> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Grant a group access > Entitles the group to the application, granting access to every one of its members. The change is applied in the source system asynchronously: this returns a job, and the job reports the outcome, including whether the target could be changed at all. Send an `Idempotency-Key` so a retried request returns the original job instead of submitting a second one. Requires the `https://devx.{environment}.oleria.io/write` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml put /v1/integrated-applications/{id}/assigned-groups/{groupId} openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/integrated-applications/{id}/assigned-groups/{groupId}: put: tags: - Integrated applications summary: Grant a group access description: >- Entitles the group to the application, granting access to every one of its members. The change is applied in the source system asynchronously: this returns a job, and the job reports the outcome, including whether the target could be changed at all. Send an `Idempotency-Key` so a retried request returns the original job instead of submitting a second one. Requires the `https://devx.{environment}.oleria.io/write` scope. operationId: AssignGroupToApplication parameters: - name: id in: path description: Global id of the integrated application. required: true schema: type: string - name: groupId in: path description: Global id of the group to act on. required: true schema: type: string - $ref: '#/components/parameters/idempotencyKey' responses: '202': description: >- The change was accepted and is being applied. Poll the returned job for its outcome. headers: Location: description: Path of the job tracking this change. schema: type: string Retry-After: description: Seconds to wait before polling the job. schema: type: integer content: application/json: schema: $ref: '#/components/schemas/ActionAccepted' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': description: >- The `Idempotency-Key` sent with this request was already used for a different one. A key identifies a single request, so reusing it with a different target or body is refused rather than treated as a retry: returning the first job would report success for a change that was never applied. Retry with the same key only when resending the same request; use a new key for a new one. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: IDEMPOTENCY_KEY_MISMATCH message: This idempotency key was used for a different request. '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/write components: parameters: idempotencyKey: name: Idempotency-Key in: header description: >- Unique key for this request, generated by the caller. Resending the same request with the same key returns the job the first one created instead of submitting a second one; sending a *different* request with a key already used is refused with `409`, so a key accidentally reused across targets cannot silently skip them. Use one key per request, not one per batch. Recommended on every write: these operations change systems outside Oleria, so a client that times out and retries without one can apply the change twice. This matters even for the operations that are safe to repeat: asserting a membership that already exists grants nothing a second time, but without a key it is still a second job, with its own audit record and its own results. schema: type: string schemas: ActionAccepted: type: object description: A reference to the job applying an accepted change. required: - jobId - self properties: jobId: type: string format: uuid description: Id of the job applying this change. example: 9f2b1c7e-5a84-4d6b-9c31-0e7f8a2d4b16 self: type: string description: Path of the job, the same value as the `Location` header. example: /v1/action-jobs/9f2b1c7e-5a84-4d6b-9c31-0e7f8a2d4b16 ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. NotFound: description: No resource exists with the given id. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: NOT_FOUND message: No resource with the given id. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````