Skip to main content
GET
Get

Authorizations

Authorization
string
header
required

OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as Authorization: Bearer <token>.

Path Parameters

id
string
required

Global id of the user group.

Response

The user group.

An Oleria UserGroup object represents a group in an enterprise SaaS application, identity provider, or directory service e.g. Okta, PingOne, ActiveDirectory, GitHub, Salesforce, or ServiceNow

applicationGroupType
string
required

This is an application-specific string indicating the type of group being represented by the UserGroup object. Typically this is the information used to derive the UserGroupType specified in the UserGroup.type field

Example:

"EmailDistributionList"

id
string
required

An identifier (unique to the integrated or assigned application) for a UserGroup object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"team:T_kgDOLL0doQ (GitHub), 37d284db-1d76-4587-aa78-5a33cfcc021f:member (SharePoint)"

name
string
required

The name (title) of the group which is typically informative of the group's purpose for granting access to resources (see also description)

Minimum string length: 1
Example:

"AI Maintainers"

objectMetadata
object
required

The ObjectMetadata structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data

type
enum<string>
required

The following group types are supported:

  1. Built-in groups are used to represent system-defined groups that can be leveraged by the application administrator to give access to resources via roles and permissions assigned to the group. Account membership in built-in groups is typically explicit
  2. Custom groups are created by administrators or users (with appropriate privilege) to give access to resources via roles and permissions assigned to the group. Account membership in custom groups is typically explicit
  3. Dynamic groups are created by administrators or users (with appropriate privilege) where membership in the group is dynamic and based on a defined set of attributes evaluated either periodically or at access control evaluation
  4. Modeled groups are an Oleria representation of an RBAC group like concept in the application typically used to represent concept like Everyone
  5. Sync groups are synchronized between an identity provider and enterprise application (or directory)
Available options:
Built-in,
Custom,
Dynamic,
Modeled,
Sync
Example:

"Custom"

globalId
string
required
oleriaObjectMetadata
object
required

object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated

authenticationRequirements
object

AuthenticationRequirements are used to specify authentication requirement configuration for Oleria integrated applications as described by their corresponding IntegratedApplication object

authorizedLocations
object

AuthorizedLocationPolicy is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc.

createdBy
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

createdByFederation
object

Federation information used when specifying an EntityIdentifier

createdDate
string<date-time>

The date the group was created

Example:

"2024-05-02T03:17:34.948Z"

description
string

The description of the group

Example:

"AI Maintainers"

directoryEntryFederation
object

Federation information used when specifying an EntityIdentifier

directoryEntryId
string

The directoryEntryId is emitted when this UserGroup object is synced with an UserGroup object emitted by a directory. The id here should match the synced UserGroup.id

directoryProviderFederation
object

Federation information used when specifying an EntityIdentifier

directoryProviderId
string

The directoryProviderId indicates the DirectoryProvider defining the directory sync relationship for this group

email
string<email>

The email address associated with the group

Example:

"ai-maintainers@oleria.com"

labels
object[]

Label tags associated with the group, particularly when used for data classification and sensitivity targeting

lastModifiedBy
string

An identifier (unique to integrated application) for an Account object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug)"

lastModifiedByFederation
object

Federation information used when specifying an EntityIdentifier

lastModifiedDate
string<date-time>

The date the group was last modified

Example:

"2024-05-02T03:17:34.948Z"

objectDirectoryContainerFederation
object

Federation information used when specifying an EntityIdentifier

objectDirectoryContainerId
string

An identifier (unique to the integrated application) for a ObjectDirectory object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations

Example:

"repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id)"

profileMetadata
object[]

An array of profile key-value pairs extending the schema of the UserGroup object

provisioning
object[]

An array detailing all participants in a provisioning relationship with this UserGroup

sourceTag
string

An application-specific tag representing the group information data source

Example:

"OrgTeams"

globalAuthenticationRequirements
object

AuthenticationRequirements are used to specify authentication requirement configuration for Oleria integrated applications as described by their corresponding IntegratedApplication object

globalAuthorizedLocations
object

AuthorizedLocationPolicy is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc.

globalCreatedBy
string
globalDirectoryEntryId
string
globalDirectoryProviderId
string
globalLastModifiedBy
string
globalObjectDirectoryContainerId
string
globalProfileMetadata
object[]
enrichedDataClassifications
object[]
enrichedNormalizedEmail
string

Normalized version of the email found in UserGroup.Email

analyticsAccessToResourceInstancesCount
integer<int64> | null

Cached count of resource instances this user group can access, including nested (Contains) descendants. Values above 1000 may be approximate.

analyticsActiveMemberCount
integer<int32> | null
analyticsAssignedApplicationCount
integer<int32> | null
analyticsAssignedRoleCount
integer<int32> | null
analyticsDataLabelsCount
integer<int32> | null
analyticsInactiveMemberCount
integer<int32> | null
analyticsMemberAccountsCount
integer<int32> | null
analyticsMemberCount
integer<int32> | null
analyticsUtilizationPercentage
integer<int32> | null
analyticsOwners
string[]
analyticsOwnerCount
integer<int32> | null
sorPrimaryStewardEmail
string