> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Get > Returns a resource hierarchy edge by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml get /v1/resource-instance-contains-resource-instance/{id} openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/resource-instance-contains-resource-instance/{id}: get: tags: - Resource hierarchy summary: Get description: >- Returns a resource hierarchy edge by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. operationId: GetResourceInstanceContainsResourceInstance parameters: - name: id in: path description: Global id of the resource hierarchy edge. required: true schema: type: string responses: '200': description: The resource hierarchy edge. content: application/json: schema: $ref: >- #/components/schemas/Oleria_ResourceInstanceContainsResourceInstance '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/read components: schemas: Oleria_ResourceInstanceContainsResourceInstance: type: object description: > An Oleria ResourceInstanceContainsResourceInstance relationship indicates nesting of Oleria ResourceInstance objects within an application (e.g. files within folders, branches within repositories). Such nesting also implies some derivation of access control specific to the application allOf: - $ref: '#/components/schemas/ResourceInstanceContainsResourceInstance' - $ref: >- #/components/schemas/Oleria_ResourceInstanceContainsResourceInstanceGlobalIdentifiers - $ref: >- #/components/schemas/Oleria_ResourceInstanceContainsResourceInstanceEnrichedInformation - required: - oleriaObjectMetadata type: object properties: oleriaObjectMetadata: $ref: '#/components/schemas/Oleria_ObjectMetadata' ResourceInstanceContainsResourceInstance: required: - childResourceInstanceId - id - objectMetadata - parentResourceInstanceId type: object properties: id: $ref: '#/components/schemas/LocallyUniqueId' childResourceInstanceId: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' objectMetadata: $ref: '#/components/schemas/ObjectMetadata' parentResourceInstanceId: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' description: >- A ResourceInstanceContainsResourceInstance relationship indicates nesting of ResourceInstances within an application. Examples of nesting include files in folders for Google Workspace and Microsoft 365 as well as branches in repositories for GitHub. Such nesting in the context of the Oleria composite identity security graph also implies some derivation of access control, though how this is expressed is specific to the application and should be represented based on a combination of roles, permissions, and the accesses implied by activity example: >- (:ResourceInstance{id:parentResourceInstanceId})-[relationship:Contains]->(:ResourceInstance{id:childResourceInstanceId}) Oleria_ResourceInstanceContainsResourceInstanceGlobalIdentifiers: required: - globalChildResourceInstanceId - globalId - globalParentResourceInstanceId type: object properties: globalChildResourceInstanceId: type: string globalId: type: string globalParentResourceInstanceId: type: string description: > Global identifiers translated from ResourceInstanceContainsResourceInstance local identifiers to be composed on Oleria ResourceInstanceContainsResourceInstance Oleria_ResourceInstanceContainsResourceInstanceEnrichedInformation: type: object description: > Enriched information derived from a combination of ResourceInstanceContainsResourceInstance data, additional identity signals Oleria_ObjectMetadata: type: object properties: enrichmentVersion: type: string generatedTime: type: string format: date-time description: > object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. LocallyUniqueId: minLength: 1 type: string description: > An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration LocallyUniqueResourceInstanceId: type: string description: > An identifier (unique to the integrated application) for a [ResourceInstance](#/components/schemas/ResourceInstance) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) ObjectMetadata: required: - ApplicationInstanceId - GeneratedTime type: object properties: ApplicationInstanceId: type: string GeneratedTime: type: string format: date-time Profile: $ref: '#/components/schemas/SchemaProfile' ObjectOrRelationshipType: type: string description: > The _ObjectMetadata_ structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data SchemaProfile: type: string enum: - Account - Membership - Governance - Risk - Access - Detection responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. NotFound: description: No resource exists with the given id. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: NOT_FOUND message: No resource with the given id. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````