Skip to main content
GET
Get

Authorizations

Authorization
string
header
required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

id
string
required

Global id of the role.

Response

The role.

An Oleria Role object represents a security role that can be assigned to accounts and groups in an application and is typically used in role-based access control (RBAC) systems to group and represents one or more sets of permissions that grant access to resources. Note this is a different representation than Oleria AccountRole which is purely used to represent entitlement descriptions and is typically a unit of entitlement assignment brokered between and IDP and an enterprise application

applicationRoleType
string
required

This is an application-specific string indicating the type of role being represented by the Role object. Typically this is the information used to derive the RoleType specified in the Role.type field or something related to the source of the Role specified in Role.sourceTag

id
string
required

An identifier (unique to the integrated application) for a Role object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"0PSHu000003fo6tOAA (Salesforce based on permission set ids)"

isCustom
boolean
required

Is this a custom-defined role? If true, then the Role.type equals Custom

Example:

false

name
string
required

The name of the role which is typically informative of the role's purpose for granting access to resources (see also description)

Minimum string length: 1
Example:

"oleria Repo Maintainers"

objectMetadata
object
required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

type
enum<string>
required

The type of the role used to group permissions in role based access control (RBAC) systems and thus give access to particular resources are described as follows:

  1. Custom roles are created by administrators or users (with sufficient privilege) to represent a custom set of permissions that grant unique access to application resources
  2. Modeled roles are roles created to model access to resources in the application, but are not "physically" represented in the application's schema. An example of modeled roles are each repository's access roles in GitHub. These are represented as modeled roles in Oleria because each repository evaluates roie membership and access with its own virtual instance of the standard read, write, triage, maintain, and admin GitHub roles.
  3. Standard roles are the documented or system installed application roles described by the application and represented in the Oleria schema
Available options:
Custom,
Modeled,
Standard
Example:

"Standard"

globalId
string
required
oleriaObjectMetadata
object
required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

authorizedLocations
object

AuthorizedLocationPolicy is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc.

createdBy
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

createdByFederation
object

Federation information used when specifying an EntityIdentifier

createdDate
string<date-time>
Example:

"2024-05-02T03:17:34.948Z"

description
string

The description of the role indicating its purpose in grouping permissions and granting access to resources

Example:

"oleria Repos Writers"

lastModifiedBy
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

lastModifiedByFederation
object

Federation information used when specifying an EntityIdentifier

lastModifiedDate
string<date-time>

The date the role was last modified

Example:

"2024-05-02T03:17:34.948Z"

objectDirectoryContainerFederation
object

Federation information used when specifying an EntityIdentifier

objectDirectoryContainerId
string

An identifier (unique to the integrated application) for a ObjectDirectory object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id)"

sourceTag
string

An application-specific tag representing the role information data source

Example:

"oleria"

globalAuthorizedLocations
object

AuthorizedLocationPolicy is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc.

globalCreatedBy
string
globalLastModifiedBy
string
globalObjectDirectoryContainerId
string
analyticsAccessToResourceInstancesCount
integer<int64> | null

Cached count of resource instances this role can access, including nested (Contains) descendants. Values above 1000 may be approximate. Note that access to resource (vs. resource instance) is deprecated.

analyticsActiveMemberCount
integer<int32> | null
analyticsAssignedApplicationCount
integer<int32> | null
analyticsAssignedRoleCount
integer<int32> | null
analyticsAssignedUserGroupCount
integer<int32> | null
analyticsInactiveMemberCount
integer<int32> | null
analyticsMemberAccountsCount
integer<int32> | null
analyticsMemberCount
integer<int32> | null
analyticsOwners
string[]
sorPrimaryStewardEmail
string