> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Get > Returns an activity by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml get /v1/activities/{id} openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/activities/{id}: get: tags: - Activities summary: Get description: >- Returns an activity by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. operationId: GetActivity parameters: - name: id in: path description: Global id of the activity. required: true schema: type: string responses: '200': description: The activity. content: application/json: schema: $ref: '#/components/schemas/Oleria_Activity' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/read components: schemas: Oleria_Activity: type: object description: > An Oleria Activity represents the action's taken by an [Oleria Account](#/components/schemas/Oleria Account) and notifications from a system or application as typically retrieved and processed from IDP, SaaS application, directory service, or other audit logs allOf: - $ref: '#/components/schemas/Activity' - $ref: '#/components/schemas/Oleria_ActivityGlobalIdentifiers' - $ref: '#/components/schemas/Oleria_ActivityEnrichedInformation' - $ref: '#/components/schemas/Oleria_ActivityAnalyticsInformation' - required: - oleriaObjectMetadata type: object properties: oleriaObjectMetadata: $ref: '#/components/schemas/Oleria_ObjectMetadata' Activity: required: - activatedPermissionsAvailable - activityType - actorAccountId - affectedObjectId - affectedObjectType - applicationActivityType - errorCode - id - objectMetadata - timestamp type: object properties: activatedPermissionsAvailable: type: boolean description: > If this is true, then the activatedPermissionSets are correct even if len(activatedPermissionSets) is zero. Otherwise, the activated permissions should be treated as unknown activatedPermissionSets: type: array description: > An array of permission specifications (one per resource class) associated with this activity items: $ref: '#/components/schemas/PermissionSetSpecification' activity: type: string description: The description of the activity that was logged example: CI activityMetadata: type: array description: >- An array of additional metadata values associated with the activity including cached activity data about the affected object using a namespace string equal to the affectedObjectType items: $ref: '#/components/schemas/MetadataItem' activityType: $ref: '#/components/schemas/ActivityType' actorAccountFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' actorAccountId: $ref: '#/components/schemas/LocallyUniqueAccountId' actorAuthenticationContext: type: string description: > An authentication method specific context that may be used by the platform to connect authentication activity and sessions across ApplicationInstances. For example, an enterprise application that has SSO to an identity provider could emit an event with an authentication method of SSO and an authentication context with the base64 encoded SHA256 hash of the authentication token. The corresponding IDP would emit an authentication activity with a method of Passkey and the same authentication token. This enables enrichment of application activities with the SSO authentication method. When the authentication context is empty (because the application could not provide the hash of the token), the Oleria platform will use other heuristics to try to connect the application activity with IDP authentication example: fBDpDdUUN1z0jMIUg1saZQmaA9Dx3B+0IPdcHG0fN4c= actorAuthenticationMethods: type: array description: Authentication methods associated with this activity and actor example: - BiometricAuthenticator - Passkey items: $ref: '#/components/schemas/AuthenticationMethod' actorAuthenticationScopes: $ref: '#/components/schemas/PermissionScopeSpecification' actorImpersonatorReference: $ref: '#/components/schemas/ImpersonatorReferenceInformation' actorLocation: $ref: '#/components/schemas/LocationSpecification' affectedObjectFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' affectedObjectId: $ref: '#/components/schemas/LocallyUniqueId' affectedObjectType: $ref: '#/components/schemas/ObjectType' applicationActivityType: type: string description: >- The application-specific activity type that is sometimes schematized to an Oleria activity type as defined by ActivityType. If there is a schematized corresponding activity type, then applicationActivityType gives additional application-specific information about the activity e.g. Login.Success == org.sso_response for GitHub in the SSO login scenario. If there is not a relevant schematized type then activityType is ApplicationSpecific and the applicationActivityType is used to communicate the full information about the type of activity e.g. workflows.completed_workflow_run (GitHub), drive.access (Google Workspace) example: >- org.sso_response (GitHub), workflows.completed_workflow_run (GitHub), drive.access (Google Workspace) authenticationContextHistory: type: array description: > Historical _actorAuthenticationContext_ entries that can be associated with this _Activity_ items: type: string browserName: type: string description: >- The name of the browser used for a web-based activity if applicable and available example: Chrome browserVersion: type: string description: >- The version of the browser used for a web-based activity if applicable and available example: '126' errorCode: type: integer description: >- For any activity type indicating failure e.g. login.failed, a reason code can be emitted with the activity example: 404 errorCodeType: $ref: '#/components/schemas/ActivityErrorCodeType' errorDescription: type: string description: Error description string example: The requested resource was not found id: $ref: '#/components/schemas/LocallyUniqueId' ipAddress: type: string format: ip example: 192.39.212.89 objectDirectoryContainerFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' objectDirectoryContainerId: $ref: '#/components/schemas/LocallyUniqueObjectDirectoryId' objectMetadata: $ref: '#/components/schemas/ObjectMetadata' oleriaActivityTypeSpecificData: type: object description: >- Activity type specific data when activity type is an OleriaActivityType oneOf: - $ref: '#/components/schemas/AccessToDeletedActivityData' - $ref: '#/components/schemas/AuthenticationMethods' - $ref: '#/components/schemas/ContainerContentActivityInformation' - $ref: '#/components/schemas/LabelInformation' - $ref: '#/components/schemas/OwnershipChangeActivityData' - $ref: '#/components/schemas/RelationshipActivityData' - $ref: '#/components/schemas/UnmanagedApplicationEntitlementInfo' osName: type: string description: >- The name of the operating system being used by the source of the activity if available example: OSX osVersion: type: string description: >- The version of the operating system being used by the source of the activity if available example: 10.15.7 pageUri: type: string description: >- The URI of the entity being used by the source of a web-based activity if applicable and available format: uri example: /lightning/r/Opportunity/006Dn000007rkDYIAY/view requestorAccountFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' requestorAccountId: $ref: '#/components/schemas/LocallyUniqueAccountId' secondaryAffectedObjects: type: array items: $ref: '#/components/schemas/EntityIdentifier' timestamp: type: string description: The timestamp of the activity format: date-time example: '2024-05-02T03:17:34.948Z' description: > An Activity object represents an entry in an identity provider or application audit log. Activities are used by Oleria to deliver account analytics, group analytics, role mining, graph activity overlay, and many other features. A key part of interpreting an activity is through the lens of the activity type (especially Oleria schematized activity types). The [ActivityType](#/components/schemas/ActivityType) gives a description on how to interpret type specific data and what to expect for the activity's affected object Oleria_ActivityGlobalIdentifiers: required: - globalActorAccountId - globalAffectedObjectId - globalId type: object properties: globalActivatedPermissionSets: type: array items: $ref: '#/components/schemas/PermissionSetSpecification' globalActorAccountId: type: string globalActorImpersonatorReference: $ref: '#/components/schemas/ImpersonatorReferenceInformation' globalAffectedObjectId: type: string globalId: type: string globalObjectDirectoryContainerId: type: string globalRequestorAccountId: type: string globalSecondaryAffectedObjects: type: array items: type: string description: > Global identifiers translated from Activity local identifiers to be composed on Oleria Activity. Note that this will at times include fields that have embedded identifiers e.g. ActivitatedPermissionSets from Activity Oleria_ActivityEnrichedInformation: type: object properties: enrichedActivatedPermissionFlags: type: array nullable: true description: > Compact integer-bitmask encoding of the permissions this activity activated, derived by mapping the activated permission specifications (Activity.activatedPermissionSets - coarse create/read/update/delete/execute/share/privileged access plus any application-specific fine-grained specifiers) through the application's permission catalog. Enables efficient permission filtering without traversing the nested globalActivatedPermissionSets structure. items: type: integer format: int64 enrichedUserAgent: type: string description: > Enriched information derived from a combination of Activity data, additional identity signals Oleria_ActivityAnalyticsInformation: type: object properties: analyticsActorAccountAlias: type: string analyticsActorAccountName: type: string analyticsActorAccountSubType: $ref: '#/components/schemas/AccountSubType' analyticsActorAccountType: $ref: '#/components/schemas/AccountType' analyticsActorEmployeeType: type: string analyticsAffectedObjectName: type: string analyticsSecondaryAffectedObjectNames: type: array items: type: string description: > Analytics information calculated from identity security graph and added to the activity. Importantly, this information is not guaranteed to be correlated to the timestamp of the activity, but rather is useful information for filtering and analytics with a "timestamp" associated with the time of record processing and storage Oleria_ObjectMetadata: type: object properties: enrichmentVersion: type: string generatedTime: type: string format: date-time description: > object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. PermissionSetSpecification: type: object properties: fineGrainedResourceClass: type: string description: >- The class of resource that the _fineGrainedSpecifiers_ are associated with example: repo fineGrainedSpecifiers: type: array example: - manage_github_actions_permissions_policy - view_collaborators items: type: string formattedScopes: $ref: '#/components/schemas/PermissionScopeSpecification' isCreate: type: boolean description: Create access permission isDelete: type: boolean description: Delete access permission isExecute: type: boolean description: Execute access permission isPrivileged: type: boolean description: Privileged access permission isRead: type: boolean description: Read access permission isShare: type: boolean description: Sharing access permission isUpdate: type: boolean description: Update access permission ownershipLevel: $ref: '#/components/schemas/PermissionLevel' owners: type: array items: $ref: '#/components/schemas/EntityIdentifier' permissionGroupId: type: string specificationMetadata: type: array description: >- An array of additional metadata items associated with the permission specification items: $ref: '#/components/schemas/MetadataItem' description: >- Coarse and fine grained specification of a set of permissions that can be associated with an Oleria object or relationship MetadataItem: type: object properties: id: type: string name: type: string namespace: type: string type: $ref: '#/components/schemas/MetadataValueType' value: type: object ActivityType: type: string description: > An Oleria schematization of activity types to enable type specific system processing. The following table details the type-specific data associated with these schematized activities as well as the affected object. Note: for enterprise applications and directories, xxxApplication == IntegratedApplication; for identity providers a) xxxApplication == AssignedApplication for SSO login activity, b) xxxApplication == IntegratedApplication for any other activities including local login and logout | Activity Type | Data | Affected Object | |-------------------------------------------|---------------------------------------------------------------------|-----------------------------| | AccessTo.Deleted | [Link](#/components/schemas/AccessToDeletedActivityData) | ResourceInstance | | Account.AccountRoleChanged | N/A | Account | | Account.Disabled | N/A | Account | | Account.Enabled | N/A | Account | | Account.Impersonated | N/A | Account | | Authentication.Methods.Added | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Methods.Authorized | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Methods.Removed | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Methods.ResetAllowed | N/A | Integrated Application | | Authentication.Methods.ResetDisallowed | N/A | Integrated Application | | Authentication.Methods.Revoked | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Methods.Updated | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Policy.General.Added | N/A | Integrated Application | | Authentication.Policy.General.Removed | N/A | Integrated Application | | Authentication.Policy.General.Updated | N/A | Integrated Application | | Authentication.Policy.Method.NotRequired | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Policy.Method.Required | [Link](#/components/schemas/AuthenticationMethods) | Integrated Application | | Authentication.Policy.MFA.Adaptive | N/A | Integrated Application | | Authentication.Policy.MFA.NotRequired | N/A | Integrated Application | | Authentication.Policy.MFA.Required | N/A | Integrated Application | | Authentication.Policy.Password.Added | N/A | Integrated Application | | Authentication.Policy.Password.Removed | N/A | Integrated Application | | Authentication.Policy.Password.Updated | N/A | Integrated Application | | Authentication.Policy.SSO.NotRequired | N/A | Integrated Application | | Authentication.Policy.SSO.Required | N/A | Integrated Application | | Authentication.Policy.SSO.Updated | N/A | Integrated Application | | Authentication.Secret.Added | N/A | Secret dependent | | Authentication.Secret.Removed | N/A | Secret dependent | | Authentication.Secret.Rotated | N/A | Secret dependent | | Authentication.Secret.Updated | N/A | Secret dependent | | Authorization.Access.Authorized | N/A | Resource Instance | | Authorization.Access.Denied | N/A | Resource Instance | | Authorization.Access.Granted | N/A | Resource Instance | | Authorization.Access.Requested | N/A | Resource Instance | | Authorization.Access.Revoked | N/A | Resource Instance | | Authorization.Access.Updated | N/A | Resource Instance | | Authorization.Requirements.Created | N/A | Resource Instance | | Authorization.Requirements.Deleted | N/A | Resource Instance | | Authorization.Requirements.Updated | N/A | Resource Instance | | Authorization.UnmanagedApplication.Granted | [Link](#/components/schemas/UnmanagedApplicationEntitlementInfo) | Account | | Authorization.UnmanagedApplication.Revoked | [Link](#/components/schemas/UnmanagedApplicationEntitlementInfo) | Account | | Container.Content.Activity |[Link](#/components/schemas/ContainerContentActivityInformation) | Resource Instance | | Content.Download.Failed | N/A | Resource Instance | | Content.Download.Success | N/A | Resource Instance | | Content.Upload.Failed | N/A | Resource Instance | | Content.Upload.Success | N/A | Resource Instance | | Endpoint.Access.AccountToService.Failed | N/A | Integrated Application | | Endpoint.Access.AccountToService.Success | N/A | Integrated Application | | Endpoint.Access.AccountToUnmanagedApplication.Failed | N/A | Account | | Endpoint.Access.AccountToUnmanagedApplication.Success | N/A | Account | | Endpoint.Access.ServiceToService.Failed | N/A | Integrated Application | | Endpoint.Access.ServiceToService.Success | N/A | Integrated Application | | Label.Added | [Link](#/components/schemas/LabelInformation) | Label target dependent | | Label.Created | [Link](#/components/schemas/LabelInformation) | Label target dependent | | Label.Destroyed | [Link](#/components/schemas/LabelInformation) | Label target dependent | | Label.Updated | [Link](#/components/schemas/LabelInformation) | Label target dependent | | Label.Removed | [Link](#/components/schemas/LabelInformation) | Label target dependent | | License.Added | N/A | License dependent | | License.Assigned | N/A | License dependent | | License.Removed | N/A | License dependent | | License.Unassigned | N/A | License dependent | | License.Updated | N/A | License dependent | | Login.Failed | N/A | xxxApplication | | Login.Remote.Failed | N/A | Resource Instance | | Login.Remote.Success | N/A | Resource Instance | | Login.Success | N/A | xxxApplication | | Logout | N/A | xxxApplication | | Logout.Remote | N/A | Resource Instance | | Object.Created | N/A | Object dependent | | Object.Deleted | N/A | Object dependent | | Object.Updated | N/A | Object dependent | | Ownership.Added | [Link](#/components/schemas/OwnershipChangeActivityData) | Resource whose ownership changed | | Ownership.Removed | [Link](#/components/schemas/OwnershipChangeActivityData) | Resource whose ownership changed | | Ownership.Transferred | [Link](#/components/schemas/OwnershipChangeActivityData) | Resource whose ownership changed | | Password.ChangedByUser | N/A | User Account | | Password.ChangedForUser | N/A | User Account | | Password.ResetByUser | N/A | User Account | | Password.ResetForUser | N/A | User Account | | Relationship.Created | [Link](#/components/schemas/RelationshipActivityData) | None | | Relationship.Deleted | [Link](#/components/schemas/RelationshipActivityData) | None | | Relationship.Updated | [Link](#/components/schemas/RelationshipActivityData) | None | | Security.Notification | N/A | Setting dependent | | Settings.Updated | N/A | Setting dependent | | Suspicious.Login.Failed | N/A | xxxApplication | | Suspicious.Login.Success | N/A | xxxApplication | | App.Custom | N/A | App dependent | example: Login.Success enum: - AccessTo.Deleted - Account.AccountRoleChanged - Account.Disabled - Account.Enabled - Account.Impersonated - Authentication.Methods.Added - Authentication.Methods.Authorized - Authentication.Methods.Removed - Authentication.Methods.ResetAllowed - Authentication.Methods.ResetDisallowed - Authentication.Methods.Revoked - Authentication.Methods.Updated - Authentication.Policy.General.Added - Authentication.Policy.General.Removed - Authentication.Policy.General.Updated - Authentication.Policy.Method.NotRequired - Authentication.Policy.Method.Required - Authentication.Policy.MFA.Adaptive - Authentication.Policy.MFA.NotRequired - Authentication.Policy.MFA.Required - Authentication.Policy.Password.Added - Authentication.Policy.Password.Removed - Authentication.Policy.Password.Updated - Authentication.Policy.SSO.NotRequired - Authentication.Policy.SSO.Required - Authentication.Policy.SSO.Updated - Authentication.Secret.Added - Authentication.Secret.Removed - Authentication.Secret.Rotated - Authentication.Secret.Updated - Authorization.Access.Authorized - Authorization.Access.Denied - Authorization.Access.Granted - Authorization.Access.Requested - Authorization.Access.Revoked - Authorization.Access.Updated - Authorization.Requirements.Created - Authorization.Requirements.Deleted - Authorization.Requirements.Updated - Authorization.UnmanagedApplication.Granted - Authorization.UnmanagedApplication.Revoked - Container.Content.Activity - Content.Download.Failed - Content.Download.Success - Content.Upload.Failed - Content.Upload.Success - Endpoint.Access.AccountToService.Failed - Endpoint.Access.AccountToService.Success - Endpoint.Access.AccountToUnmanagedApplication.Failed - Endpoint.Access.AccountToUnmanagedApplication.Success - Endpoint.Access.ServiceToService.Failed - Endpoint.Access.ServiceToService.Success - Label.Added - Label.Created - Label.Destroyed - Label.Updated - Label.Removed - License.Added - License.Assigned - License.Removed - License.Unassigned - License.Updated - Login.Failed - Login.Remote.Failed - Login.Remote.Success - Login.Success - Logout - Logout.Remote - Object.Created - Object.Deleted - Object.Updated - Ownership.Added - Ownership.Removed - Ownership.Transferred - Password.ChangedByUser - Password.ChangedForUser - Password.ResetByUser - Password.ResetForUser - Relationship.Created - Relationship.Deleted - Relationship.Updated - Secret.Added - Secret.Deleted - Secret.Revocation.Failed - Secret.Revocation.Success - Secret.Updated - Secret.Verification.Failed - Secret.Verification.Success - Security.Notification - Settings.Updated - Suspicious.Login.Failed - Suspicious.Login.Success - Token.Revocation.Failed - Token.Revocation.Requested - Token.Revocation.Success - App.Custom EntityIdentifierFederationInformation: type: object required: - isFederated properties: authenticationKey: type: string isFederated: type: boolean description: | Federation information used when specifying an _EntityIdentifier_ LocallyUniqueAccountId: type: string description: > An identifier (unique to integrated application) for an [Account](#/components/schemas/Account) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug) AuthenticationMethod: type: object properties: type: type: string description: type: string description: > Authentication methods describe how an [Account](#/components/schemas/Account) is required to authenticate to an enterprise application or identity provider. [Account](#/components/schemas/Account) include a list of enrolled authentication methods for the account, and [Activity](#/components/schemas/Activity) will include the authentication method used for login and other events. The type [AuthenticationMethodType](#/components/schemas/AuthenticationMethodType) is a string that can be one of many different authentication methods recognized by Oleria PermissionScopeSpecification: type: object properties: specifiers: type: array description: Formatted scopes as specified by type items: type: string type: $ref: '#/components/schemas/PermissionScopeType' description: Scope specification optionally specified in a PermissionSetSpecification ImpersonatorReferenceInformation: type: object properties: accountReference: description: >- Reference to the impersonating account which is interpreted based on the impersonationType oneOf: - $ref: '#/components/schemas/FederatedAccountAccessInformation' - $ref: '#/components/schemas/LocalAccountAccessInformation' - $ref: '#/components/schemas/PrivateTokenAccountAccessInformation' type: $ref: '#/components/schemas/ImpersonationType' description: >- The ImpersonatorReferenceInformation describes the impersonating account for an activity that is based on the impersonation auth method LocationSpecification: type: object properties: type: $ref: '#/components/schemas/LocationSpecificationType' typeSpecificData: oneOf: - $ref: '#/components/schemas/NetworkLocationSpecification' - $ref: '#/components/schemas/PhysicalLocationSpecification' LocallyUniqueId: minLength: 1 type: string description: > An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration ObjectType: type: string description: >- The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage example: Account enum: - Account - AccountRole - Activity - AssignedApplication - Authenticator - AuthenticatorEnrollment - Department - DirectoryProvider - Employee - IntegratedApplication - None - ObjectDirectory - PermissionSet - Person - ResourceClass - ResourceInstance - RiskDefinition - RiskViolation - Role - UserGroup ActivityErrorCodeType: type: string enum: - HTTP - IntegratedApplication LocallyUniqueObjectDirectoryId: type: string description: > An identifier (unique to the integrated application) for a [ObjectDirectory](#/components/schemas/ObjectDirectory) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) ObjectMetadata: required: - ApplicationInstanceId - GeneratedTime type: object properties: ApplicationInstanceId: type: string GeneratedTime: type: string format: date-time Profile: $ref: '#/components/schemas/SchemaProfile' ObjectOrRelationshipType: type: string description: > The _ObjectMetadata_ structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data AccessToDeletedActivityData: type: object properties: fromId: $ref: '#/components/schemas/LocallyUniqueId' toId: $ref: '#/components/schemas/LocallyUniqueId' description: >- Activity specific data for [AccessTo.Deleted](#/components/schemas/ActivityType) AuthenticationMethods: type: object properties: entries: type: array items: $ref: '#/components/schemas/AuthenticationMethod' ContainerContentActivityInformation: type: object properties: activityType: $ref: '#/components/schemas/ActivityType' applicationActivityType: type: string description: type: string name: type: string oleriaActivityTypeSpecificData: type: object description: >- Activity type specific data when activity type is an Oleria ActivityType oneOf: - $ref: '#/components/schemas/AccessToDeletedActivityData' - $ref: '#/components/schemas/ContainerContentActivityInformation' - $ref: '#/components/schemas/RelationshipActivityData' - $ref: '#/components/schemas/AuthenticationMethods' - $ref: '#/components/schemas/EntityIdentifier' uri: type: string description: > This data structure is used to convey information regarding a content notification coming out of a container LabelInformation: type: object properties: description: type: string name: type: string description: > Information used to describe a label for data classification, data sensitivity, etc. OwnershipChangeActivityData: type: object properties: newOwnerId: $ref: '#/components/schemas/EntityIdentifier' priorOwnerId: $ref: '#/components/schemas/EntityIdentifier' description: > Activity-specific data for the Ownership.* activity family. Carries the owner principal(s) for ownership state changes. EntityIdentifier (not LocallyUniqueAccountId) because owners can be non-account principals (ServicePrincipals, etc.). priorOwnerId is null for Ownership.Added; newOwnerId is null for Ownership.Removed; both populated for Ownership.Transferred. RelationshipActivityData: type: object properties: federationSpecification: $ref: '#/components/schemas/FederatedRelationshipSpecification' relationshipFromId: $ref: '#/components/schemas/LocallyUniqueId' relationshipFromType: $ref: '#/components/schemas/ObjectType' relationshipId: $ref: '#/components/schemas/LocallyUniqueId' relationshipToId: $ref: '#/components/schemas/LocallyUniqueId' relationshipToType: $ref: '#/components/schemas/ObjectType' relationshipType: $ref: '#/components/schemas/RelationshipType' relationshipTypeSpecificData: oneOf: - $ref: '#/components/schemas/EntitlementSpecification' - $ref: '#/components/schemas/ImpersonationRestrictions' - $ref: '#/components/schemas/PermissionSetSpecification' - $ref: '#/components/schemas/ScopedMembershipPermissions' description: >- Details the information about a relationship (edge) associated with a Relationship.XXX activity UnmanagedApplicationEntitlementInfo: type: object required: - applicationName - grantedScopesStatus - vendorVerificationStatus description: > Type-specific data for Authorization.UnmanagedApplication.Granted and Authorization.UnmanagedApplication.Revoked activity events. Carries the state of an OAuth grant from a user to a Shadow IT / unmanaged application discovered via IdP OAuth grant logs. An unmanaged application is one where a user granted OAuth access via their own initiative, bypassing IT governance entirely. This is distinct from admin-provisioned SSO applications (EntitlementReason.SSO) and undergoverned applications (where an admin made a deliberate provisioning decision without full governance lifecycle). For unmanaged application usage signals, see Endpoint.Access.AccountToUnmanagedApplication.Success/Failed — those activity types carry no type-specific data; scope usage is expressed via activatedPermissionSets on the Activity object. properties: applicationDescription: type: string description: >- Human-readable description of the unmanaged app from the IdP OAuth app registration. Primarily useful for human triage; lower-signal for platform risk scoring. applicationMetadata: type: array description: >- Application-specific additional context about the unmanaged application. items: $ref: '#/components/schemas/MetadataItem' applicationName: minLength: 1 type: string description: >- Display name of the shadow/unmanaged app as reported by the IdP. If the IdP has no name, the source application should synthesize one from clientId. clientId: type: string description: >- OAuth client ID of the unmanaged app. Enables cross-tenant correlation of the same OAuth registration. Also serves as a fallback identifier when applicationName is ambiguous. grantedScopes: $ref: '#/components/schemas/PermissionScopeSpecification' description: >- The OAuth scopes the user granted to the unmanaged app. Populated only when grantedScopesStatus is GrantedAndObservable. grantedScopesStatus: $ref: '#/components/schemas/GrantedScopesStatus' vendorName: type: string description: >- Developer or vendor name as reported by the IdP. Consistent with vendorName usage on AssignedApplication, IntegratedApplication, and DirectoryProvider. vendorVerificationStatus: $ref: '#/components/schemas/VendorVerificationStatus' EntityIdentifier: type: object properties: federationInformation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' objectId: $ref: '#/components/schemas/LocallyUniqueId' objectType: $ref: '#/components/schemas/ObjectType' description: > Used for typed indentification of an entity (node) in the graph with values for _objectId_ and _objectType_ AccountSubType: type: string description: > The following sub-types of account are supported: 1. _Application_ is used to represent accounts used to represent an "installed" application or custom created service principal for application or federated use. When the sub-type is _Application_, the source application should also emit [ApprovedApplicationUsage](#/components/schemas/ApprovedApplicationUsage) for the account 2. _AnonymousUser_ is used to represent anonymous accounts typically in the context of sharing resources 3. _ExternalUser_ is used to represent accounts that are outside of the application-defined customer organizational unit, and is typically used in the context of sharing resources] 4. _StandardUser_ accounts are any user accounts not classified as _AnonymousUser_ or _ExternalUser_ and is typically the majority of accounts managed by an enterprise application 5. _System_ is used to represent system bots and pre-defined or configurable system service principals e.g. the merge queue bot in GitHub 5. _Unavailable_ should be indicated when the sub-type of the account cannot be definitively determined as _AnonymousUser_, _ExternalUser_, _StandardUser_, _Application_, or _System_ based on the absence of endpoint functionality or lack of access example: Standard enum: - Application - AnonymousUser - ExternalUser - StandardUser - System - Unavailable AccountType: type: string description: > 1. _Machine_ accounts are used to represent system-defined accounts and service principals registered with the enterprise application that can take some sort of audited action 2. _Token_ accounts are used to represent tokens used to impersonate accounts with some restricted scope e.g. personal access tokens 3. _User_ accounts are used to represent human users of the application example: User enum: - Machine - Token - User PermissionLevel: type: string description: > The level of ownership of the permission granting access to a Resource or ResourceInstance: 1. _AccessReviewOwner_ indicates that the assignee of the represented permission is a (or the) designated access reviewer and an owner from the perspective of Governance 2. _NotApplicable_ indicates that a permission level is not relevant in the context of the permission set specification 3. _Owner_ means that the assignee of the represented permission is also an owner of the Resource or ResourceInstance 4. _User_ indicates that the assignee of the represented permission is simply a user or accessor or the Resource or ResourceInstance example: Owner enum: - AccessReviewOwner - NotApplicable - Owner - User MetadataValueType: type: string enum: - array_boolean - array_float32 - array_float64 - array_int32 - array_int64 - array_string - boolean - float32 - float64 - int32 - int64 - oleria_global_id - oleria_local_id - pem - property_bag - rfc3339_date - string PermissionScopeType: type: string description: >- The enumerated list of scope formats optionally specified in a PermissionSetSpecification enum: - OAuth FederatedAccountAccessInformation: type: object properties: authenticationKey: type: string description: > If present, the authentication key can be used to find a specific federation target application instance. It is required for some federation protocols e.g. Trustfusion where the federationId is a locally unique account id federationId: $ref: '#/components/schemas/FederationId' federationProtocol: $ref: '#/components/schemas/FederationProtocol' description: >- The FederatedAccountAccessInformation details the information required to connect accounts across a federated link LocalAccountAccessInformation: type: object properties: accountId: $ref: '#/components/schemas/LocallyUniqueAccountId' description: >- The LocalAccountAccessInformation details the information required to connect accounts within an application instance PrivateTokenAccountAccessInformation: type: object properties: tokenData: type: string description: Used to describe an impersonator reference by a private token ImpersonationType: type: string enum: - Federated - Local - PrivateToken LocationSpecificationType: type: string enum: - Network - Physical NetworkLocationSpecification: type: object properties: ipAddressExclusions: type: array items: type: string ipAddressInclusions: type: array items: type: string name: type: string supplementaryInformation: $ref: '#/components/schemas/SupplementaryLocationInformation' description: > Specify a network location or zone with a name and a list of IP addresses or ranges (including in CIDR notation) PhysicalLocationSpecification: type: object properties: addressedObjectIdentifier: $ref: '#/components/schemas/AddressedObjectIdentifier' countryLevelInformation: $ref: '#/components/schemas/CountryLevelInformation' locality: $ref: '#/components/schemas/Locality' postcode: type: string description: | Postal code or ZIP code example: '98112' supplementaryInformation: $ref: '#/components/schemas/SupplementaryLocationInformation' description: > A subset of the ISO 19160-4:2023 delivery point specification. For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 SchemaProfile: type: string enum: - Account - Membership - Governance - Risk - Access - Detection FederatedRelationshipSpecification: type: object required: - isFederated properties: connectionType: $ref: '#/components/schemas/FederatedRelationshipConnectionType' isFederated: type: boolean sourceAuthenticationKey: type: string targetAuthenticationKey: type: string description: > Used to specify if an emitted relationship is federated, and if so, how Oleria can connect the participating objects in a composite graph RelationshipType: type: string description: >- The enumerated list of all Oleria relationships used to describe and manage the connections among Oleria objects. Furthermore, these connections amongst objects complete the definiton of an Oleria composite graph used to represent a customer's full (potentally cross-application) identity security. The definition of each relationship describes its usage and the description includes a "GraphNotation:" which gives a normative way of describing the relationship using the connected ObjectTypes, abstract Relationship, and potential field matching. example: ResourceInstanceContainsResourceInstance enum: - AccountCanImpersonateAccount - AccountMemberOfRole - AccountMemberOfUserGroup - ApplicationAccountCanImpersonateApplicationAccount - ApplicationAccountMemberOfRole - ApplicationAccountMemberOfUserGroup - AssignedApplicationHasAccountRole - DepartmentContainsDepartment - EmployeeManagesEmployee - EmployeeServingInDepartment - EnrollmentViaAuthenticator - EntityAssignedAccessToObject - EntityCanImpersonateEntity - EntityManagedViaObject - IdentityAccountAssignedAccessToAssignedApplication - IdentityAccountCanImpersonateIdentityAccount - IdentityAccountMemberOfRole - IdentityAccountMemberOfUserGroup - IntegratedApplicationHasAccountRole - IntegratedApplicationRegisteredWithDirectoryProvider - ObjectHasExtension - ObjectDirectoryContainsObject - PermissionSetAccessToResourceInstance - PersonIsEmployee - ResourceClassHasResourceInstance - ResourceInstanceContainsResourceInstance - RoleAccessToResourceClass - RoleAssignedAccessToAssignedApplication - RoleHasPermissionSet - RoleMemberOfRole - UserGroupAssignedAccessToAssignedApplication - UserGroupAssignedAccessToResourceInstance - UserGroupMemberOfRole - UserGroupMemberOfUserGroup - UserGroupSyncsWithUserGroup EntitlementSpecification: type: object properties: inferenceConfidence: type: number description: > If the entitlement is inferred, then this gives a confidence score between 0 and 1 isInferred: type: boolean description: > If false, then the specified entitlement is considered "actual" i.e. known with 100% confidence, if true, then the entitlement is inferred from some set of properties and the _inferenceConfidence_ indicates confidence in the "reality" of the entitlement given relevant data sources. Note: even if an entitlement has 100% confidence, authorized access via the entitlement always needs to be evaluated and tested in real-time reason: $ref: '#/components/schemas/EntitlementReason' reasonSpecificData: description: >- Reason specific data associated with entitlement AssignedAccessTo relationship oneOf: - $ref: '#/components/schemas/AccessControlEntitlementInformation' - $ref: '#/components/schemas/MFAEntitlementInformation' - $ref: '#/components/schemas/SSOEntitlementInformation' description: >- The EntitlementSpecification describes the entitlements associated with an AssignedAccessTo relationship used for access control entitlement or SSO entitlement purposes ImpersonationRestrictions: type: object required: - resourceSpecifierIsClass properties: resourceIdOrClass: type: string resourceSpecifierIsClass: type: boolean scopedPermissions: $ref: '#/components/schemas/PermissionSetSpecification' description: >- The ImpersonationRestrictions describes any resource and scope (permission) restrictions that apply in the context of an impersonation relationship ScopedMembershipPermissions: type: object properties: aggregateOwnershipLevel: $ref: '#/components/schemas/PermissionLevel' name: type: string specifications: type: array items: $ref: '#/components/schemas/PermissionSetSpecification' description: > Permission scoping data associated with membership in [Roles](#/components/schemas/Role) and [UserGroups](#/components/schemas/UserGroup) GrantedScopesStatus: type: string description: >- Observability status of OAuth scopes granted to an unmanaged application. Distinguishes between scopes that are known, granted but not observable, and not granted at all. enum: - GrantedAndObservable - GrantedButUnobservable - NotGranted VendorVerificationStatus: type: string description: >- Whether the IdP has verified the identity of the vendor or publisher who registered the OAuth client. Used globally wherever vendor verification state is relevant. enum: - Verified - Unverified - VerificationStatusUnknown FederationId: type: string description: >- A FederationId is an account username override used in the context of an authenticated session or in some contexts an Oleria LocallyUniqueAccountId example: kirt@oleria.dev FederationProtocol: type: string description: Federation protocols that can be used for entitlements enum: - FirstParty - OAuth - OIDC - RADIUS - SAML - Trustfusion SupplementaryLocationInformation: type: object properties: geoLocation: $ref: '#/components/schemas/GeoLocation' additionalLocationMetadata: type: array items: $ref: '#/components/schemas/MetadataItem' AddressedObjectIdentifier: type: object properties: building: type: string description: > Element identifying the number or name and type of the location edifice or construction example: The Madrona Refuge Building door: type: string description: | Element identifying the apartment, room, or office example: Suite 301 premisesIdentifier: type: string description: > Element designating the area or the object on an area associated with the location example: 1126 34th Avenue description: > Subset of an ISO 19160-4:2023 construct identifying a specific addess within a [Locality](#/components/schemas/Locality). For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 CountryLevelInformation: type: object properties: countryCode: type: string description: > Element designating the ISO 3166-1 A-2 country code for the country, territory or area of geopolitical interest example: US countryName: type: string description: > Element designating the country, dependency, or area of geopolitical interest example: United States multiCountryRegion: type: string description: > Element indicating a region in which the country, territory, or area of geopolitical interest is located and by which it is potentially more effectively recognized example: North America description: > Subset of ISO 19160-4:2023 country level information. For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 Locality: type: object properties: district: type: string description: > Element indicating the name of the area within or adjacent to the specified town example: Madrona (neighborhood in Seattle) region: type: string description: > Element specifying the geographic or administrative area of the country in which the town is situated example: Washington town: type: string description: > Element indicating the name of the populated place associated with the [LocationSpecification](#/components/schemas/LocationSpecification) in which this _Locality_ is being referenced example: Seattle description: > Subset of ISO 19160-4:2023 locality information identifying the geographical area. For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 FederatedRelationshipConnectionType: type: string enum: - Source - SourceAndTarget - Target EntitlementReason: type: string description: >- EntitlementReason indicates why a particular entitlement has been assigned in the context of an EntitlementSpecification for an AssignedAccessTo relationship enum: - AccessControl - MFA - SSO AccessControlEntitlementInformation: type: object required: - enabled properties: accessControlMetadata: type: array description: >- An array of high level metadata values associated with the access control (separate from the metadata specifically associated with the underlying conditions or permissions). This would typically be application-specific encoding metadata associated with the entitlement that is not already schematized internally items: $ref: '#/components/schemas/MetadataItem' conditions: $ref: '#/components/schemas/ConditionSpecification' description: type: string enabled: type: boolean name: type: string permissions: $ref: '#/components/schemas/PermissionSetSpecification' shareableUri: type: string description: > A optional shareable URI that resolves to the access control target via the described entitlement and subject to the permissions described therein shareableUriLabel: type: string description: > An optional label that can be used when displaying the _shareableUri_ sourceTag: type: string description: An application-specific reason for the entitlement type: $ref: '#/components/schemas/AccessControlEntitlementType' description: >- The AccessControlEntitlementInformation indicates _(typically in the context of an AssignedAccessTo edge)_ the entitlement conditions, permissions granted or denied, and any other contextual information used by the authorization function when evaluating the entitlement MFAEntitlementInformation: type: object properties: authorizedLocations: $ref: '#/components/schemas/AuthorizedLocationPolicy' conditions: $ref: '#/components/schemas/ConditionSpecification' mfaMetadata: type: array description: A array of additional metadata values associated with the MFA items: $ref: '#/components/schemas/MetadataItem' description: | Additional context for an MFA based entitlement specification SSOEntitlementInformation: type: object properties: assignment: $ref: '#/components/schemas/SSOAssignmentSpecification' protocol: $ref: '#/components/schemas/FederationProtocol' protocolMetadata: type: array description: >- A array of additional metadata values associated with the entitlement assignment protocol items: $ref: '#/components/schemas/MetadataItem' description: >- The SSOEntitlementInformation gives additional context for a entitlement based AssignedAccessTo edge for SSO purposes GeoLocation: type: object required: - latitude - longtitude properties: latitude: type: number longtitude: type: number description: Latitude and longtitude specification for a location ConditionSpecification: type: object properties: context: type: array description: Additional context used when evaluating the conditional access items: $ref: '#/components/schemas/MetadataItem' overrides: type: array items: $ref: '#/components/schemas/ConditionOverrideSpecifier' rootOperator: $ref: '#/components/schemas/ConditionOperator' AccessControlEntitlementType: type: string description: >- As part of [AccessControlEntitlementInformation](#/components/schemas/AccessControlEntitlementInformation), the type enumeration indicates if the permissions in the entitlement are granted or denied when the entitlement is evaluated by an authorization function enum: - Denial - Grant AuthorizedLocationPolicy: type: object required: - isInherited properties: isInherited: type: boolean description: > When set to true this indicates that the location policy is inherited from another object, otherwise the location policy is directly specified policy: oneOf: - $ref: '#/components/schemas/AuthorizedEntityLocationPolicy' - $ref: '#/components/schemas/AuthorizedInheritedLocationPolicy' description: > _AuthorizedLocationPolicy_ is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc. SSOAssignmentSpecification: type: object properties: assignedApplicationTrust: $ref: '#/components/schemas/AssignedApplicationTrust' assignedApplicationScopes: $ref: '#/components/schemas/PermissionScopeSpecification' lastModifiedDate: type: string description: | The date the _Account_ was last modified format: date-time example: '2024-05-02T03:17:34.948Z' type: $ref: '#/components/schemas/SSOAssignmentType' typeSpecificAssignment: oneOf: - $ref: '#/components/schemas/SSOAccountAssignmentSpecification' - $ref: '#/components/schemas/SSOUserGroupAssignmentSpecification' ConditionOverrideSpecifier: type: string enum: - AllowAdmin - AllowAll - AllowAnonymous - DenyAdmin - DenyAll - DenyAnonymous ConditionOperator: type: object properties: operator: oneOf: - $ref: '#/components/schemas/ConditionArrayOperator' - $ref: '#/components/schemas/ConditionComparisonOperator' - $ref: '#/components/schemas/ConditionContentSearchOperator' - $ref: '#/components/schemas/ConditionGraphOperator' - $ref: '#/components/schemas/ConditionLogicalOperator' - $ref: '#/components/schemas/ConditionSecureScriptOperator' type: $ref: '#/components/schemas/ConditionOperatorType' AuthorizedEntityLocationPolicy: type: object required: - allowAll properties: allowAll: type: boolean description: | When set to true this indicates that all locations are authorized authorizedLocations: type: array description: > These are the locations authorized for use by the entity that has this policy. If none are specified then no locations are allowed. If any are specified and it is desirable for the _assignedLocations_ to be authorized, then they must be explicitly included in the array items: $ref: '#/components/schemas/LocationSpecification' description: > _AuthorizedEntityLocationPolicy_ is used to specify locations authorized for use by the specific entity that it is attached to AuthorizedInheritedLocationPolicy: type: object properties: sourceObjectType: $ref: '#/components/schemas/ObjectType' sourceObjectId: $ref: '#/components/schemas/LocallyUniqueId' description: > _AuthorizedInheritedLocationPolicy_ is used to specify an object that is the source for the location authorization data used by the specific entity the _AuthorizedInheritedLocationPolicy_ is attached to AssignedApplicationTrust: type: string description: > The level of trust an identity provider indicates for the assignment of an application to an [Account](#/components/schemas/Account) or [UserGroup](#/components/schemas/UserGroup) enum: - Blocked - NotApplicable - Trusted - Unavailable - Untrusted SSOAssignmentType: type: string description: Types of SSO assigment associated with an entitlement enum: - Account - Group SSOAccountAssignmentSpecification: type: object properties: accountOverride: $ref: '#/components/schemas/AccountOverrideInformation' accountRoles: type: array description: >- The application-specific roles to be associated with accounts in the group e.g. member, admin, etc. items: type: string externalAccountId: type: string description: Account identifier in the external system being federated federationId: type: string description: Identifier used to match accounts across the federation relationship type: $ref: '#/components/schemas/SSOAccountAssignmentType' SSOUserGroupAssignmentSpecification: type: object properties: accountRolesForGroup: type: array description: >- The application-specific roles to be associated with accounts in the group e.g. member, admin, etc. items: type: string memberOverride: $ref: '#/components/schemas/UserGroupMemberOverrideInformation' ConditionArrayOperator: type: object required: - isArrayGeneratingDynamicValue properties: isArrayGeneratingDynamicValue: type: boolean arrayOpKey: $ref: '#/components/schemas/ConditionKey' arrayOpType: $ref: '#/components/schemas/ConditionArrayOperatorType' arrayOpValue: oneOf: - $ref: '#/components/schemas/ConditionArrayStaticValues' - $ref: '#/components/schemas/DynamicConditionValue' description: >- Condition used to specify conditional access based on presence or absence of the key data in the given array of values ConditionComparisonOperator: type: object properties: comparisonOpKey: $ref: '#/components/schemas/ConditionKey' comparisonOpType: $ref: '#/components/schemas/ConditionComparisonOperatorType' comparisonOpValue: $ref: '#/components/schemas/ConditionValue' description: >- Condition used to specify conditional access based on key - value comparison ConditionContentSearchOperator: type: object required: - searchOpIsDynamicCondition properties: searchOpIsDynamicCondition: type: boolean searchOpValue: oneOf: - $ref: '#/components/schemas/DynamicContentCondition' - $ref: '#/components/schemas/StaticContentCondition' description: >- Condition used to specify conditional access based on data inside a resource instance ConditionGraphOperator: type: object properties: graphOpSource: $ref: '#/components/schemas/ConditionGraphOperatorEntityIdentifier' graphOpTargets: type: array items: $ref: '#/components/schemas/ConditionGraphOperatorEntityIdentifier' graphOpTypes: $ref: '#/components/schemas/ConditionGraphOperatorType' description: >- Condition used to specify conditional access based on graph entity relationships ConditionLogicalOperator: type: object properties: logicalOpOperands: type: array items: $ref: '#/components/schemas/ConditionOperator' logicalOpType: $ref: '#/components/schemas/ConditionLogicalOperatorType' description: >- Condition used to specify conditional access based on a logical (AND, OR, NOT, EXISTS, ORDERED) operation ConditionSecureScriptOperator: type: object properties: contentType: $ref: '#/components/schemas/SecureScriptContentType' context: type: array description: >- Additional context used when accessing the data referenced by the condition key e.g. Function key parameters items: $ref: '#/components/schemas/MetadataItem' executionEngine: type: string scriptContent: type: string version: type: string description: A condition used to specify a script based conditional access expression ConditionOperatorType: type: string description: Categories of operators that can be used with conditional expressions enum: - Array - Comparison - ContentSearch - Graph - Logical - SecureScript AccountOverrideInformation: type: object properties: alias: minLength: 1 type: string description: The username associated with the account in the application instance example: kirtd-oleria companyName: type: string description: The name of the company or enterprise associated with the account example: Oleria Corporation department: type: string description: >- The name of the company or enterprise department associated with the account example: Engineering displayName: type: string description: >- The user experience displayable name of the account holder e.g. a nickname. If this field is not set, then Oleria will set its value to name during processing example: Kirtliness email: type: string description: The primary email address of the account format: email example: kirt@oleria.com employeeNumber: type: string description: The employee number associated with the account holder example: '29375' jobFunction: type: string description: The job function associated with the owner of the account example: Engineering name: minLength: 1 type: string description: The name (ideally full name) of the account holder example: Kirt Debique title: type: string description: The job title of the account holder example: Chief Architect description: >- When an SSO entitlement federation protocol allows override of account information, the overrides are specified via the AccountOverrideInformation SSOAccountAssignmentType: type: string description: Types of account assignment enum: - Direct - ViaGroup UserGroupMemberOverrideInformation: type: object required: - overridePriority properties: overrideMetadata: type: array description: >- An array of metadata items containing the override attribute name, type, and value items: $ref: '#/components/schemas/MetadataItem' overridePriority: type: number description: >- The priority used to resolve conflicts in assignment across multiple groups description: >- For SSO entitlement when accounts are assigned access via groups, this information is used to override certain attributes on the accounts ConditionKey: type: object properties: keySpecification: oneOf: - $ref: '#/components/schemas/ConditionKeyFunctionSpecifier' - $ref: '#/components/schemas/ConditionKeyObjectSpecifier' type: $ref: '#/components/schemas/ConditionKeyType' value: type: string description: >- Identifies the entity or function data used to evaluate the validity of a condition against the specified condition value ConditionArrayOperatorType: type: string description: Supported operators for array conditions enum: - In - NotIn ConditionArrayStaticValues: type: object properties: values: type: array items: $ref: '#/components/schemas/StaticConditionValue' description: Array of static values used as an operand in array conditions DynamicConditionValue: type: object properties: dynamicConditionValueContext: type: array description: >- This context can be passed to the function that resolves the dynamic specification to a static one items: $ref: '#/components/schemas/MetadataItem' dynamicConditionValueData: type: string description: >- Type for dynamic conditional access expression values. These will resolve to static ConditionValueTypes (or arrays of static ConditionValueTypes) by a relevant authorization function ConditionComparisonOperatorType: type: string description: Supported operators for comparison conditions enum: - Contains - DoesNotContain - Equal - GreaterThan - GreaterThanOrEqual - LessThan - LessThanOrEqual - NotEqual ConditionValue: type: object required: - isDynamic properties: data: oneOf: - $ref: '#/components/schemas/DynamicConditionValue' - $ref: '#/components/schemas/StaticConditionValue' isDynamic: type: boolean description: Typed condition value for static or dynamic values DynamicContentCondition: type: object required: - dynamicContentConditionCaseSensitive - dynamicContentConditionDiacriticSensitive properties: dynamicContentConditionCaseSensitive: type: boolean dynamicContentConditionDiacriticSensitive: type: boolean dynamicContentConditionLangage: type: string dynamicContentConditionResourceInstanceId: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' dynamicContentConditionSearch: $ref: '#/components/schemas/ConditionKey' description: >- A condition used to a target content search conditional access expression with a dynamic search string StaticContentCondition: type: object required: - staticContentConditionCaseSensitive - staticContentConditionDiacriticSensitive properties: staticContentConditionCaseSensitive: type: boolean staticContentConditionDiacriticSensitive: type: boolean staticContentConditionLanguage: type: string staticContentConditionResourceInstanceId: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' staticSearch: type: string description: >- A condition used to specify a target content search conditional access expression with a static search string ConditionGraphOperatorEntityIdentifier: type: object required: - isDynamicEntityIdentifier properties: isDynamicEntityIdentifier: type: boolean value: oneOf: - $ref: >- #/components/schemas/ConditionGraphOperatorConditionKeyEntityIdentifier - $ref: '#/components/schemas/EntityIdentifier' description: >- ConditionGraphOperatorEntityIdentifier is used to reference a entity (node) in the graph ConditionGraphOperatorType: type: string description: Supported operators for graph conditions enum: - AssignedAccessTo - MemberOf ConditionLogicalOperatorType: type: string description: Supported operators for logical conditions enum: - And - Exists - Not - Or - Ordered SecureScriptContentType: type: string description: Content types used to specify scripts for conditional access enum: - JavaScript - JSON - XML ConditionKeyFunctionSpecifier: type: object properties: parameters: type: array description: >- Optional parameters used when accessing the data referenced by the condition key e.g. Function key parameters items: $ref: '#/components/schemas/MetadataItem' ConditionKeyObjectSpecifier: type: object properties: name: type: string description: >- Contextual object specifier for a condition key that is derefencing its value from an object type ConditionKeyType: type: string description: > The following types of keys are used to specify conditional access expressions: 1. A _Function_ key is used to identify a runtime function that will resolve to a value e.g. isLoggedIn, isImpersonatingUser, etc. 2. A _Object_ key is used to identify a particular field on an object where the value of the field on the object is used to determine the validity of the condition enum: - Function - Object StaticConditionValue: type: object properties: staticConditionValueType: $ref: '#/components/schemas/ConditionValueType' staticConditionValueData: type: object description: Type for static conditional access expression values LocallyUniqueResourceInstanceId: type: string description: > An identifier (unique to the integrated application) for a [ResourceInstance](#/components/schemas/ResourceInstance) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) ConditionGraphOperatorConditionKeyEntityIdentifier: type: object properties: objectIdConditionKey: $ref: '#/components/schemas/ConditionKey' objectTypeConditionKey: $ref: '#/components/schemas/ConditionKey' description: > ConditionGraphOperatorConditionKeyEntityIdentifier is used to reference a entity (node) in the graph with [ConditionKey](#/components/schemas/ConditionKey)-based dynamic values for _objectId_ and _objectType_ ConditionValueType: type: string description: >- Types for condition values used in specifying static conditional access expression values enum: - activity_type - boolean - float - int32 - int64 - object - object_type - relationship_type - string responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. NotFound: description: No resource exists with the given id. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: NOT_FOUND message: No resource with the given id. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````