Skip to main content
GET
Get

Authorizations

Authorization
string
header
required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

id
string
required

Global id of the membership.

Response

The membership.

An Oleria EntityMemberOfEntity relationship represents a membership in which a child entity (Oleria Account, Oleria Role, or Oleria UserGroup) belongs to a parent grouping entity (Oleria Role or Oleria UserGroup), entitling the child to the access that the parent confers. Direction: child to parent. globalChildId/Type identify the child member; globalParentId/Type identify the parent grouping.

childId
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
childType
enum<string>
required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:
Account,
AccountRole,
Activity,
AssignedApplication,
Authenticator,
AuthenticatorEnrollment,
Department,
DirectoryProvider,
Employee,
IntegratedApplication,
None,
ObjectDirectory,
PermissionSet,
Person,
ResourceClass,
ResourceInstance,
RiskDefinition,
RiskViolation,
Role,
UserGroup
Example:

"Account"

id
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
objectMetadata
object
required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

parentId
string
required

An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration

Minimum string length: 1
parentType
enum<string>
required

The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage

Available options:
Account,
AccountRole,
Activity,
AssignedApplication,
Authenticator,
AuthenticatorEnrollment,
Department,
DirectoryProvider,
Employee,
IntegratedApplication,
None,
ObjectDirectory,
PermissionSet,
Person,
ResourceClass,
ResourceInstance,
RiskDefinition,
RiskViolation,
Role,
UserGroup
Example:

"Account"

globalChildId
string
required

Global ID of the child member entity. Valid values reference Oleria Account, Oleria Role, or Oleria UserGroup.

globalChildType
enum<string>
required

Object type of the child member entity. Expected values: Oleria Account, Oleria Role, Oleria UserGroup.

Available options:
Oleria_Account,
Oleria_AccountRole,
Oleria_Activity,
Oleria_Application,
Oleria_ApplicationDeployment,
Oleria_AssignedApplication,
Oleria_Authenticator,
Oleria_AuthenticatorEnrollment,
Oleria_Department,
Oleria_DirectoryProvider,
Oleria_DiscoveredApplication,
Oleria_Employee,
Oleria_IntegratedApplication,
Oleria_ObjectDirectory,
Oleria_Person,
Oleria_ResourceClass,
Oleria_ResourceInstance,
Oleria_Role,
Oleria_UserGroup
Example:

"Oleria_IntegratedApplication"

globalId
string
required

Opaque platform-assigned identifier for this relationship instance.

globalParentId
string
required

Global ID of the parent grouping entity the child belongs to. Valid values reference Oleria Role or Oleria UserGroup.

globalParentType
enum<string>
required

Object type of the parent grouping entity. Expected values: Oleria Role, Oleria UserGroup.

Available options:
Oleria_Account,
Oleria_AccountRole,
Oleria_Activity,
Oleria_Application,
Oleria_ApplicationDeployment,
Oleria_AssignedApplication,
Oleria_Authenticator,
Oleria_AuthenticatorEnrollment,
Oleria_Department,
Oleria_DirectoryProvider,
Oleria_DiscoveredApplication,
Oleria_Employee,
Oleria_IntegratedApplication,
Oleria_ObjectDirectory,
Oleria_Person,
Oleria_ResourceClass,
Oleria_ResourceInstance,
Oleria_Role,
Oleria_UserGroup
Example:

"Oleria_IntegratedApplication"

oleriaObjectMetadata
object
required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

expirationDate
string<date-time>

The date the membership expires, if applicable.

federationSpecification
object

Used to specify if an emitted relationship is federated, and if so, how Oleria can connect the participating objects in a composite graph

scopedMembershipPermissions
object

Permission scoping data associated with membership in Roles and UserGroups

globalScopedMembershipPermissions
object

Permission scoping data associated with membership in Roles and UserGroups

enrichedAggregateOwnershipLevel
enum<string>

The level of ownership of the permission granting access to a Resource or ResourceInstance:

  1. AccessReviewOwner indicates that the assignee of the represented permission is a (or the) designated access reviewer and an owner from the perspective of Governance
  2. NotApplicable indicates that a permission level is not relevant in the context of the permission set specification
  3. Owner means that the assignee of the represented permission is also an owner of the Resource or ResourceInstance
  4. User indicates that the assignee of the represented permission is simply a user or accessor or the Resource or ResourceInstance
Available options:
AccessReviewOwner,
NotApplicable,
Owner,
User
Example:

"Owner"

analyticsLoginEventCount
integer<int64> | null

Cached count of authentication/login events on the application entitlements this membership confers. Null when no login activity has been observed for this membership.

analyticsResourceAccessEventCount
integer<int64> | null

Cached count of resource-access events on the resources this membership grants access to, inclusive of events on contained resources. Null when no resource-access activity has been observed for this membership.

analyticsLastActivityDate
string<date-time> | null

Most recent activity of any kind observed for this membership; feeds group-utilization analytics. Null when no activity has been observed for this membership.