> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # List > Returns a page of user groups. Pass `pageToken` from the previous response's `nextPageToken` to fetch the next page. A page can be empty while the results are still being prepared. Keep requesting pages until the response has no `nextPageToken`. Requires the `https://devx.{environment}.oleria.io/read` scope. ## OpenAPI ````yaml /developer-docs/api-reference/oleria-public-api-1.0.0.yaml get /v1/user-groups openapi: 3.0.3 info: title: Oleria Public API version: 1.0.0 description: >- REST API for Oleria's identity and access data. Each resource is a collection exposing list and get operations; responses return the complete object. Where Oleria can change what it reports, the change is a method on the same resource: disabling an account is `POST /v1/accounts/{id}/disable`, and membership is a sub-resource asserted with `PUT` and removed with `DELETE`. Those changes are applied in the source application asynchronously: each returns a job under `/v1/action-jobs` that reports the outcome for every target it affected, and whether Oleria's own data reflects it yet. Authenticate with OAuth 2.0 client credentials and send the access token as `Authorization: Bearer `. servers: - url: https://devx.{environment}.oleria.io description: Oleria API server. variables: environment: default: prod description: >- Your Oleria deployment, for example `acme` for `https://devx.acme.oleria.io`. Substitute it in the OAuth scope names as well, since OpenAPI applies a server variable to the URL only and the scopes are published with the placeholder still in them. security: [] paths: /v1/user-groups: get: tags: - User groups summary: List description: >- Returns a page of user groups. Pass `pageToken` from the previous response's `nextPageToken` to fetch the next page. A page can be empty while the results are still being prepared. Keep requesting pages until the response has no `nextPageToken`. Requires the `https://devx.{environment}.oleria.io/read` scope. operationId: ListUserGroups parameters: - $ref: '#/components/parameters/pageSize' - $ref: '#/components/parameters/pageToken' - $ref: '#/components/parameters/applicationInstanceId' responses: '200': description: A page of user groups. content: application/json: schema: $ref: '#/components/schemas/UserGroupList' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' security: - oauth2: - https://devx.{environment}.oleria.io/read components: parameters: pageSize: name: pageSize in: query description: Maximum items per page. schema: type: integer format: int32 default: 50 minimum: 1 maximum: 200 pageToken: name: pageToken in: query description: >- Opaque page token from the previous response's `nextPageToken`. Omit it for the first page; pass it back exactly as received. Do not parse or construct it. schema: type: string applicationInstanceId: name: applicationInstanceId in: query description: >- Scope the list to a single application instance, identified by its id (UUID). An application instance is one connected integration in your tenant: a specific Okta, Workday, and so on. Omit it to list across all of your instances. schema: type: string format: uuid schemas: UserGroupList: type: object required: - items properties: items: type: array items: $ref: '#/components/schemas/Oleria_UserGroup' nextPageToken: type: string description: >- Opaque token for the next page; pass it back as `pageToken`. Present whenever more pages remain, including when this page is empty because the results are still being prepared, and absent only once the collection is fully returned. Do not parse or construct it. Oleria_UserGroup: type: object description: > An Oleria UserGroup object represents a group in an enterprise SaaS application, identity provider, or directory service e.g. Okta, PingOne, ActiveDirectory, GitHub, Salesforce, or ServiceNow allOf: - $ref: '#/components/schemas/UserGroup' - $ref: '#/components/schemas/Oleria_UserGroupGlobalIdentifiers' - $ref: '#/components/schemas/Oleria_UserGroupEnrichedInformation' - $ref: '#/components/schemas/Oleria_UserGroupAnalyticsInformation' - $ref: '#/components/schemas/Oleria_UserGroupSystemOfRecordInformation' - required: - oleriaObjectMetadata type: object properties: oleriaObjectMetadata: $ref: '#/components/schemas/Oleria_ObjectMetadata' ErrorResponse: type: object description: >- Error envelope. `code` is a stable machine-readable identifier; `message` is human-readable. required: - code - message properties: code: type: string description: Stable, machine-readable error code (SCREAMING_SNAKE_CASE). example: NOT_FOUND details: type: object description: Optional free-form context for debugging. additionalProperties: true message: type: string description: Human-readable description of the error. example: No resource with the given id. UserGroup: required: - applicationGroupType - id - name - objectMetadata - type type: object properties: applicationGroupType: type: string description: >- This is an application-specific string indicating the type of group being represented by the UserGroup object. Typically this is the information used to derive the UserGroupType specified in the UserGroup.type field example: EmailDistributionList authenticationRequirements: $ref: '#/components/schemas/AuthenticationRequirements' authorizedLocations: $ref: '#/components/schemas/AuthorizedLocationPolicy' createdBy: $ref: '#/components/schemas/LocallyUniqueAccountId' createdByFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' createdDate: type: string description: The date the group was created format: date-time example: '2024-05-02T03:17:34.948Z' description: type: string description: The description of the group example: AI Maintainers directoryEntryFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' directoryEntryId: type: string description: > The _directoryEntryId_ is emitted when this _UserGroup_ object is synced with an _UserGroup_ object emitted by a directory. The id here should match the synced _UserGroup.id_ directoryProviderFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' directoryProviderId: type: string description: > The _directoryProviderId_ indicates the [DirectoryProvider](#/components/schemas/DirectoryProvider) defining the directory sync relationship for this group email: type: string description: The email address associated with the group format: email example: ai-maintainers@oleria.com id: $ref: '#/components/schemas/LocallyUniqueUserGroupId' labels: type: array description: > Label tags associated with the group, particularly when used for data classification and sensitivity targeting items: $ref: '#/components/schemas/MetadataItem' lastModifiedBy: $ref: '#/components/schemas/LocallyUniqueAccountId' lastModifiedByFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' lastModifiedDate: type: string description: The date the group was last modified format: date-time example: '2024-05-02T03:17:34.948Z' name: minLength: 1 type: string description: >- The name (title) of the group which is typically informative of the group's purpose for granting access to resources (see also description) example: AI Maintainers objectDirectoryContainerFederation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' objectDirectoryContainerId: $ref: '#/components/schemas/LocallyUniqueObjectDirectoryId' objectMetadata: $ref: '#/components/schemas/ObjectMetadata' profileMetadata: type: array description: > An array of profile key-value pairs extending the schema of the _UserGroup_ object items: $ref: '#/components/schemas/MetadataItem' provisioning: type: array description: > An array detailing all participants in a provisioning relationship with this _UserGroup_ items: $ref: '#/components/schemas/ProvisioningParticipant' sourceTag: type: string description: >- An application-specific tag representing the group information data source example: OrgTeams type: $ref: '#/components/schemas/UserGroupType' description: >- A UserGroup object represents groups of accounts (users) associated with an application or IDP e.g. Google Groups, GitHub Teams, or Salesforce Groups Oleria_UserGroupGlobalIdentifiers: required: - globalId type: object properties: globalAuthenticationRequirements: $ref: '#/components/schemas/AuthenticationRequirements' globalAuthorizedLocations: $ref: '#/components/schemas/AuthorizedLocationPolicy' globalCreatedBy: type: string globalDirectoryEntryId: type: string globalDirectoryProviderId: type: string globalId: type: string globalLastModifiedBy: type: string globalObjectDirectoryContainerId: type: string globalProfileMetadata: type: array items: $ref: '#/components/schemas/MetadataItem' description: > Global identifiers translated from UserGroup local identifiers to be composed on Oleria UserGroup Oleria_UserGroupEnrichedInformation: type: object properties: enrichedDataClassifications: $ref: '#/components/schemas/DataClassifications' enrichedNormalizedEmail: type: string description: Normalized version of the email found in UserGroup.Email description: > Enriched information derived from a combination of UserGroup data, additional identity signals Oleria_UserGroupAnalyticsInformation: type: object properties: analyticsAccessToResourceInstancesCount: type: integer nullable: true format: int64 description: > Cached count of resource instances this user group can access, including nested (Contains) descendants. Values above 1000 may be approximate. analyticsActiveMemberCount: type: integer nullable: true format: int32 analyticsAssignedApplicationCount: type: integer nullable: true format: int32 analyticsAssignedRoleCount: type: integer nullable: true format: int32 analyticsDataLabelsCount: type: integer nullable: true format: int32 analyticsInactiveMemberCount: type: integer nullable: true format: int32 analyticsMemberAccountsCount: type: integer nullable: true format: int32 analyticsMemberCount: type: integer nullable: true format: int32 analyticsUtilizationPercentage: type: integer nullable: true format: int32 analyticsOwners: type: array items: type: string analyticsOwnerCount: type: integer nullable: true format: int32 description: > Analytics information calculated from identity security graph and added to the user group Oleria_UserGroupSystemOfRecordInformation: type: object properties: sorPrimaryStewardEmail: type: string description: > System of Record information associated with a group and managed in Oleria Oleria_ObjectMetadata: type: object properties: enrichmentVersion: type: string generatedTime: type: string format: date-time description: > object metadata supersets object metadata with platform enrichment provenance — the enrichment version and the time the record was generated AuthenticationRequirements: type: object required: - isMFAAuthority - isSSOBasedMFARequired properties: authenticationKeys: type: array description: > Each array item is a base64 encoded SHA256 hash of authentication configuration properties.The authenticationKeys property is used by Oleria to match enterprise application IntegratedApplication objects with corresponding identity provider configured AssignedApplication objects assigned to accounts or groups. When these objects are connected and there's a match in authenticationKeys and federated identity, the Oleria platform will connect [Account](#/components/schemas/Account) objects that have an Identity [AccountAuthenticationFunction](#/components/schemas/AccountAuthenticationFunction) with their corresponding [Account](#/components/schemas/Account) objects that have an ApplicationAccount [AccountAuthenticationFunction](#/components/schemas/AccountAuthenticationFunction), and indicate an SSO-based login flow is available. The following protocol configurations are supported: 1. SAML configurations encode the SAML certificate raw public key info 2. First party configurations e.g. Microsoft Entra to Microsoft 365 Apps encode the app type + the first party instance specific instance key with a ":" delimiter 3. OIDC configurations encode the lowercased issuer URL (with trailing slash appended) and the client ID, joined by a "," delimiter, SHA256 hashed and base64 (standard encoding) encoded. Example input: "https://login.example.com/tenant/v2.0/,client-id-abc" 4. RADIUS configuration encoding is TBD example: - XD+NWux+oeqdAa1eUPtNC06g/HtrzM6AbNiZU2MhHSM= items: type: string adaptiveAuthenticationMethodSelectionPolicy: type: array items: $ref: '#/components/schemas/AdaptiveAuthenticationMethodSelectionPolicy' authenticationMethodSelectionPolicy: $ref: '#/components/schemas/AuthenticationMethodSelectionPolicy' availableAuthenticationMethods: type: array items: $ref: '#/components/schemas/AuthenticationMethod' enforcedAuthenticationMethods: type: array items: $ref: '#/components/schemas/AuthenticationMethod' isMFAAuthority: type: boolean description: >- Is this the MFA authority for authentication associated with this application. If false, then a connected identity provider is usually the MFA authority example: true isSSOBasedMFARequired: type: boolean description: >- Does that application require MFA to be done at the configured IDP to allow login example: false passwordPolicy: $ref: '#/components/schemas/PasswordPolicy' secondaryFactorRequirements: $ref: '#/components/schemas/MFARequirements' ssoExclusions: type: array description: > An array of account ids for accounts that are excluded from SSO requirements. These are typically used in the context of break glass scenarios items: $ref: '#/components/schemas/LocallyUniqueAccountId' description: >- AuthenticationRequirements are used to specify authentication requirement configuration for Oleria integrated applications as described by their corresponding IntegratedApplication object AuthorizedLocationPolicy: type: object required: - isInherited properties: isInherited: type: boolean description: > When set to true this indicates that the location policy is inherited from another object, otherwise the location policy is directly specified policy: oneOf: - $ref: '#/components/schemas/AuthorizedEntityLocationPolicy' - $ref: '#/components/schemas/AuthorizedInheritedLocationPolicy' description: > _AuthorizedLocationPolicy_ is used to specify locations authorized for use by accounts, groups, roles, employees, departments, etc. LocallyUniqueAccountId: type: string description: > An identifier (unique to integrated application) for an [Account](#/components/schemas/Account) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- user:U_kgDOB7P6Rg (GitHub based on node identifier), 838439349399 (Google Workspace based on user id), user:wiz-inc-4db1c46901 (GitHub based on app slug) EntityIdentifierFederationInformation: type: object required: - isFederated properties: authenticationKey: type: string isFederated: type: boolean description: | Federation information used when specifying an _EntityIdentifier_ LocallyUniqueUserGroupId: type: string description: > An identifier (unique to the integrated or assigned application) for a [UserGroup](#/components/schemas/UserGroup) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- team:T_kgDOLL0doQ (GitHub), 37d284db-1d76-4587-aa78-5a33cfcc021f:member (SharePoint) MetadataItem: type: object properties: id: type: string name: type: string namespace: type: string type: $ref: '#/components/schemas/MetadataValueType' value: type: object LocallyUniqueObjectDirectoryId: type: string description: > An identifier (unique to the integrated application) for a [ObjectDirectory](#/components/schemas/ObjectDirectory) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) ObjectMetadata: required: - ApplicationInstanceId - GeneratedTime type: object properties: ApplicationInstanceId: type: string GeneratedTime: type: string format: date-time Profile: $ref: '#/components/schemas/SchemaProfile' ObjectOrRelationshipType: type: string description: > The _ObjectMetadata_ structure defines metadata that applies to every object and relationship, and is usually managed by the system that receives the data ProvisioningParticipant: type: object properties: authenticationKey: type: string description: >- Authentication key used to match the other side of the sync relationship entitySync: $ref: '#/components/schemas/EntitySyncSpecification' syncKey: type: string description: >- The syncKey identifies the matching entity used for the sync relationship and the syncMethod indicates how the sync is accomplished example: Oleria Repository Writers syncMethod: $ref: '#/components/schemas/SyncMethodType' description: > For IDP to application provisioning sync (as distinct from directory provider sync), the _ProvisioningParticipant_ structure provides information about a specific IDP to application connection for an entity (account, group, role, etc.) UserGroupType: type: string description: > The following group types are supported: 1. _Built-in_ groups are used to represent system-defined groups that can be leveraged by the application administrator to give access to resources via roles and permissions assigned to the group. Account membership in built-in groups is typically explicit 2. _Custom_ groups are created by administrators or users (with appropriate privilege) to give access to resources via roles and permissions assigned to the group. Account membership in custom groups is typically explicit 3. _Dynamic_ groups are created by administrators or users (with appropriate privilege) where membership in the group is dynamic and based on a defined set of attributes evaluated either periodically or at access control evaluation 4. _Modeled_ groups are an Oleria representation of an RBAC group like concept in the application typically used to represent concept like Everyone 5. _Sync_ groups are synchronized between an identity provider and enterprise application (or directory) example: Custom enum: - Built-in - Custom - Dynamic - Modeled - Sync DataClassifications: type: array items: $ref: '#/components/schemas/DataClassification' AdaptiveAuthenticationMethodSelectionPolicy: type: object properties: policy: $ref: '#/components/schemas/AuthenticationMethodSelectionPolicy' riskLevel: $ref: '#/components/schemas/AuthenticationRiskLevel' description: | Defines selection policies for an authentication risk level AuthenticationMethodSelectionPolicy: type: object properties: accountConditions: $ref: '#/components/schemas/ConditionSpecification' assignedApplicationConditions: $ref: '#/components/schemas/ConditionSpecification' authorizedLocations: $ref: '#/components/schemas/AuthorizedLocationPolicy' excludedAuthenticationMethods: type: array items: $ref: '#/components/schemas/AuthenticationMethod' includedAuthenticationMethods: type: array items: $ref: '#/components/schemas/AuthenticationMethod' description: > This policy expresses the selection criteria used by an IDP or MFA provider to select authentication methods for use at authentication time (usually as a subset of the enforced authentication methods) AuthenticationMethod: type: object properties: type: type: string description: type: string description: > Authentication methods describe how an [Account](#/components/schemas/Account) is required to authenticate to an enterprise application or identity provider. [Account](#/components/schemas/Account) include a list of enrolled authentication methods for the account, and [Activity](#/components/schemas/Activity) will include the authentication method used for login and other events. The type [AuthenticationMethodType](#/components/schemas/AuthenticationMethodType) is a string that can be one of many different authentication methods recognized by Oleria PasswordPolicy: type: object required: - expirationLengthInDays - length - resetViaSelfServiceAllowed - reuseDisallowed properties: characters: type: array items: $ref: '#/components/schemas/PasswordCharacterTypes' expirationLengthInDays: type: integer description: A value of 0 indicates passwords never expire. length: type: integer description: A value of 0 indicates no minimum password length requirement. mfaRequirements: $ref: '#/components/schemas/MFARequirements' reuseDisallowed: type: boolean resetViaSelfServiceAllowed: type: boolean policyMetadata: type: array description: >- An array of additional metadata items associated with the permission specification items: $ref: '#/components/schemas/MetadataItem' description: > The set of rules used by an organization, department, group, etc. to ensure the creation and maintenance of secure passwords MFARequirements: type: string description: | MFA requirements for an [Account](#/components/schemas/Account) example: Required enum: - Adaptive - EnrollmentRequired - Excluded - NotApplicable - NotRequired - Required - Unavailable AuthorizedEntityLocationPolicy: type: object required: - allowAll properties: allowAll: type: boolean description: | When set to true this indicates that all locations are authorized authorizedLocations: type: array description: > These are the locations authorized for use by the entity that has this policy. If none are specified then no locations are allowed. If any are specified and it is desirable for the _assignedLocations_ to be authorized, then they must be explicitly included in the array items: $ref: '#/components/schemas/LocationSpecification' description: > _AuthorizedEntityLocationPolicy_ is used to specify locations authorized for use by the specific entity that it is attached to AuthorizedInheritedLocationPolicy: type: object properties: sourceObjectType: $ref: '#/components/schemas/ObjectType' sourceObjectId: $ref: '#/components/schemas/LocallyUniqueId' description: > _AuthorizedInheritedLocationPolicy_ is used to specify an object that is the source for the location authorization data used by the specific entity the _AuthorizedInheritedLocationPolicy_ is attached to MetadataValueType: type: string enum: - array_boolean - array_float32 - array_float64 - array_int32 - array_int64 - array_string - boolean - float32 - float64 - int32 - int64 - oleria_global_id - oleria_local_id - pem - property_bag - rfc3339_date - string SchemaProfile: type: string enum: - Account - Membership - Governance - Risk - Access - Detection EntitySyncSpecification: type: object properties: attributeControls: type: array items: $ref: '#/components/schemas/EntitySyncAttributeMapping' protocol: $ref: '#/components/schemas/EntitySyncProtocol' protocolControls: type: array items: $ref: '#/components/schemas/EntitySyncProtocolSpecifiers' description: >- An EntitySyncSpecification expresses how accounts are synced among IDPs, directories, and enterprise applications SyncMethodType: type: string description: >- Sync methods for user groups between IDPs and enterprise applications where the UserGroup.syncKey identifies the matching group name used for the sync relationship and the UserGroup.syncMethod is a SyncMethodType indicating how the sync is accomplished enum: - ApplicationSpecific - Bidirectional - None - Pull - Push - Receive DataClassification: type: object properties: businessImpact: $ref: '#/components/schemas/ImpactLevel' compliance: type: array items: $ref: '#/components/schemas/ComplianceRegime' customerImpact: $ref: '#/components/schemas/ImpactLevel' dataSensitivity: $ref: '#/components/schemas/DataSensitivity' description: type: string id: $ref: '#/components/schemas/DataClassificationId' name: type: string description: >- DataClassification objects are emitted by integrated applications to indicate classification labels that have been created in the enterprise application system and assigned certain impact level, compliance regime, and data sensitivity properties where applicable. The Oleria aggregates these classifications across integrated applications and allows security teams customize as well as group by, filter by, and order by these labels when reviewing identity security and access information AuthenticationRiskLevel: type: string enum: - Critical - Default - High - Low - Moderate ConditionSpecification: type: object properties: context: type: array description: Additional context used when evaluating the conditional access items: $ref: '#/components/schemas/MetadataItem' overrides: type: array items: $ref: '#/components/schemas/ConditionOverrideSpecifier' rootOperator: $ref: '#/components/schemas/ConditionOperator' PasswordCharacterTypes: type: string enum: - AlphaUppercase - AlphaLowercase - AlphaCaseInsensitive - Numeric - SpecialSymbolic LocationSpecification: type: object properties: type: $ref: '#/components/schemas/LocationSpecificationType' typeSpecificData: oneOf: - $ref: '#/components/schemas/NetworkLocationSpecification' - $ref: '#/components/schemas/PhysicalLocationSpecification' ObjectType: type: string description: >- The enumerated list of all Oleria objects used to describe and manage any customer application's identity security. The definition of each object describes its usage example: Account enum: - Account - AccountRole - Activity - AssignedApplication - Authenticator - AuthenticatorEnrollment - Department - DirectoryProvider - Employee - IntegratedApplication - None - ObjectDirectory - PermissionSet - Person - ResourceClass - ResourceInstance - RiskDefinition - RiskViolation - Role - UserGroup LocallyUniqueId: minLength: 1 type: string description: > An identifier (unique to the integrated or assigned application) of any object or entity represented in the Oleria system as well as any relationship or connection among entities when they are represented in Oleria. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. The full list of Oleria objects or entities is defined by the object-type enumeration, and the full list of relationships or connections is defined by the relationship-type enumeration EntitySyncAttributeMapping: type: object properties: attributeSync: type: array items: $ref: '#/components/schemas/EntitySyncAttributeSpecifiers' id: type: string sourceAttributeName: type: string sourceEntityType: $ref: '#/components/schemas/ObjectType' targetAttributeName: type: string targetEntityType: $ref: '#/components/schemas/ObjectType' description: >- An EntitySyncAttributeMapping expresses how specific account or group fields are mapped during sync of objects among IDPs, directories, and enterprise applications EntitySyncProtocol: type: string description: >- These specifiers are used to identify different protocols for syncing account and group information among IDPs, directories, and enterprise applications enum: - AD - LDAP - SAML - SCIM EntitySyncProtocolSpecifiers: type: string description: >- These specifiers are used to express the protocol actions used to sync accounts among IDPs, directories, and enterprise applications enum: - Create - Deactivate - Delete - SyncPassword - Update ImpactLevel: type: string description: >- Impact of compromise of a secured information on the business or customer (enumeration ordered descending by criticality) enum: - MissionCritical - Critical - High - Moderate - Low - None ComplianceRegime: type: string description: >- Data compliance standards and information security categories that a security classification may be used in enum: - CCPA - CDPA - COPPA - CPA - GDPR - GLB - HIPAA - ISO-27001 - ISO-27018 - PCI - PII - SOC - SOC2 - UCPA DataSensitivity: type: string description: >- Sensitivity of the data associated with a resource (enumeration ordered descending by sensitivity) enum: - TopSecret - Secret - Confidential - ExtremelySensitive - Protected - AuthorizedDisclosure - Open - NotApplicable DataClassificationId: type: string description: >- An identifier for a specific data classification associated with an integrated application instance ConditionOverrideSpecifier: type: string enum: - AllowAdmin - AllowAll - AllowAnonymous - DenyAdmin - DenyAll - DenyAnonymous ConditionOperator: type: object properties: operator: oneOf: - $ref: '#/components/schemas/ConditionArrayOperator' - $ref: '#/components/schemas/ConditionComparisonOperator' - $ref: '#/components/schemas/ConditionContentSearchOperator' - $ref: '#/components/schemas/ConditionGraphOperator' - $ref: '#/components/schemas/ConditionLogicalOperator' - $ref: '#/components/schemas/ConditionSecureScriptOperator' type: $ref: '#/components/schemas/ConditionOperatorType' LocationSpecificationType: type: string enum: - Network - Physical NetworkLocationSpecification: type: object properties: ipAddressExclusions: type: array items: type: string ipAddressInclusions: type: array items: type: string name: type: string supplementaryInformation: $ref: '#/components/schemas/SupplementaryLocationInformation' description: > Specify a network location or zone with a name and a list of IP addresses or ranges (including in CIDR notation) PhysicalLocationSpecification: type: object properties: addressedObjectIdentifier: $ref: '#/components/schemas/AddressedObjectIdentifier' countryLevelInformation: $ref: '#/components/schemas/CountryLevelInformation' locality: $ref: '#/components/schemas/Locality' postcode: type: string description: | Postal code or ZIP code example: '98112' supplementaryInformation: $ref: '#/components/schemas/SupplementaryLocationInformation' description: > A subset of the ISO 19160-4:2023 delivery point specification. For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 EntitySyncAttributeSpecifiers: type: string enum: - OnCreate - OnUpdate ConditionArrayOperator: type: object required: - isArrayGeneratingDynamicValue properties: isArrayGeneratingDynamicValue: type: boolean arrayOpKey: $ref: '#/components/schemas/ConditionKey' arrayOpType: $ref: '#/components/schemas/ConditionArrayOperatorType' arrayOpValue: oneOf: - $ref: '#/components/schemas/ConditionArrayStaticValues' - $ref: '#/components/schemas/DynamicConditionValue' description: >- Condition used to specify conditional access based on presence or absence of the key data in the given array of values ConditionComparisonOperator: type: object properties: comparisonOpKey: $ref: '#/components/schemas/ConditionKey' comparisonOpType: $ref: '#/components/schemas/ConditionComparisonOperatorType' comparisonOpValue: $ref: '#/components/schemas/ConditionValue' description: >- Condition used to specify conditional access based on key - value comparison ConditionContentSearchOperator: type: object required: - searchOpIsDynamicCondition properties: searchOpIsDynamicCondition: type: boolean searchOpValue: oneOf: - $ref: '#/components/schemas/DynamicContentCondition' - $ref: '#/components/schemas/StaticContentCondition' description: >- Condition used to specify conditional access based on data inside a resource instance ConditionGraphOperator: type: object properties: graphOpSource: $ref: '#/components/schemas/ConditionGraphOperatorEntityIdentifier' graphOpTargets: type: array items: $ref: '#/components/schemas/ConditionGraphOperatorEntityIdentifier' graphOpTypes: $ref: '#/components/schemas/ConditionGraphOperatorType' description: >- Condition used to specify conditional access based on graph entity relationships ConditionLogicalOperator: type: object properties: logicalOpOperands: type: array items: $ref: '#/components/schemas/ConditionOperator' logicalOpType: $ref: '#/components/schemas/ConditionLogicalOperatorType' description: >- Condition used to specify conditional access based on a logical (AND, OR, NOT, EXISTS, ORDERED) operation ConditionSecureScriptOperator: type: object properties: contentType: $ref: '#/components/schemas/SecureScriptContentType' context: type: array description: >- Additional context used when accessing the data referenced by the condition key e.g. Function key parameters items: $ref: '#/components/schemas/MetadataItem' executionEngine: type: string scriptContent: type: string version: type: string description: A condition used to specify a script based conditional access expression ConditionOperatorType: type: string description: Categories of operators that can be used with conditional expressions enum: - Array - Comparison - ContentSearch - Graph - Logical - SecureScript SupplementaryLocationInformation: type: object properties: geoLocation: $ref: '#/components/schemas/GeoLocation' additionalLocationMetadata: type: array items: $ref: '#/components/schemas/MetadataItem' AddressedObjectIdentifier: type: object properties: building: type: string description: > Element identifying the number or name and type of the location edifice or construction example: The Madrona Refuge Building door: type: string description: | Element identifying the apartment, room, or office example: Suite 301 premisesIdentifier: type: string description: > Element designating the area or the object on an area associated with the location example: 1126 34th Avenue description: > Subset of an ISO 19160-4:2023 construct identifying a specific addess within a [Locality](#/components/schemas/Locality). For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 CountryLevelInformation: type: object properties: countryCode: type: string description: > Element designating the ISO 3166-1 A-2 country code for the country, territory or area of geopolitical interest example: US countryName: type: string description: > Element designating the country, dependency, or area of geopolitical interest example: United States multiCountryRegion: type: string description: > Element indicating a region in which the country, territory, or area of geopolitical interest is located and by which it is potentially more effectively recognized example: North America description: > Subset of ISO 19160-4:2023 country level information. For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 Locality: type: object properties: district: type: string description: > Element indicating the name of the area within or adjacent to the specified town example: Madrona (neighborhood in Seattle) region: type: string description: > Element specifying the geographic or administrative area of the country in which the town is situated example: Washington town: type: string description: > Element indicating the name of the populated place associated with the [LocationSpecification](#/components/schemas/LocationSpecification) in which this _Locality_ is being referenced example: Seattle description: > Subset of ISO 19160-4:2023 locality information identifying the geographical area. For context, the property examples reference the address - The Madrona Refuge Building, Suite 301, 1126 34th Avenue, Seattle, WA, 98112 ConditionKey: type: object properties: keySpecification: oneOf: - $ref: '#/components/schemas/ConditionKeyFunctionSpecifier' - $ref: '#/components/schemas/ConditionKeyObjectSpecifier' type: $ref: '#/components/schemas/ConditionKeyType' value: type: string description: >- Identifies the entity or function data used to evaluate the validity of a condition against the specified condition value ConditionArrayOperatorType: type: string description: Supported operators for array conditions enum: - In - NotIn ConditionArrayStaticValues: type: object properties: values: type: array items: $ref: '#/components/schemas/StaticConditionValue' description: Array of static values used as an operand in array conditions DynamicConditionValue: type: object properties: dynamicConditionValueContext: type: array description: >- This context can be passed to the function that resolves the dynamic specification to a static one items: $ref: '#/components/schemas/MetadataItem' dynamicConditionValueData: type: string description: >- Type for dynamic conditional access expression values. These will resolve to static ConditionValueTypes (or arrays of static ConditionValueTypes) by a relevant authorization function ConditionComparisonOperatorType: type: string description: Supported operators for comparison conditions enum: - Contains - DoesNotContain - Equal - GreaterThan - GreaterThanOrEqual - LessThan - LessThanOrEqual - NotEqual ConditionValue: type: object required: - isDynamic properties: data: oneOf: - $ref: '#/components/schemas/DynamicConditionValue' - $ref: '#/components/schemas/StaticConditionValue' isDynamic: type: boolean description: Typed condition value for static or dynamic values DynamicContentCondition: type: object required: - dynamicContentConditionCaseSensitive - dynamicContentConditionDiacriticSensitive properties: dynamicContentConditionCaseSensitive: type: boolean dynamicContentConditionDiacriticSensitive: type: boolean dynamicContentConditionLangage: type: string dynamicContentConditionResourceInstanceId: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' dynamicContentConditionSearch: $ref: '#/components/schemas/ConditionKey' description: >- A condition used to a target content search conditional access expression with a dynamic search string StaticContentCondition: type: object required: - staticContentConditionCaseSensitive - staticContentConditionDiacriticSensitive properties: staticContentConditionCaseSensitive: type: boolean staticContentConditionDiacriticSensitive: type: boolean staticContentConditionLanguage: type: string staticContentConditionResourceInstanceId: $ref: '#/components/schemas/LocallyUniqueResourceInstanceId' staticSearch: type: string description: >- A condition used to specify a target content search conditional access expression with a static search string ConditionGraphOperatorEntityIdentifier: type: object required: - isDynamicEntityIdentifier properties: isDynamicEntityIdentifier: type: boolean value: oneOf: - $ref: >- #/components/schemas/ConditionGraphOperatorConditionKeyEntityIdentifier - $ref: '#/components/schemas/EntityIdentifier' description: >- ConditionGraphOperatorEntityIdentifier is used to reference a entity (node) in the graph ConditionGraphOperatorType: type: string description: Supported operators for graph conditions enum: - AssignedAccessTo - MemberOf ConditionLogicalOperatorType: type: string description: Supported operators for logical conditions enum: - And - Exists - Not - Or - Ordered SecureScriptContentType: type: string description: Content types used to specify scripts for conditional access enum: - JavaScript - JSON - XML GeoLocation: type: object required: - latitude - longtitude properties: latitude: type: number longtitude: type: number description: Latitude and longtitude specification for a location ConditionKeyFunctionSpecifier: type: object properties: parameters: type: array description: >- Optional parameters used when accessing the data referenced by the condition key e.g. Function key parameters items: $ref: '#/components/schemas/MetadataItem' ConditionKeyObjectSpecifier: type: object properties: name: type: string description: >- Contextual object specifier for a condition key that is derefencing its value from an object type ConditionKeyType: type: string description: > The following types of keys are used to specify conditional access expressions: 1. A _Function_ key is used to identify a runtime function that will resolve to a value e.g. isLoggedIn, isImpersonatingUser, etc. 2. A _Object_ key is used to identify a particular field on an object where the value of the field on the object is used to determine the validity of the condition enum: - Function - Object StaticConditionValue: type: object properties: staticConditionValueType: $ref: '#/components/schemas/ConditionValueType' staticConditionValueData: type: object description: Type for static conditional access expression values LocallyUniqueResourceInstanceId: type: string description: > An identifier (unique to the integrated application) for a [ResourceInstance](#/components/schemas/ResourceInstance) object represented in the Oleria system. Oleria converts these identifiers to global ids so they can be unique in the context of the global system graph. It is important for this identifier to be based on an underlying persistent and reusable application or identity provider id so connections to the object are robust to metadata changes and other relevant operations example: >- repo:R_kgDOLL0doQ (GitHub based on repository node identifier), 1BUxdX4M-H7X8GKRgTjprJS8fjY_Ij1giE82lQlny2kc (Google Drive based on file id) ConditionGraphOperatorConditionKeyEntityIdentifier: type: object properties: objectIdConditionKey: $ref: '#/components/schemas/ConditionKey' objectTypeConditionKey: $ref: '#/components/schemas/ConditionKey' description: > ConditionGraphOperatorConditionKeyEntityIdentifier is used to reference a entity (node) in the graph with [ConditionKey](#/components/schemas/ConditionKey)-based dynamic values for _objectId_ and _objectType_ EntityIdentifier: type: object properties: federationInformation: $ref: '#/components/schemas/EntityIdentifierFederationInformation' objectId: $ref: '#/components/schemas/LocallyUniqueId' objectType: $ref: '#/components/schemas/ObjectType' description: > Used for typed indentification of an entity (node) in the graph with values for _objectId_ and _objectType_ ConditionValueType: type: string description: >- Types for condition values used in specifying static conditional access expression values enum: - activity_type - boolean - float - int32 - int64 - object - object_type - relationship_type - string responses: BadRequest: description: The request was malformed, for example an invalid cursor or page size. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: BAD_REQUEST message: The request was malformed. Unauthorized: description: Missing or invalid authentication token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: UNAUTHORIZED message: Missing or invalid authentication token. Forbidden: description: The token lacks the scope required for this resource. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: FORBIDDEN message: The token lacks the required scope. TooManyRequests: description: Rate limit exceeded. Retry after the interval in the Retry-After header. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: TOO_MANY_REQUESTS message: Rate limit exceeded. Retry after the specified interval. InternalError: description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: code: INTERNAL_ERROR message: An unexpected error occurred. securitySchemes: oauth2: type: oauth2 description: >- OAuth 2.0 client-credentials flow. Request an access token from the token endpoint and send it as `Authorization: Bearer `. flows: clientCredentials: tokenUrl: https://auth.prod.oleria.io/oauth/token scopes: https://devx.{environment}.oleria.io/delete: Irreversibly destroy an object in the source system. https://devx.{environment}.oleria.io/read: Read identity and access data, and the jobs that change it. https://devx.{environment}.oleria.io/write: >- Make reversible changes: grant, enable, assign, revoke and remove access. ````