curl --request GET \
--url https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"assignedObjectId": "<string>",
"assignedObjectType": "Account",
"entitlementSpecification": {
"inferenceConfidence": 123,
"isInferred": true,
"reason": "AccessControl",
"reasonSpecificData": {
"enabled": true,
"accessControlMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"conditions": {
"context": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"overrides": [
"AllowAdmin"
],
"rootOperator": {
"operator": {
"isArrayGeneratingDynamicValue": true,
"arrayOpKey": {
"keySpecification": {
"parameters": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"type": "Function",
"value": "<string>"
},
"arrayOpType": "In",
"arrayOpValue": {
"values": [
{
"staticConditionValueType": "activity_type",
"staticConditionValueData": "<unknown>"
}
]
}
},
"type": "Array"
}
},
"description": "<string>",
"name": "<string>",
"permissions": {
"fineGrainedResourceClass": "repo",
"fineGrainedSpecifiers": [
"manage_github_actions_permissions_policy",
"view_collaborators"
],
"formattedScopes": {
"specifiers": [
"<string>"
],
"type": "OAuth"
},
"isCreate": true,
"isDelete": true,
"isExecute": true,
"isPrivileged": true,
"isRead": true,
"isShare": true,
"isUpdate": true,
"ownershipLevel": "Owner",
"owners": [
{
"federationInformation": {
"isFederated": true,
"authenticationKey": "<string>"
},
"objectId": "<string>",
"objectType": "Account"
}
],
"permissionGroupId": "<string>",
"specificationMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"shareableUri": "<string>",
"shareableUriLabel": "<string>",
"sourceTag": "<string>",
"type": "Denial"
}
},
"entityId": "<string>",
"entityType": "Account",
"id": "<string>",
"objectMetadata": {
"ApplicationInstanceId": "<string>",
"GeneratedTime": "2023-11-07T05:31:56Z",
"Profile": "Account",
"ObjectOrRelationshipType": "<string>"
},
"globalAssignedObjectId": "<string>",
"globalAssignedObjectType": "Oleria_IntegratedApplication",
"globalEntitlementSpecification": {
"inferenceConfidence": 123,
"isInferred": true,
"reason": "AccessControl",
"reasonSpecificData": {
"enabled": true,
"accessControlMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"conditions": {
"context": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"overrides": [
"AllowAdmin"
],
"rootOperator": {
"operator": {
"isArrayGeneratingDynamicValue": true,
"arrayOpKey": {
"keySpecification": {
"parameters": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"type": "Function",
"value": "<string>"
},
"arrayOpType": "In",
"arrayOpValue": {
"values": [
{
"staticConditionValueType": "activity_type",
"staticConditionValueData": "<unknown>"
}
]
}
},
"type": "Array"
}
},
"description": "<string>",
"name": "<string>",
"permissions": {
"fineGrainedResourceClass": "repo",
"fineGrainedSpecifiers": [
"manage_github_actions_permissions_policy",
"view_collaborators"
],
"formattedScopes": {
"specifiers": [
"<string>"
],
"type": "OAuth"
},
"isCreate": true,
"isDelete": true,
"isExecute": true,
"isPrivileged": true,
"isRead": true,
"isShare": true,
"isUpdate": true,
"ownershipLevel": "Owner",
"owners": [
{
"federationInformation": {
"isFederated": true,
"authenticationKey": "<string>"
},
"objectId": "<string>",
"objectType": "Account"
}
],
"permissionGroupId": "<string>",
"specificationMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"shareableUri": "<string>",
"shareableUriLabel": "<string>",
"sourceTag": "<string>",
"type": "Denial"
}
},
"globalEntityId": "<string>",
"globalEntityType": "Oleria_IntegratedApplication",
"globalId": "<string>",
"oleriaObjectMetadata": {
"enrichmentVersion": "<string>",
"generatedTime": "2023-11-07T05:31:56Z"
},
"activationRequiresApproval": true,
"activationState": "Active",
"federationSpecification": {
"isFederated": true,
"connectionType": "Source",
"sourceAuthenticationKey": "<string>",
"targetAuthenticationKey": "<string>"
},
"validFrom": "2023-11-07T05:31:56Z",
"validTo": "2023-11-07T05:31:56Z",
"analyticsLoginEventCount": 123,
"analyticsResourceAccessEventCount": 123,
"analyticsLastActivityDate": "2023-11-07T05:31:56Z",
"analyticsDaysSinceLastActivity": 123,
"analyticsFirstActivityDate": "2023-11-07T05:31:56Z"
}{
"code": "BAD_REQUEST",
"message": "The request was malformed."
}{
"code": "UNAUTHORIZED",
"message": "Missing or invalid authentication token."
}{
"code": "FORBIDDEN",
"message": "The token lacks the required scope."
}{
"code": "NOT_FOUND",
"message": "No resource with the given id."
}{
"code": "TOO_MANY_REQUESTS",
"message": "Rate limit exceeded. Retry after the specified interval."
}{
"code": "INTERNAL_ERROR",
"message": "An unexpected error occurred."
}Get
Returns an access assignment by its global id. Requires the https://devx.{environment}.oleria.io/read scope.
curl --request GET \
--url https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://devx.{environment}.oleria.io/v1/entity-assigned-access-to-object/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"assignedObjectId": "<string>",
"assignedObjectType": "Account",
"entitlementSpecification": {
"inferenceConfidence": 123,
"isInferred": true,
"reason": "AccessControl",
"reasonSpecificData": {
"enabled": true,
"accessControlMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"conditions": {
"context": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"overrides": [
"AllowAdmin"
],
"rootOperator": {
"operator": {
"isArrayGeneratingDynamicValue": true,
"arrayOpKey": {
"keySpecification": {
"parameters": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"type": "Function",
"value": "<string>"
},
"arrayOpType": "In",
"arrayOpValue": {
"values": [
{
"staticConditionValueType": "activity_type",
"staticConditionValueData": "<unknown>"
}
]
}
},
"type": "Array"
}
},
"description": "<string>",
"name": "<string>",
"permissions": {
"fineGrainedResourceClass": "repo",
"fineGrainedSpecifiers": [
"manage_github_actions_permissions_policy",
"view_collaborators"
],
"formattedScopes": {
"specifiers": [
"<string>"
],
"type": "OAuth"
},
"isCreate": true,
"isDelete": true,
"isExecute": true,
"isPrivileged": true,
"isRead": true,
"isShare": true,
"isUpdate": true,
"ownershipLevel": "Owner",
"owners": [
{
"federationInformation": {
"isFederated": true,
"authenticationKey": "<string>"
},
"objectId": "<string>",
"objectType": "Account"
}
],
"permissionGroupId": "<string>",
"specificationMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"shareableUri": "<string>",
"shareableUriLabel": "<string>",
"sourceTag": "<string>",
"type": "Denial"
}
},
"entityId": "<string>",
"entityType": "Account",
"id": "<string>",
"objectMetadata": {
"ApplicationInstanceId": "<string>",
"GeneratedTime": "2023-11-07T05:31:56Z",
"Profile": "Account",
"ObjectOrRelationshipType": "<string>"
},
"globalAssignedObjectId": "<string>",
"globalAssignedObjectType": "Oleria_IntegratedApplication",
"globalEntitlementSpecification": {
"inferenceConfidence": 123,
"isInferred": true,
"reason": "AccessControl",
"reasonSpecificData": {
"enabled": true,
"accessControlMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"conditions": {
"context": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
],
"overrides": [
"AllowAdmin"
],
"rootOperator": {
"operator": {
"isArrayGeneratingDynamicValue": true,
"arrayOpKey": {
"keySpecification": {
"parameters": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"type": "Function",
"value": "<string>"
},
"arrayOpType": "In",
"arrayOpValue": {
"values": [
{
"staticConditionValueType": "activity_type",
"staticConditionValueData": "<unknown>"
}
]
}
},
"type": "Array"
}
},
"description": "<string>",
"name": "<string>",
"permissions": {
"fineGrainedResourceClass": "repo",
"fineGrainedSpecifiers": [
"manage_github_actions_permissions_policy",
"view_collaborators"
],
"formattedScopes": {
"specifiers": [
"<string>"
],
"type": "OAuth"
},
"isCreate": true,
"isDelete": true,
"isExecute": true,
"isPrivileged": true,
"isRead": true,
"isShare": true,
"isUpdate": true,
"ownershipLevel": "Owner",
"owners": [
{
"federationInformation": {
"isFederated": true,
"authenticationKey": "<string>"
},
"objectId": "<string>",
"objectType": "Account"
}
],
"permissionGroupId": "<string>",
"specificationMetadata": [
{
"id": "<string>",
"name": "<string>",
"namespace": "<string>",
"type": "array_boolean",
"value": "<unknown>"
}
]
},
"shareableUri": "<string>",
"shareableUriLabel": "<string>",
"sourceTag": "<string>",
"type": "Denial"
}
},
"globalEntityId": "<string>",
"globalEntityType": "Oleria_IntegratedApplication",
"globalId": "<string>",
"oleriaObjectMetadata": {
"enrichmentVersion": "<string>",
"generatedTime": "2023-11-07T05:31:56Z"
},
"activationRequiresApproval": true,
"activationState": "Active",
"federationSpecification": {
"isFederated": true,
"connectionType": "Source",
"sourceAuthenticationKey": "<string>",
"targetAuthenticationKey": "<string>"
},
"validFrom": "2023-11-07T05:31:56Z",
"validTo": "2023-11-07T05:31:56Z",
"analyticsLoginEventCount": 123,
"analyticsResourceAccessEventCount": 123,
"analyticsLastActivityDate": "2023-11-07T05:31:56Z",
"analyticsDaysSinceLastActivity": 123,
"analyticsFirstActivityDate": "2023-11-07T05:31:56Z"
}{
"code": "BAD_REQUEST",
"message": "The request was malformed."
}{
"code": "UNAUTHORIZED",
"message": "Missing or invalid authentication token."
}{
"code": "FORBIDDEN",
"message": "The token lacks the required scope."
}{
"code": "NOT_FOUND",
"message": "No resource with the given id."
}{
"code": "TOO_MANY_REQUESTS",
"message": "Rate limit exceeded. Retry after the specified interval."
}{
"code": "INTERNAL_ERROR",
"message": "An unexpected error occurred."
}Authorizations
OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.
Path Parameters
Global id of the access assignment.
Response
The access assignment.
An Oleria EntityAssignedAccessToObject relationship represents an entity (Oleria Account, Oleria Role, or Oleria UserGroup) assigned access to an object - an application (Oleria AssignedApplication or Oleria ApplicationDeployment) or a resource (Oleria ResourceClass or Oleria ResourceInstance). Direction: entity to assigned object. globalEntityId/Type identify the entity; globalAssignedObjectId/Type identify the object it is granted access to. It is the connector from the IdP layer to the application and resource layers.
An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration
1The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage
Account, AccountRole, Activity, Agent, AgentVersion, AssignedApplication, Authenticator, AuthenticatorEnrollment, Credential, Department, DirectoryProvider, Employee, IntegratedApplication, None, ObjectDirectory, PermissionSet, Person, ResourceClass, ResourceInstance, RiskDefinition, RiskViolation, Role, UserGroup "Account"
The EntitlementSpecification describes the entitlements associated with an AssignedAccessTo relationship used for access control entitlement or SSO entitlement purposes
Show child attributes
Show child attributes
An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration
1The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage
Account, AccountRole, Activity, Agent, AgentVersion, AssignedApplication, Authenticator, AuthenticatorEnrollment, Credential, Department, DirectoryProvider, Employee, IntegratedApplication, None, ObjectDirectory, PermissionSet, Person, ResourceClass, ResourceInstance, RiskDefinition, RiskViolation, Role, UserGroup "Account"
An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration
1The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data
Show child attributes
Show child attributes
Global ID of the object the entity is assigned access to. References Oleria AssignedApplication, Oleria ApplicationDeployment, Oleria ResourceClass, or Oleria ResourceInstance.
Object type of the assigned object. Expected values: Oleria AssignedApplication, Oleria ApplicationDeployment, Oleria ResourceClass, Oleria ResourceInstance.
Oleria_Account, Oleria_AccountRole, Oleria_Activity, Oleria_Application, Oleria_ApplicationDeployment, Oleria_AssignedApplication, Oleria_Authenticator, Oleria_AuthenticatorEnrollment, Oleria_Credential, Oleria_Department, Oleria_DirectoryProvider, Oleria_DiscoveredApplication, Oleria_Employee, Oleria_IntegratedApplication, Oleria_ObjectDirectory, Oleria_Person, Oleria_ResourceClass, Oleria_ResourceInstance, Oleria_Role, Oleria_UserGroup "Oleria_IntegratedApplication"
The EntitlementSpecification describes the entitlements associated with an AssignedAccessTo relationship used for access control entitlement or SSO entitlement purposes
Show child attributes
Show child attributes
Global ID of the entity granted access. Valid values reference Oleria Account, Oleria Role, or Oleria UserGroup.
Object type of the entity granted access. Expected values: Oleria Account, Oleria Role, Oleria UserGroup.
Oleria_Account, Oleria_AccountRole, Oleria_Activity, Oleria_Application, Oleria_ApplicationDeployment, Oleria_AssignedApplication, Oleria_Authenticator, Oleria_AuthenticatorEnrollment, Oleria_Credential, Oleria_Department, Oleria_DirectoryProvider, Oleria_DiscoveredApplication, Oleria_Employee, Oleria_IntegratedApplication, Oleria_ObjectDirectory, Oleria_Person, Oleria_ResourceClass, Oleria_ResourceInstance, Oleria_Role, Oleria_UserGroup "Oleria_IntegratedApplication"
Opaque platform-assigned identifier for this relationship instance.
object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated
Show child attributes
Show child attributes
Indicates whether activating the assignment requires an approval decision, where the source's policy says so. Meaningful only when activationState is Eligible or PendingActivation; an assignment that is already Active records the approval as history rather than as a requirement. False is the safe reading and is how absence is read, because it renders the assignment as the fewer steps away from being in force. It gates one activation, where EntityRequiresObject.approvalRequirement gates every exercise of a declared dependency
Where an assignment stands in a just-in-time lifecycle, for sources that hold assignments in reserve for the entity to activate. Microsoft Entra Privileged Identity Management and entitlement management, AWS IAM Identity Center temporary elevated access and Okta Access Requests all follow the same sequence:
- Active is used when the assignment is in force now, whether it was granted directly or activated
- Eligible is used when the entity may request activation. An eligible assignment is not an ungranted one — it is one activation, and possibly one approval, away from being in force, and a posture measure that ignores it understates reach
- Expired is used when a time-bound activation or assignment has lapsed and the source still records it, so that a reviewer can see what was recently in force
- PendingActivation is used when activation has been requested and the source is awaiting an approval decision or a scheduled start
- Unavailable should be indicated when the source does not distinguish these states, which for most sources means every assignment is in force
Active, Eligible, Expired, PendingActivation, Unavailable "Active"
Used to specify if an emitted relationship is federated, and if so, how Oleria can connect the participating objects in a composite graph
Show child attributes
Show child attributes
The date from which the source declares the assignment in force, where the source bounds it — a time-bound access package assignment or an activated just-in-time assignment
The date after which the source declares the assignment no longer in force, where the source bounds it. A source-declared expiry, not an Oleria policy
Cached count of authentication/login events observed on this assignment. Populated for entity-to-application entitlement assignments (an identity or group granted access to an application); null for entity-to-resource (ResourceClass/ResourceInstance) access.
Cached count of resource-access events observed on this assignment, inclusive of events on contained resources. Populated for entity-to-resource (ResourceClass/ResourceInstance) access; null for application entitlement assignments.
Most recent activity of any kind observed on this assignment relationship. Null when no activity has been observed on this assignment.
Dormancy of the assignment - days since the most recent observed activity. Null when no activity has been observed or dormancy is not tracked for this assignment.
Earliest activity observed on this assignment relationship (first-seen) - the counterpart to analyticsLastActivityDate. Null when no first-seen activity has been recorded for this assignment.
Was this page helpful?