform-assigned identifier for this relationship instance.

oleriaObjectMetadata
object
required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

federationSpecification
object

Used to specify if an emitted relationship is federated, and if so, how Oleria can connect the participating objects in a composite graph

analyticsLoginEventCount
integer<int64> | null

Cached count of authentication/login events observed on this assignment. Populated for entity-to-application entitlement assignments (an identity or group granted access to an application); null for entity-to-resource (ResourceClass/ResourceInstance) access.

analyticsResourceAccessEventCount
integer<int64> | null

Cached count of resource-access events observed on this assignment, inclusive of events on contained resources. Populated for entity-to-resource (ResourceClass/ResourceInstance) access; null for application entitlement assignments.

analyticsLastActivityDate
string<date-time> | null

Most recent activity of any kind observed on this assignment relationship. Null when no activity has been observed on this assignment.

analyticsDaysSinceLastActivity
integer<int32> | null

Dormancy of the assignment - days since the most recent observed activity. Null when no activity has been observed or dormancy is not tracked for this assignment.

analyticsFirstActivityDate
string<date-time> | null

Earliest activity observed on this assignment relationship (first-seen) - the counterpart to analyticsLastActivityDate. Null when no first-seen activity has been recorded for this assignment.