> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Get > Returns a resource instance by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml get /v1/resource-instances/{id} openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/resource-instances/{id}: get: tags: - Resource instances summary: Get description: >- Returns a resource instance by its global id. Requires the `https://devx.{environment}.oleria.io/read` scope. operationId: GetResourceInstance parameters: - name: id in: path description: Global id of the resource instance. required: true schema: type: string responses: '200': description: The resource instance. content: application/json: schema: $ref: '#/components/schemas/Oleria_ResourceInstance' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/read components: schemas: Oleria_ResourceInstance: type: object description: > An Oleria ResourceInstance object represents an application-specific instance of a resource controlled by the application's access control system (e.g. repositories in GitHub, files in Google Drive) allOf: - $ref: '#/components/schemas/ResourceInstance' - $ref: '#/components/schemas/Oleria_ResourceInstanceGlobalIdentifiers' - $ref: '#/components/schemas/Oleria_ResourceInstanceEnrichedInformation' - $ref: '#/components/schemas/Oleria_ResourceInstanceAnalyticsInformation' - $ref: >- #/components/schemas/Oleria_ResourceInstanceSystemOfRecordInformation - required: - oleriaObjectMetadata type: object properties: oleriaObjectMetadata: $ref: '#/components/schemas/Oleria_ObjectMetadata' ResourceInstance: required: - id - isDeleted - name - objectMetadata - prohibitInheritedLabels - prohibitInheritedPermissions - resourceClass type: object properties: contentHashesOrFingerprints: type: array description: > Exposes [hashes or fingerprints](#/components/schemas/HashOrFingerprintAlgorithmPrefix) of the content represented by this _ResourceInstance_ items: type: string createdBy: $ref: '#/components/schemas/LocallyUniqueAccountId' createdByFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' createdDate: type: string description: The date the resource instance was created format: date-time id: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' isDeleted: type: boolean description: >- Has this resource instance been deleted? A deleted resource instance may still be represented in the Oleria composite graph of an application's identity security example: false labels: type: array items: $ref: '#/components/schemas/MetadataItem' lastModifiedBy: $ref: '#/components/schemas/LocallyUniqueAccountId' lastModifiedByFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' lastModifiedDate: type: string description: The date the resource instance was last modified format: date-time example: '2024-05-02T03:17:34.948Z' name: minLength: 1 type: string description: The name of the resource instance example: oleria objectDirectoryContainerFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' objectDirectoryContainerId: $ref: '#/components/schemas/LocallyUniqueObjectDirectoryId' objectMetadata: $ref: '#/components/schemas/ObjectMetadata' pageUri: type: string description: The URI of the resource instance entity format: uri example: >- /lightning/r/Opportunity/006Dn000007rkDYIAY/view, https://github.com/roanokedatasecurity/oleria prohibitInheritedLabels: type: boolean description: > Inherited labels e.g. container -> contained are not allowed on this resource instance. Only directly assigned labels are honored example: false prohibitInheritedPermissions: type: boolean description: > Inherited permissions e.g. container -> contained are not allowed on this resource instance. Only direct permissions are honored example: true resourceClass: type: string description: > The unique application-specific type of the _ResourceInstance_ which connects it to a particular [ResourceClass](#/components/schemas/ResourceClass) via the _ResourceClass.name_ field example: repo secondaryResourceClasses: type: array items: type: string sourceTag: type: string description: >- An application-specific tag representing the resource instance information data source description: >- A ResourceInstance object represents an application-specific instance of a resource controlled by the application's access control system e.g. Repositories in GitHub or Files in Google Drive Oleria_ResourceInstanceGlobalIdentifiers: required: - globalId type: object properties: globalCreatedBy: type: string globalId: type: string globalLastModifiedBy: type: string globalObjectDirectoryContainerId: type: string description: > Global identifiers translated from ResourceInstance local identifiers to be composed on Oleria ResourceInstance Oleria_ResourceInstanceEnrichedInformation: type: object properties: enrichedDataClassifications: $ref: '#/components/schemas/DataClassifications' description: > Enriched information derived from a combination of ResourceInstance data, additional identity signals Oleria_ResourceInstanceAnalyticsInformation: type: object properties: analyticsAccessFromApplicationAccountsCount: type: integer nullable: true format: int32 description: > Cached count of distinct accounts with access to this resource instance, including both application accounts and directory accounts. Values above 1000 may be approximate. analyticsAccessFromRolesCount: type: integer nullable: true format: int32 description: > Cached count of roles with access to this resource instance. Values above 1000 may be approximate. analyticsAccessFromUserGroupsCount: type: integer nullable: true format: int32 description: | Cached count of user groups with access to this resource instance. analyticsChildResourceInstanceCount: type: integer nullable: true format: int64 description: | Cached count of directly nested child resource instances. analyticsContainedDataSensitivityLabels: type: array items: type: string description: > Distinct data-sensitivity labels found across this resource instance's descendants (excluding itself). analyticsContainedSensitiveResourceInstancesCount: type: integer nullable: true format: int64 description: > Cached count of sensitive resource instances among this resource instance's descendants (excluding itself). analyticsDaysSinceLastActivity: type: integer nullable: true format: int32 description: > Days since the most recent activity directly observed on this resource instance. analyticsEffectiveDaysSinceLastActivity: type: integer nullable: true format: int32 description: > Days since the most recent activity across this resource instance and all of its descendants. analyticsEffectiveLastActivityDate: type: string nullable: true format: date-time description: > Most recent activity across this resource instance and all of its descendants. analyticsIsAnonymouslyShared: type: boolean nullable: true description: > Whether this resource instance is shared via an anonymous or public link. analyticsIsExternallyShared: type: boolean nullable: true description: > Whether this resource instance is shared with parties external to the organization. analyticsLastActivityDate: type: string nullable: true format: date-time description: | Most recent activity directly observed on this resource instance. analyticsMaximumRolledUpLastActivityDate: type: string nullable: true format: date-time description: > Most recent activity across this resource instance's descendants (excluding itself). analyticsMinimumRolledUpDaysSinceLastActivity: type: integer nullable: true format: int32 description: > Days since the most recent activity across this resource instance's descendants (excluding itself). analyticsOwners: type: array items: type: string description: > Names of the accounts, roles, or user groups determined to own this resource instance, derived from access topology. analyticsSharedLinksCount: type: integer nullable: true format: int32 description: | Cached count of shared links pointing to this resource instance. description: | Analytics information cached on the Oleria ResourceInstance object Oleria_ResourceInstanceSystemOfRecordInformation: type: object properties: sorPrimaryStewardEmail: type: string description: > System of Record information associated with a resource instance and managed in Oleria Oleria_ObjectMetadata: type: object properties: enrichmentVersion: type: string generatedTime: type: string format: date-time description: > object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. LocallyUniqueAccountId: type: string description: > An identifier (unique to integrated application) for an [Account](#/components/schemas/Account) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug) EntityIdentifierFederationInformation: type: object required: - isFederated properties: authenticationKey: type: string isFederated: type: boolean description: | Federation information used when specifying an _EntityIdentifier_ LocallyUniqueResourceInstanceId: type: string description: > An identifier (unique to the integrated application) for a [ResourceInstance](#/components/schemas/ResourceInstance) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) MetadataItem: type: object properties: id: type: string name: type: string namespace: type: string type: $ref: '#/components/schemas/MetadataValueType' value: type: object LocallyUniqueObjectDirectoryId: type: string description: > An identifier (unique to the integrated application) for a [ObjectDirectory](#/components/schemas/ObjectDirectory) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) ObjectMetadata: required: - ApplicationInstanceId - GeneratedTime type: object properties: ApplicationInstanceId: type: string GeneratedTime: type: string format: date-time Profile: $ref: '#/components/schemas/SchemaProfile' ObjectOrRelationshipType: type: string description: > The _ObjectMetadata_ structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data DataClassifications: type: array items: $ref: '#/components/schemas/DataClassification' MetadataValueType: type: string enum: - array_boolean - array_float32 - array_float64 - array_int32 - array_int64 - array_string - boolean - float32 - float64 - int32 - int64 - oleria_global_id - oleria_local_id - pem - property_bag - rfc3339_date - string SchemaProfile: type: string enum: - Account - Membership - Governance - Risk - Access - Detection DataClassification: type: object properties: businessImpact: $ref: '#/components/schemas/ImpactLevel' compliance: type: array items: $ref: '#/components/schemas/ComplianceRegime' customerImpact: $ref: '#/components/schemas/ImpactLevel' dataSensitivity: $ref: '#/components/schemas/DataSensitivity' description: type: string id: $ref: '#/components/schemas/DataClassificationId' name: type: string description: >- DataClassification objects are emitted by integrated applications to indicate classification labels that have been created in the enterprise application system and assigned certain impact level, compliance regime, and data sensitivity properties where applicable. The Oleria aggregates these classifications across integrated applications and allows security teams customize as well as group by, filter by, and order by these labels when reviewing identity security and access information ImpactLevel: type: string description: >- Impact of compromise of a secured information on the business or customer (enumeration ordered descending by criticality) enum: - MissionCritical - Critical - High - Moderate - Low - None ComplianceRegime: type: string description: >- Data compliance standards and information security categories that a security classification may be used in enum: - CCPA - CDPA - COPPA - CPA - GDPR - GLB - HIPAA - ISO-27001 - ISO-27018 - PCI - PII - SOC - SOC2 - UCPA DataSensitivity: type: string description: >- Sensitivity of the data associated with a resource (enumeration ordered descending by sensitivity) enum: - TopSecret - Secret - Confidential - ExtremelySensitive - Protected - AuthorizedDisclosure - Open - NotApplicable DataClassificationId: type: string description: >- An identifier for a specific data classification associated with an integrated application instance responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. NotFound: description: No resource exists with the given id. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: NOT_FOUND message: No resource with the given id. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````