Skip to main content
GET
Get

Authorizations

Authorization
string
header
required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

id
string
required

Global id of the account.

Response

The account.

An Oleria Account object represents a user, machine, or token account in an enterprise SaaS application, identity provider, MFA provider, or directory service e.g. Okta, PingOne, ActiveDirectory, GitHub, Salesforce, or ServiceNow

accountRole
string
required

The source application-specific role associated with the account e.g. member, admin, etc. This preserves the underlying information used to determine type and userType of the account, and is referenced when doing identity provider assignment

Example:

"MEMBER"

alias
string
required

The username associated with the account in the application instance

Minimum string length: 1
Example:

"kirtd-oleria"

authenticationFunctions
string[]
required

Authentication functions associated with this account (see AccountAuthenticationFunction)

email
string<email>
required

The primary email address of the Account

Example:

"kirt@oleria.com"

enabled
boolean
required

Is the Account enabled?

Example:

true

hasAPIAccess
boolean
required

Is the Account authorized to access the application's API endpoints?

Example:

false

id
string
required

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

isAdmin
boolean
required

Is the Account an administrator?

Example:

true

mfaRequirements
enum<string>
required

MFA requirements for an Account

Available options:
Adaptive,
EnrollmentRequired,
Excluded,
NotApplicable,
NotRequired,
Required,
Unavailable
Example:

"Required"

objectMetadata
object
required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

ssoRequirements
enum<string>
required

SSO requirements for an Account

Available options:
Configured,
NotApplicable,
NotConfigured,
Required,
Unavailable
Example:

"Required"

subType
enum<string>
required

The following sub-types of account are supported:

  1. Application is used to represent accounts used to represent an "installed" application or custom created service principal for application or federated use. When the sub-type is Application, the source application should also emit ApprovedApplicationUsage for the account
  2. AnonymousUser is used to represent anonymous accounts typically in the context of sharing resources
  3. ExternalUser is used to represent accounts that are outside of the application-defined customer organizational unit, and is typically used in the context of sharing resources]
  4. StandardUser accounts are any user accounts not classified as AnonymousUser or ExternalUser and is typically the majority of accounts managed by an enterprise application
  5. System is used to represent system bots and pre-defined or configurable system service principals e.g. the merge queue bot in GitHub
  6. Unavailable should be indicated when the sub-type of the account cannot be definitively determined as AnonymousUser, ExternalUser, StandardUser, Application, or System based on the absence of endpoint functionality or lack of access
Available options:
Application,
AnonymousUser,
ExternalUser,
StandardUser,
System,
Unavailable
Example:

"Standard"

type
enum<string>
required
  1. Machine accounts are used to represent system-defined accounts and service principals registered with the enterprise application that can take some sort of audited action
  2. Token accounts are used to represent tokens used to impersonate accounts with some restricted scope e.g. personal access tokens
  3. User accounts are used to represent human users of the application
Available options:
Machine,
Token,
User
Example:

"User"

globalId
string
required
enrichedNormalizedEmail
string
required

Normalized version of the email found in Account.Email

enrichedSharingRiskCategory
enum<string>
required

Categories of risk implied by sharing to an entity (account) evaluated as having the given risk category

Available options:
AnonymousEndpoint,
RegisteredEnterpriseEndpoint,
RegisteredInternetEndpoint,
TrustedApplicationEndpoint,
Unavailable
enrichedMFAStatus
object
required

MFAStatus describes the MFA usage currently being enforced for an account including those derived from authentication policy, adaptive security requirements, authorized location constraints, and more. It also includes information about how MFA authentication is operationalized for the account via a list of participating entities such that a graph topology can be built to represent the source of the MFA policies being enforced

oleriaObjectMetadata
object
required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

accountRoleDisplayName
string
Example:

"Org Members"

alternateEmails
string<email>[]

Alternate email aliases for the account's primary email

approvedApplicationPermissions
object[]
approvedApplicationUsages
string[]

Approved application usages associated with this account (see ApprovedApplicationUsage)

assignedLocations
object[]

These are the locations assigned as delivery points for this Account. It is typically populated by identity providers in lieu of the definitive data coming from HRIS integrations

authenticationMethods
object[]
authenticationMethodSelectionPolicy
object

This policy expresses the selection criteria used by an IDP or MFA provider to select authentication methods for use at authentication time (usually as a subset of the enforced authentication methods)

authorizedLocations
object

AuthorizedLocationPolicy is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc.

companyName
string

The name of the company or enterprise associated with the Account

Example:

"Oleria Corporation"

costCenter
string

The cost center associated with the owner of the Account

Example:

"232345"

countryCode
string

ISO-3166-1 A-2 country code assigned to the account

Example:

"US"

createdBy
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

createdByFederation
object

Federation information used when specifying an EntityIdentifier

createdDate
string<date-time>

The date the Account was created

Example:

"2024-05-02T03:17:34.948Z"

department
string

The name of the company or enterprise department associated with the Account

Example:

"Platform Engineering"

directoryEntryFederation
object

Federation information used when specifying an EntityIdentifier

directoryEntryId
string

The directoryEntryId is emitted when this Account object is synced with an Account emitted by a directory. The id here should match the synced Account.id

directoryProviderFederation
object

Federation information used when specifying an EntityIdentifier

directoryProviderId
string

The directoryProviderId indicates the DirectoryProvider defining the sync relationship for this account

displayName
string

The user experience displayable name of the Account holder e.g. a nickname. If this field is not set, then Oleria will set its value to name during processing

Example:

"Kirtliness"

employeeNumber
string

The employee number associated with the Account holder

Example:

"29375"

expirationDate
string<date-time>

The date the Account expires if applicable

Example:

"2024-05-02T03:17:34.948Z"

federationId
string

A FederationId is an account username override used in the context of an authenticated session or in some contexts an Oleria LocallyUniqueAccountId

Example:

"kirt@oleria.dev"

hashIdentifiers
string[]

The hash identifiers are typically emitted in connection with Machine and Token accounts to expose the fact that they can be "unlocked" by access to key material matching the hash. The relevant hash algorithm prefix plus the hash are added to the array of strings so they can be connected to owner or steward accounts by Oleria

jobCode
string

Identifier of the job or job profile of the Account's owner, also known as the Job ID (Workday Job Code — the Job Profile's reference ID; SuccessFactors Job Classification code)

Example:

"343949"

jobFamily
string

The job family of the Account owner's job — a grouping of related jobs that share core knowledge and background requirements (Workday and SuccessFactors Job Family). Narrower than jobFamilyGroup and broader than specialization

Example:

"Software Engineering"

jobFamilyGroup
string

The broadest grouping of job families for the Account owner's job (Workday Job Family Group)

Example:

"Technology"

jobFunction
string

The functional role or occupation of the Account's owner. A role-level descriptor, not a broad grouping — occupational groupings belong in jobFamily / jobFamilyGroup

Example:

"Product Manager"

lastActivityDate
string<date-time>

The date of the last activity performed by the Account

Example:

"2024-05-02T03:17:34.948Z"

lastModifiedBy
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

lastModifiedByFederation
object

Federation information used when specifying an EntityIdentifier

lastModifiedDate
string<date-time>

The date the Account was last modified

Example:

"2024-05-02T03:17:34.948Z"

lastPasswordChangedDate
string<date-time>

The date the Account password was last changed

Example:

"2024-05-02T03:17:34.948Z"

licenseLevel
enum<string>

The license regime under which the account is currently active or was last activated

Available options:
Free,
NotApplicable,
Paid,
Unassigned,
Unavailable
Example:

"Paid"

licenseStatus
enum<string>

Is the account license active or inactive?

Available options:
Active,
Inactive,
NotApplicable
Example:

"Active"

licenseType
string

The application-specific license type (or plan) used by the Account

Example:

"Enterprise Plan"

managerEmails
string[]

Array of manager emails for the employee that has the Account

name
string

The name (ideally full name) of the Account holder

Minimum string length: 1
Example:

"Kirt Debique"

objectDirectoryContainerFederation
object

Federation information used when specifying an EntityIdentifier

objectDirectoryContainerId
string

An identifier (unique to the integrated application) for a ObjectDirectory object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id)"

profileMetadata
object[]

An array of profile key-value pairs extending the schema of the Account object

provisioning
object[]
secondaryAccountRoles
string[]

Additional underlying account roles associated with the Account object

sourceTag
string

An application-specific tag representing the Account information data source

Example:

"OrgOwners"

specialization
string

A finer sub-discipline within the Account owner's jobFamily. There is no standard Workday or SuccessFactors foundation field for this — it is sourced from an org-defined specialty or sub-classification. Not the Workday Job Category field, which is a regulatory/EEO classification. Distinct from the business title

Example:

"Site Reliability"

title
string

The job title of the Account holder

Example:

"Chief Architect"

globalAuthorizedLocations
object

AuthorizedLocationPolicy is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc.

globalCreatedBy
string
globalDirectoryEntryId
string
globalDirectoryProviderId
string
globalLastModifiedBy
string
globalObjectDirectoryContainerId
string
globalProfileMetadata
object[]
enrichedDataClassifications
object[]
enrichedNonHumanIdentityRisk
object

Aggregate access-risk posture for a non-human identity (Machine/Token account), derived from its impersonation and application-assignment relationships. Omitted for human accounts.

enrichedNormalizedAlternateEmails
string[]

Normalized version of each alternate email found in Account.AlternateEmails

analyticsAccessToResourceInstancesCount
integer<int64> | null

Cached count of resource instances this account can access. Values above 1000 may be approximate.

analyticsAssignedApplicationCount
integer<int32> | null
analyticsAssignedGroupCount
integer<int32> | null
analyticsAssignedOwners
string[]

Names of owners assigned through Oleria's ownership-governance workflow - for example, non-human-identity ownership assignment.

analyticsAssignedRoleCount
integer<int32> | null
analyticsDataLabelsCount
integer<int32> | null
analyticsDaysSinceLastActivity
integer<int32> | null
analyticsImpersonationTargetCount
integer<int32> | null

Number of user accounts this non-human identity (Machine/Token account) can impersonate - a blast-radius indicator for NHI access risk. 0 when the identity has no impersonation reach. Null for human accounts or when not computed.

analyticsLastActivityDate
string<date-time>

Most recent activity observed on this account.

analyticsSourceOwners
string[]

Names of owners derived from the source system's management relationships.

sorPrimaryStewardEmail
string