Get

Get

curl --request GET \
  --url https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

"(:Account{id:impersonatingEntityId})-[relationship:CanImpersonate]->(:ObjectDirectory{id:impersonatedEntityId})"

{
  "code": "BAD_REQUEST",
  "message": "The request was malformed."
}

{
  "code": "UNAUTHORIZED",
  "message": "Missing or invalid authentication token."
}

{
  "code": "FORBIDDEN",
  "message": "The token lacks the required scope."
}

{
  "code": "NOT_FOUND",
  "message": "No resource with the given id."
}

{
  "code": "TOO_MANY_REQUESTS",
  "message": "Rate limit exceeded. Retry after the specified interval."
}

{
  "code": "INTERNAL_ERROR",
  "message": "An unexpected error occurred."
}

GET

entity-can-impersonate-entity

{id}

Get

curl --request GET \
  --url https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://devx.{environment}.oleria.io/v1/entity-can-impersonate-entity/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

"(:Account{id:impersonatingEntityId})-[relationship:CanImpersonate]->(:ObjectDirectory{id:impersonatedEntityId})"

{
  "code": "BAD_REQUEST",
  "message": "The request was malformed."
}

{
  "code": "UNAUTHORIZED",
  "message": "Missing or invalid authentication token."
}

{
  "code": "FORBIDDEN",
  "message": "The token lacks the required scope."
}

{
  "code": "NOT_FOUND",
  "message": "No resource with the given id."
}

{
  "code": "TOO_MANY_REQUESTS",
  "message": "Rate limit exceeded. Retry after the specified interval."
}

{
  "code": "INTERNAL_ERROR",
  "message": "An unexpected error occurred."
}

Authorizations

Authorization

string

header

required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

string

required

Global id of the impersonation grant.

Response

The impersonation grant.

An Oleria EntityCanImpersonateEntity relationship represents an explicit authorization for one entity (Oleria Account, Oleria Role, or Oleria UserGroup) to act on behalf of another entity. Direction: impersonating to impersonated. globalImpersonatingEntityId/Type identify the entity granted the authorization; globalImpersonatedEntityId/Type identify the target. Impersonation grants apply transitively to entities nested under the target.

string

required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1

impersonatedEntityId

string

required

Minimum string length: 1

impersonatedEntityType

enum<string>

required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:

Account,

AccountRole,

Activity,

Agent,

AgentVersion,

AssignedApplication,

Authenticator,

AuthenticatorEnrollment,

Credential,

Department,

DirectoryProvider,

Employee,

IntegratedApplication,

None,

ObjectDirectory,

PermissionSet,

Person,

ResourceClass,

ResourceInstance,

RiskDefinition,

RiskViolation,

Role,

UserGroup

Example:

"Account"

impersonatingEntityId

string

required

Minimum string length: 1

impersonatingEntityType

enum<string>

required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:

Account,

AccountRole,

Activity,

Agent,

AgentVersion,

AssignedApplication,

Authenticator,

AuthenticatorEnrollment,

Credential,

Department,

DirectoryProvider,

Employee,

IntegratedApplication,

None,

ObjectDirectory,

PermissionSet,

Person,

ResourceClass,

ResourceInstance,

RiskDefinition,

RiskViolation,

Role,

UserGroup

Example:

"Account"

objectMetadata

object

required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

Show child attributes

globalId

string

required

Opaque platform-assigned identifier for this relationship instance.

globalImpersonatedEntityId

string

required

Global ID of the entity that may be impersonated. Valid values reference Oleria Account, Oleria Role, or Oleria UserGroup.

globalImpersonatedEntityType

enum<string>

required

Object type of the impersonated entity. Expected values: Oleria Account, Oleria Role, Oleria UserGroup.

Available options:

Oleria_Account,

Oleria_AccountRole,

Oleria_Activity,

Oleria_Application,

Oleria_ApplicationDeployment,

Oleria_AssignedApplication,

Oleria_Authenticator,

Oleria_AuthenticatorEnrollment,

Oleria_Credential,

Oleria_Department,

Oleria_DirectoryProvider,

Oleria_DiscoveredApplication,

Oleria_Employee,

Oleria_IntegratedApplication,

Oleria_ObjectDirectory,

Oleria_Person,

Oleria_ResourceClass,

Oleria_ResourceInstance,

Oleria_Role,

Oleria_UserGroup

Example:

"Oleria_IntegratedApplication"

globalImpersonatingEntityId

string

required

Global ID of the entity granted authorization to impersonate. Valid values reference Oleria Account, Oleria Role, or Oleria UserGroup.

globalImpersonatingEntityType

enum<string>

required

Object type of the impersonating entity. Expected values: Oleria Account, Oleria Role, Oleria UserGroup.

Available options:

Oleria_Account,

Oleria_AccountRole,

Oleria_Activity,

Oleria_Application,

Oleria_ApplicationDeployment,

Oleria_AssignedApplication,

Oleria_Authenticator,

Oleria_AuthenticatorEnrollment,

Oleria_Credential,

Oleria_Department,

Oleria_DirectoryProvider,

Oleria_DiscoveredApplication,

Oleria_Employee,

Oleria_IntegratedApplication,

Oleria_ObjectDirectory,

Oleria_Person,

Oleria_ResourceClass,

Oleria_ResourceInstance,

Oleria_Role,

Oleria_UserGroup

Example:

"Oleria_IntegratedApplication"

oleriaObjectMetadata

object

required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

Show child attributes

authorityMode

enum<string>

Whose authority an entity exercises when it acts against an object, or for another entity. Delegation and Impersonation are the two modes RFC 8693 names for token exchange, and they produce different audit trails and different blast radii:

Delegation is used when the acting entity keeps its own identity and exercises a subset of another entity's authority on its behalf, so the audit trail can name both parties
Impersonation is used when the acting entity becomes indistinguishable from the entity it acts for, so the audit trail names only the entity acted for
Own is used when the entity exercises no authority but its own, which is what a configuration declares when it names the credentials the entity itself holds. It is meaningful only on EntityRequiresObject; EntityCanImpersonateEntity is by definition about another entity's authority and must not carry it
Unavailable should be indicated when the source does not distinguish the modes

Available options:

Delegation,

Impersonation,

Own,

Unavailable

Example:

"Delegation"

federationSpecification

object

Used to specify if an emitted relationship is federated, and if so, how Oleria can connect the participating objects in a composite graph

Show child attributes

isAttenuating

boolean

Indicates whether the acting entity's effective access through this relationship is the intersection of its own authority and the impersonated entity's, rather than the union. On every examined on-behalf-of platform it is an intersection, and mistaking one for the other is the difference between a posture number that is incomplete and one that is wrong. False is the safe reading and is how absence is read, because it renders the wider of the two reaches. The cap itself, where the source states one, is in restrictions

restrictions

object

The ImpersonationRestrictions describes any resource and scope (permission) restrictions that apply in the context of an impersonation relationship

Show child attributes

globalRestrictions

object

The ImpersonationRestrictions describes any resource and scope (permission) restrictions that apply in the context of an impersonation relationship

Show child attributes

Getting Started

Inventory & Actions

Action jobs

TrustFusion

Downloads

Authorizations

Path Parameters

Response