> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Get > Returns a membership by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml get /v1/entity-member-of-entity/{id} openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/entity-member-of-entity/{id}: get: tags: - Memberships summary: Get description: >- Returns a membership by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. operationId: GetEntityMemberOfEntity parameters: - name: id in: path description: Global id of the membership. required: true schema: type: string responses: '200': description: The membership. content: application/json: schema: $ref: '#/components/schemas/Oleria_EntityMemberOfEntity' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/read components: schemas: Oleria_EntityMemberOfEntity: type: object description: > An Oleria EntityMemberOfEntity relationship represents a membership in which a child entity (Oleria Account, Oleria Role, or Oleria UserGroup) belongs to a parent grouping entity (Oleria Role or Oleria UserGroup), entitling the child to the access that the parent confers. Direction: child to parent. globalChildId/Type identify the child member; globalParentId/Type identify the parent grouping. allOf: - $ref: '#/components/schemas/EntityMemberOfEntity' - $ref: '#/components/schemas/Oleria_EntityMemberOfEntityGlobalIdentifiers' - $ref: '#/components/schemas/Oleria_EntityMemberOfEntityEnrichedInformation' - $ref: '#/components/schemas/Oleria_EntityMemberOfEntityAnalyticsInformation' - required: - oleriaObjectMetadata type: object properties: oleriaObjectMetadata: $ref: '#/components/schemas/Oleria_ObjectMetadata' EntityMemberOfEntity: required: - childId - childType - id - objectMetadata - parentId - parentType type: object properties: childId: $ref: '#/components/schemas/LocallyUniqueId' childType: $ref: '#/components/schemas/ObjectType' expirationDate: type: string format: date-time description: | The date the membership expires, if applicable. federationSpecification: $ref: '#/components/schemas/FederatedRelationshipSpecification' id: $ref: '#/components/schemas/LocallyUniqueId' objectMetadata: $ref: '#/components/schemas/ObjectMetadata' parentId: $ref: '#/components/schemas/LocallyUniqueId' parentType: $ref: '#/components/schemas/ObjectType' scopedMembershipPermissions: $ref: '#/components/schemas/ScopedMembershipPermissions' description: > The common shape of a membership relationship: the child and parent endpoints, expirationDate, federationSpecification, scopedMembershipPermissions, and objectMetadata. Oleria_EntityMemberOfEntityGlobalIdentifiers: required: - globalChildId - globalChildType - globalId - globalParentId - globalParentType type: object properties: globalChildId: type: string description: > Global ID of the child member entity. Valid values reference Oleria Account, Oleria Role, or Oleria UserGroup. globalChildType: allOf: - $ref: '#/components/schemas/Oleria_ObjectType' description: > Object type of the child member entity. Expected values: Oleria Account, Oleria Role, Oleria UserGroup. globalId: type: string description: Opaque platform-assigned identifier for this relationship instance. globalParentId: type: string description: > Global ID of the parent grouping entity the child belongs to. Valid values reference Oleria Role or Oleria UserGroup. globalParentType: allOf: - $ref: '#/components/schemas/Oleria_ObjectType' description: > Object type of the parent grouping entity. Expected values: Oleria Role, Oleria UserGroup. globalScopedMembershipPermissions: $ref: '#/components/schemas/ScopedMembershipPermissions' description: | Global identifiers composed on Oleria EntityMemberOfEntity Oleria_EntityMemberOfEntityEnrichedInformation: type: object properties: enrichedAggregateOwnershipLevel: $ref: '#/components/schemas/PermissionLevel' description: > Enriched information derived from additional identity signals and composed on Oleria EntityMemberOfEntity Oleria_EntityMemberOfEntityAnalyticsInformation: type: object properties: analyticsLoginEventCount: type: integer nullable: true format: int64 description: > Cached count of authentication/login events on the application entitlements this membership confers. Null when no login activity has been observed for this membership. analyticsResourceAccessEventCount: type: integer nullable: true format: int64 description: > Cached count of resource-access events on the resources this membership grants access to, inclusive of events on contained resources. Null when no resource-access activity has been observed for this membership. analyticsLastActivityDate: type: string nullable: true format: date-time description: > Most recent activity of any kind observed for this membership; feeds group-utilization analytics. Null when no activity has been observed for this membership. description: > Analytics information cached on the Oleria EntityMemberOfEntity relationship Oleria_ObjectMetadata: type: object properties: enrichmentVersion: type: string generatedTime: type: string format: date-time description: > object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. LocallyUniqueId: minLength: 1 type: string description: > An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration ObjectType: type: string description: >- The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage example: Account enum: - Account - AccountRole - Activity - AssignedApplication - Authenticator - AuthenticatorEnrollment - Department - DirectoryProvider - Employee - IntegratedApplication - None - ObjectDirectory - PermissionSet - Person - ResourceClass - ResourceInstance - RiskDefinition - RiskViolation - Role - UserGroup FederatedRelationshipSpecification: type: object required: - isFederated properties: connectionType: $ref: '#/components/schemas/FederatedRelationshipConnectionType' isFederated: type: boolean sourceAuthenticationKey: type: string targetAuthenticationKey: type: string description: > Used to specify if an emitted relationship is federated, and if so, how Oleria can connect the participating objects in a composite graph ObjectMetadata: required: - ApplicationInstanceId - GeneratedTime type: object properties: ApplicationInstanceId: type: string GeneratedTime: type: string format: date-time Profile: $ref: '#/components/schemas/SchemaProfile' ObjectOrRelationshipType: type: string description: > The _ObjectMetadata_ structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data ScopedMembershipPermissions: type: object properties: aggregateOwnershipLevel: $ref: '#/components/schemas/PermissionLevel' name: type: string specifications: type: array items: $ref: '#/components/schemas/PermissionSetSpecification' description: > Permission scoping data associated with membership in [Roles](#/components/schemas/Role) and [UserGroups](#/components/schemas/UserGroup) Oleria_ObjectType: type: string description: > The enumerated list of all Oleria objects used to describe and manage any customer's identity security. The definition of each object describes its usage example: Oleria_IntegratedApplication enum: - Oleria_Account - Oleria_AccountRole - Oleria_Activity - Oleria_Application - Oleria_ApplicationDeployment - Oleria_AssignedApplication - Oleria_Authenticator - Oleria_AuthenticatorEnrollment - Oleria_Department - Oleria_DirectoryProvider - Oleria_DiscoveredApplication - Oleria_Employee - Oleria_IntegratedApplication - Oleria_ObjectDirectory - Oleria_Person - Oleria_ResourceClass - Oleria_ResourceInstance - Oleria_Role - Oleria_UserGroup PermissionLevel: type: string description: > The level of ownership of the permission granting access to a Resource or ResourceInstance: 1. _AccessReviewOwner_ indicates that the assignee of the represented permission is a (or the) designated access reviewer and an owner from the perspective of Governance 2. _NotApplicable_ indicates that a permission level is not relevant in the context of the permission set specification 3. _Owner_ means that the assignee of the represented permission is also an owner of the Resource or ResourceInstance 4. _User_ indicates that the assignee of the represented permission is simply a user or accessor or the Resource or ResourceInstance example: Owner enum: - AccessReviewOwner - NotApplicable - Owner - User FederatedRelationshipConnectionType: type: string enum: - Source - SourceAndTarget - Target SchemaProfile: type: string enum: - Account - Membership - Governance - Risk - Access - Detection PermissionSetSpecification: type: object properties: fineGrainedResourceClass: type: string description: >- The class of resource that the _fineGrainedSpecifiers_ are associated with example: repo fineGrainedSpecifiers: type: array example: - manage_github_actions_permissions_policy - view_collaborators items: type: string formattedScopes: $ref: '#/components/schemas/PermissionScopeSpecification' isCreate: type: boolean description: Create access permission isDelete: type: boolean description: Delete access permission isExecute: type: boolean description: Execute access permission isPrivileged: type: boolean description: Privileged access permission isRead: type: boolean description: Read access permission isShare: type: boolean description: Sharing access permission isUpdate: type: boolean description: Update access permission ownershipLevel: $ref: '#/components/schemas/PermissionLevel' owners: type: array items: $ref: '#/components/schemas/EntityIdentifier' permissionGroupId: type: string specificationMetadata: type: array description: >- An array of additional metadata items associated with the permission specification items: $ref: '#/components/schemas/MetadataItem' description: >- Coarse and fine grained specification of a set of permissions that can be associated with an Oleria object or relationship PermissionScopeSpecification: type: object properties: specifiers: type: array description: Formatted scopes as specified by type items: type: string type: $ref: '#/components/schemas/PermissionScopeType' description: Scope specification optionally specified in a PermissionSetSpecification EntityIdentifier: type: object properties: federationInformation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' objectId: $ref: '#/components/schemas/LocallyUniqueId' objectType: $ref: '#/components/schemas/ObjectType' description: > Used for typed indentification of an entity (node) in the graph with values for _objectId_ and _objectType_ MetadataItem: type: object properties: id: type: string name: type: string namespace: type: string type: $ref: '#/components/schemas/MetadataValueType' value: type: object PermissionScopeType: type: string description: >- The enumerated list of scope formats optionally specified in a PermissionSetSpecification enum: - OAuth EntityIdentifierFederationInformation: type: object required: - isFederated properties: authenticationKey: type: string isFederated: type: boolean description: | Federation information used when specifying an _EntityIdentifier_ MetadataValueType: type: string enum: - array_boolean - array_float32 - array_float64 - array_int32 - array_int64 - array_string - boolean - float32 - float64 - int32 - int64 - oleria_global_id - oleria_local_id - pem - property_bag - rfc3339_date - string responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. NotFound: description: No resource exists with the given id. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: NOT_FOUND message: No resource with the given id. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````