Identity Governance-related APIs

Identity Governance has many features, including access requests, the governance glossary (catalog), and entitlements.

The following sections comprehensively explore the Identity Governance REST API endpoints.

YAML file

The REST APIs contain many parameters and, in some instances, large request bodies. For your convenience, you can view the entire API using a YAML file based on the OpenAPI specification.

To download the YAML file, click here.

Learn more in the API reference documentation.

Adjust the configurations of the file to match your specific details, such as your Advanced Identity Cloud tenant FQDN.

Access token

You need to obtain an access token to authenticate to the Advanced Identity Cloud REST API. Learn more about obtaining an access token in Authenticate to Advanced Identity Cloud REST API with access token.

After you obtain an access token, you can access the Identity Governance API using the specific HTTP methods: GET, POST, PUT, PATCH, and DELETE. You can use client command-line tools, such as cURL or API platforms, such as Postman to transfer data to and from the IGA server.

For example, using cURL:

curl \
--request GET \
--header 'Authorization: Bearer <access token>' \
"https://<tenant-env-fqdn>/iga/governance/application?_pageSize=10&_queryFilter=true"

Show example response

{
  "result": [
    {
      "application": {
		"authoritative": false,
      "connectorId": "AzureAD",
     		"description": "AzureAD application",
      ...
     	 	"name": "AzureAD",
      "templateName": "azure.ad",
     		 "templateVersion": "2.0",
      "objectTypes": [
        {
          "name": "__ACCOUNT__"
        },
        {
          "name": "__GROUP__",
          "accountAttribute": "memberOf"
        }
      ]
  },
  ...
}
  ],
  "searchAfterKey": "string",
  "resultCount": 0,
  "totalCount": 0
}

Endpoints

The following sections present the Identity Governance endpoints.

The output and examples presented in this section are based on a test dataset and are not real data.

Application

URI HTTP
method Description

/iga/governance/application

GET

Query Identity Governance applications. This endpoint is subject to scoped permissions given to the end user.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Responses

Code Description

200

500

Server error

Click for an example to get a list of applications

Media type: application/json

GET iga/governance/application?_pageSize=1&_queryFilter=true
{
  "result": [
    {
      "application": {
		"authoritative": false,
      "connectorId": "AzureAD",
     		"description": "AzureAD application",
      ...
     	 	"name": "AzureAD",
      "templateName": "azure.ad",
     		 "templateVersion": "2.0",
      "objectTypes": [
        {
          "name": "__ACCOUNT__"
        },
        {
          "name": "__GROUP__",
          "accountAttribute": "memberOf"
        }
      ]
  },
  ...
}
  ],
  "searchAfterKey": "string",
  "resultCount": 0,
  "totalCount": 0
}

/iga/governance/application/{id}/{objectType}/schema

GET

Returns the schema of a given application’s object type.

This endpoint helps identify the required payload structure for the request endpoint, specifically for the object key that holds the entitlement details. The endpoint is also used in the UI to dynamically generate forms for creating and modifying entitlements.

Parameters

Name Description

id string * required

ID of the application.

objectType string * required

Object type to get the schema.

Responses

Code Description

200

500

Server error

Click for an example to get the object type schema

Media type: application/json

GET iga/governance/application/{applicationId}/{objectType}/schema

For example:

GET iga/governance/application/e35d09cd-2b9b-41bc-8246-dc23d4a36502/Department/schema"
{
  "$schema": "http://json-schema.org/draft-03/schema",
  "id": "department",
  "nativeType": "department",
  "properties": {
    "__NAME__": {
      "flags": [
        "NOT_UPDATEABLE",
        "NOT_CREATABLE"
      ],
      "nativeName": "__NAME__",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 11,
      "displayName": "__NAME__"
    },
    "company": {
      "nativeName": "company",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 4,
      "displayName": "company"
    },
    "cost_center": {
      "nativeName": "cost_center",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 0,
      "displayName": "cost_center"
    },
    "dept_head": {
      "nativeName": "dept_head",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 15,
      "displayName": "dept_head"
    },
    "description": {
      "nativeName": "description",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 7,
      "displayName": "description"
    },
    "head_count": {
      "nativeName": "head_count",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 1,
      "displayName": "head_count"
    },
    "id": {
      "nativeName": "id",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 14,
      "displayName": "id"
    },
    "name": {
      "nativeName": "name",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 3,
      "displayName": "name"
    },
    "parent": {
      "nativeName": "parent",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 8,
      "displayName": "parent"
    },
    "primary_contact": {
      "nativeName": "primary_contact",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 10,
      "displayName": "primary_contact"
    },
    "sys_created_by": {
      "nativeName": "sys_created_by",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 12,
      "displayName": "sys_created_by"
    },
    "sys_created_on": {
      "nativeName": "sys_created_on",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 6,
      "displayName": "sys_created_on"
    },
    "sys_mod_count": {
      "flags": [
        "NOT_UPDATEABLE",
        "NOT_CREATABLE"
      ],
      "nativeName": "sys_mod_count",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 5,
      "displayName": "sys_mod_count"
    },
    "sys_tags": {
      "flags": [
        "NOT_UPDATEABLE",
        "NOT_CREATABLE"
      ],
      "nativeName": "sys_tags",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 13,
      "displayName": "sys_tags"
    },
    "sys_updated_by": {
      "flags": [
        "NOT_UPDATEABLE",
        "NOT_CREATABLE"
      ],
      "nativeName": "sys_updated_by",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 9,
      "displayName": "sys_updated_by"
    },
    "sys_updated_on": {
      "flags": [
        "NOT_UPDATEABLE",
        "NOT_CREATABLE"
      ],
      "nativeName": "sys_updated_on",
      "nativeType": "string",
      "type": "string",
      "userSpecific": true,
      "order": 2,
      "displayName": "sys_updated_on"
    }
  },
  "type": "object",
  "applicationId": "e35d09cd-2b9b-41bc-8246-dc23d4a36502"
}

Certification

URI HTTP
method Description

/iga/governance/certification/template

GET

Query existing certification templates.

Parameters

Name Description

queryString string

String to search name and description.

pageSize string

Number of results per page.

pageNumber string

Page number of results to display.

searchAfter string

An alternate of pageNumber, corresponds to the searchAfterKey value sent in the previous page’s results.

sortBy string

Property to sort results by.

sortDesc string

Direction to sort results by.

certificationType string

Filter by certification type. The available values are identity, roleMembership, and entitlement.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

GET /iga/governance/certification/templat?_pageSize=1
{
  "result": [
    {
      "status": "active",
      "certObjectType": "user",
      "name": "Biometrical Identity Scan  v0.1",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "identity",
      "ownerId": "managed/user/d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Luis Ye",
            "id": "d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5",
            "mail": "awd@asd.asd",
            "sn": "Herrera",
            "userName": "ye"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": "emailTemplate/certificationAssigned",
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": "emailTemplate/certificationReassigned",
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "accountGrant",
          "entitlementGrant",
          "roleMembership",
          "AccountGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "authoritative",
            "targetValue": false
          }
        },
        "account": {
          "operator": "ALL",
          "operand": []
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "role": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "Luis Ye",
        "id": "d4cdcf1e-9f97-4d50-ad6d-843bdfa47ae5",
        "mail": "awd@asd.asd",
        "sn": "Herrera",
        "userName": "ye"
      },
      "id": "afbd1e00-6b17-425b-a7e8-b34816b20174",
      "metadata": {
        "modifiedDate": "2025-03-20T21:47:32.325Z",
        "createdDate": "2025-03-20T21:47:13.329365134Z"
      }
    },
    {
      "status": "active",
      "certObjectType": "user",
      "name": "Bookmark App Test",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": true,
      "selfCertificationRule": "all",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": "BasicRevocation",
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "identity",
      "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Abel",
            "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
            "mail": "abel.tuter@example.com",
            "sn": "Tuter",
            "userName": "abel.tuter"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": null,
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": null,
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "accountGrant",
          "AccountGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "OR",
          "operand": [
            {
              "operand": {
                "targetName": "id",
                "targetValue": "06ad7fa8-b0c3-412e-a8af-7d27367dc4d3"
              },
              "operator": "EQUALS"
            }
          ]
        },
        "account": {
          "operator": "ALL",
          "operand": []
        },
        "memberOfOrg": [],
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "Abel",
        "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
        "mail": "abel.tuter@example.com",
        "sn": "Tuter",
        "userName": "abel.tuter"
      },
      "id": "cf31dc2f-96bc-4b9d-baca-a25b6fcd2b6c",
      "metadata": {
        "modifiedDate": "2025-03-26T16:10:54.979Z",
        "createdDate": "2025-03-26T16:10:48.375561804Z"
      }
    },
    {
      "status": "pending",
      "certObjectType": "user",
      "name": "Bookmark App Test (copy)",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": true,
      "selfCertificationRule": "all",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": "BasicRevocation",
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "identity",
      "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Abel",
            "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
            "mail": "abel.tuter@example.com",
            "sn": "Tuter",
            "userName": "abel.tuter"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": null,
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": null,
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "accountGrant",
          "AccountGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "OR",
          "operand": [
            {
              "operand": {
                "targetName": "id",
                "targetValue": "06ad7fa8-b0c3-412e-a8af-7d27367dc4d3"
              },
              "operator": "EQUALS"
            }
          ]
        },
        "account": {
          "operator": "ALL",
          "operand": []
        },
        "memberOfOrg": [],
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "Abel",
        "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
        "mail": "abel.tuter@example.com",
        "sn": "Tuter",
        "userName": "abel.tuter"
      },
      "id": "e92b134a-4843-41e1-89c3-eed7a21061a1",
      "scheduleId": null,
      "metadata": {
        "modifiedDate": "2025-05-09T11:20:37.22Z",
        "createdDate": "2025-03-26T16:45:03.022653856Z"
      }
    },
    {
      "status": "active",
      "certObjectType": "user",
      "name": "EC CV",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "entitlement",
      "ownerId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Carlos",
            "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
            "mail": "carlos.vibancoo@forgerock.com",
            "sn": "Vibanco",
            "userName": "cvibanco"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": "emailTemplate/certificationAssigned",
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": "emailTemplate/certificationReassigned",
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "entitlementGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "authoritative",
            "targetValue": false
          }
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "Carlos",
        "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
        "mail": "carlos.vibancoo@forgerock.com",
        "sn": "Vibanco",
        "userName": "cvibanco"
      },
      "id": "7526e7b6-6580-497c-817b-64e05e54d1dc",
      "scheduleId": null,
      "metadata": {
        "modifiedDate": "2025-03-27T03:26:27.344Z",
        "createdDate": "2025-03-27T03:25:49.018057675Z"
      }
    },
    {
      "status": "pending",
      "certObjectType": "user",
      "name": "EC CV (copy)",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": "",
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "entitlement",
      "ownerId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Carlos",
            "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
            "mail": "carlos.vibancoo@forgerock.com",
            "sn": "Vibanco",
            "userName": "cvibanco"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": "emailTemplate/certificationAssigned",
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": "emailTemplate/certificationReassigned",
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "entitlementGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "authoritative",
            "targetValue": false
          }
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "Carlos",
        "id": "9dd8eb23-6b5b-4573-b2ea-d9d886a1c43c",
        "mail": "carlos.vibancoo@forgerock.com",
        "sn": "Vibanco",
        "userName": "cvibanco"
      },
      "id": "9cd17b0f-6c92-4a2f-842f-dec592b47227",
      "metadata": {
        "modifiedDate": "2025-03-27T16:57:32.813732253Z",
        "createdDate": "2025-03-27T16:57:32.813730761Z"
      }
    },
    {
      "status": "active",
      "certObjectType": "user",
      "name": "EntitlementCert",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "entitlement",
      "ownerId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "mike",
            "id": "991cddde-a0ff-4da2-b01b-080e182ff395",
            "mail": "test@test.com",
            "sn": "test",
            "userName": "mikeTest"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": "emailTemplate/certificationAssigned",
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": "emailTemplate/certificationReassigned",
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "entitlementGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "authoritative",
            "targetValue": false
          }
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "mike",
        "id": "991cddde-a0ff-4da2-b01b-080e182ff395",
        "mail": "test@test.com",
        "sn": "test",
        "userName": "mikeTest"
      },
      "id": "5357fe84-db54-4853-bca7-e28580617830",
      "metadata": {
        "modifiedDate": "2025-03-21T18:20:38.449Z",
        "createdDate": "2025-03-21T18:20:19.686794893Z"
      }
    },
    {
      "status": "active",
      "certObjectType": "user",
      "name": "Entra Groups",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 0,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "entitlement",
      "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Abel",
            "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
            "mail": "abel.tuter@example.com",
            "sn": "Tuter",
            "userName": "abel.tuter"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": null,
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": null,
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "entitlementGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "OR",
          "operand": [
            {
              "operand": {
                "targetName": "id",
                "targetValue": "89feff34-86e3-4c00-b0ff-376c772ba1b7"
              },
              "operator": "EQUALS"
            }
          ]
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": false,
        "exceptionAllowed": false
      },
      "ownerInfo": {
        "givenName": "Abel",
        "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
        "mail": "abel.tuter@example.com",
        "sn": "Tuter",
        "userName": "abel.tuter"
      },
      "id": "94b71f9e-f5a1-488f-8d9a-fed558ed74d8",
      "metadata": {
        "modifiedDate": "2025-03-25T05:39:42.616Z",
        "createdDate": "2025-03-25T05:39:36.35029936Z"
      }
    },
    {
      "status": "pending",
      "certObjectType": "user",
      "name": "Entra Groups (copy)",
      "description": "",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": "",
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 0,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "entitlement",
      "ownerId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Abel",
            "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
            "mail": "abel.tuter@example.com",
            "sn": "Tuter",
            "userName": "abel.tuter"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": null,
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": null,
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "entitlementGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "OR",
          "operand": [
            {
              "operand": {
                "targetName": "id",
                "targetValue": "89feff34-86e3-4c00-b0ff-376c772ba1b7"
              },
              "operator": "EQUALS"
            }
          ]
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": false,
        "exceptionAllowed": false
      },
      "ownerInfo": {
        "givenName": "Abel",
        "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
        "mail": "abel.tuter@example.com",
        "sn": "Tuter",
        "userName": "abel.tuter"
      },
      "id": "569ccdb3-5583-4d7b-9c10-20ae76dd74ab",
      "metadata": {
        "modifiedDate": "2025-03-25T06:04:33.45811308Z",
        "createdDate": "2025-03-25T06:04:33.458111794Z"
      }
    },
    {
      "status": "active",
      "certObjectType": "user",
      "name": "MikeTest",
      "description": "test",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": false,
      "selfCertificationRule": "none",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": true,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "identity",
      "ownerId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "mike",
            "id": "991cddde-a0ff-4da2-b01b-080e182ff395",
            "mail": "test@test.com",
            "sn": "test",
            "userName": "mikeTest"
          }
        }
      ],
      "defaultCertifierId": "managed/user/991cddde-a0ff-4da2-b01b-080e182ff395",
      "assignmentNotification": "emailTemplate/certificationAssigned",
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": "emailTemplate/certificationReassigned",
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "accountGrant",
          "entitlementGrant",
          "roleMembership",
          "AccountGrant",
          "ResourceGrant"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "application": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "authoritative",
            "targetValue": false
          }
        },
        "account": {
          "operator": "ALL",
          "operand": []
        },
        "memberOfOrg": [],
        "entitlement": {
          "operator": "ALL",
          "operand": []
        },
        "role": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "expirationNotificationDay": 5,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "mike",
        "id": "991cddde-a0ff-4da2-b01b-080e182ff395",
        "mail": "test@test.com",
        "sn": "test",
        "userName": "mikeTest"
      },
      "defaultCertifierInfo": {
        "givenName": "mike",
        "id": "991cddde-a0ff-4da2-b01b-080e182ff395",
        "mail": "test@test.com",
        "sn": "test",
        "userName": "mikeTest"
      },
      "id": "f3a5ee0f-975a-443f-8a94-a70bca08f9af",
      "scheduleId": null,
      "metadata": {
        "modifiedDate": "2025-03-20T16:04:26.713Z",
        "createdDate": "2025-03-18T23:46:41.305877852Z"
      }
    },
    {
      "status": "active",
      "certObjectType": "user",
      "name": "Role Membership Certification",
      "description": "Role Membership Certification",
      "isEventBased": false,
      "stagingEnabled": false,
      "schedule": null,
      "skipInactiveCertifiers": false,
      "allowSelfCertification": true,
      "selfCertificationRule": "all",
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "claim": true,
        "delegate": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "save": true,
        "signoff": true
      },
      "exceptionDuration": 14,
      "allowBulkCertify": true,
      "allowPartialSignoff": false,
      "remediationRule": null,
      "initializeRule": "",
      "finalizeRule": "",
      "certificationType": "roleMembership",
      "ownerId": "managed/user/75982e79-40dc-4ad2-8b85-abe1ebd2e2b9",
      "stageDuration": 14,
      "expirationAction": null,
      "expirationActionDelay": 0,
      "expirationReassignee": null,
      "stages": [
        {
          "certifierType": "user",
          "certifierId": "managed/user/15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
          "certifierScript": null,
          "certifierInfo": {
            "givenName": "Abel",
            "id": "15ed1cdd-8a3b-4b26-82d4-a3eed78e3bfa",
            "mail": "abel.tuter@example.com",
            "sn": "Tuter",
            "userName": "abel.tuter"
          }
        }
      ],
      "defaultCertifierId": null,
      "assignmentNotification": null,
      "assignmentNotificationIncludeManager": false,
      "reassignNotification": null,
      "expirationNotification": null,
      "reminderNotification": null,
      "reminderFrequency": 0,
      "escalationNotification": null,
      "escalationFrequency": null,
      "escalationOwner": null,
      "remediationDelay": 0,
      "targetFilter": {
        "type": [
          "roleMembership"
        ],
        "user": {
          "operator": "ALL",
          "operand": []
        },
        "memberOfOrg": [],
        "role": {
          "operator": "ALL",
          "operand": []
        },
        "decision": {
          "operator": "ALL",
          "operand": []
        }
      },
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "requireJustification": {
        "revoke": true,
        "exceptionAllowed": true
      },
      "ownerInfo": {
        "givenName": "Frank",
        "id": "75982e79-40dc-4ad2-8b85-abe1ebd2e2b9",
        "mail": "fyork@example.com",
        "sn": "York",
        "userName": "fyork"
      },
      "id": "deb85d50-170b-4c5a-abb8-defa3ed8baef",
      "metadata": {
        "modifiedDate": "2025-03-26T15:46:19.528Z",
        "createdDate": "2025-03-26T15:45:57.050282486Z"
      }
    }
  ],
  "resultCount": 10,
  "totalHits": 21,
  "searchAfterKey": [
    "Role Membership Certification",
    "deb85d50-170b-4c5a-abb8-defa3ed8baef"
  ]
}

/iga/governance/certification/template

POST

Create a new certification template.

Parameters

No parameters

Request body * required

Media type: application/json

{
  "name": "Active Directory Certification",
  "description": "Certifying the accounts within active directory applications",
  "stagingEnabled": false,
  "schedule": null,
  "allowSelfCertification": false,
  "selfCertificationRule": "none",
  "enableForward": true,
  "enableReassign": true,
  "reassignPermissions": {
    "certify": true,
    "comment": true,
    "exception": true,
    "forward": true,
    "reassign": true,
    "reset": true,
    "revoke": true,
    "signoff": true
  },
  "exceptionDuration": 7,
  "allowBulkCertify": true,
  "allowPartialSignoff": true,
  "remediationRule": "",
  "initializeRule": "",
  "finalizeRule": "",
  "certificationType": "identity",
  "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6",
  "stageDuration": 14,
  "expirationAction": "revoke",
  "expirationActionDelay": 0,
  "expirationReassignee": null,
  "stages": [
   {
     "certifierType": "user",
     "certifierId": "managed/user/79cc9f29-8d89-4958-8074-ce0df88979a2"
   }
  ],
  "defaultCertifierId": null,
  "assignmentNotification": null,
  "reassignNotification": null,
  "expirationNotification": null,
  "reminderNotification": null,
  "reminderFrequency": 0,
  "escalationNotification": null,
  "escalationFrequency": null,
  "escalationOwner": null,
  "remediationDelay": 0,
  "targetFilter": {
    "user": {
      "operator": "ALL",
      "operand": []
    },
    "type": [
      "accountGrant"
    ],
    "application": {
      "operator": "CONTAINS",
      "operand": {
        "targetName": "name",
        "targetValue": "Active Directory"
      }
    }
  },
  "excludeConditionalAccess": true,
  "excludeRoleBasedAccess": true,
  "includeChildOrganizations": true
}

Responses

Code Description

201

Creation success. Returns the saved template object.

400

Invalid data provided.

500

Server error

Click for an example response

Media type: application/json

POST iga/governance/certification/template
{
  "name": "Active Directory Certification",
  "description": "Certifying the accounts within active directory applications",
  "stagingEnabled": false,
  "schedule": null,
  "allowSelfCertification": false,
  "selfCertificationRule": "none",
  "enableForward": true,
  "enableReassign": true,
  "reassignPermissions": {
    "certify": true,
    "comment": true,
    "exception": true,
    "forward": true,
    "reassign": true,
    "reset": true,
    "revoke": true,
    "signoff": true
  },
  "exceptionDuration": 7,
  "allowBulkCertify": true,
  "allowPartialSignoff": true,
  "remediationRule": "",
  "initializeRule": "",
  "finalizeRule": "",
  "certificationType": "identity",
  "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6",
  "stageDuration": 14,
  "expirationAction": "revoke",
  "expirationActionDelay": 0,
  "expirationReassignee": null,
  "stages": [
    {
      "certifierType": "user",
      "certifierId": "managed/user/79cc9f29-8d89-4958-8074-ce0df88979a2"
    }
  ],
  "defaultCertifierId": null,
  "assignmentNotification": null,
  "reassignNotification": null,
  "expirationNotification": null,
  "reminderNotification": null,
  "reminderFrequency": 0,
  "escalationNotification": null,
  "escalationFrequency": null,
  "escalationOwner": null,
  "remediationDelay": 0,
  "targetFilter": {
    "user": {
      "operator": "ALL",
      "operand": []
    },
    "type": [
      "accountGrant",
      "AccountGrant"
    ],
    "application": {
      "operator": "CONTAINS",
      "operand": {
        "targetName": "name",
        "targetValue": "Active Directory"
      }
    }
  },
  "excludeConditionalAccess": true,
  "excludeRoleBasedAccess": true,
  "includeChildOrganizations": true,
  "status": "pending",
  "id": "5626c308-250f-4b50-9f92-0c7e122e95c9"
}

/iga/governance/certification/template/{id}/duplicate

POST

Duplicate an existing certification template.

Parameters

Name Description

id string * required

ID of the template object to copy

Responses

Code Description

200

400

Invalid request

404

Template not found

500

Server error

Click for an example response

Media type: application/json

POST /iga/governance/certification/template/afbd1e00-6b17-425b-a7e8-b34816b20174/duplicate
{
  "message": "Cert Template duplicated successfully"
}

/iga/governance/certification/template/{id}

PUT

Update a single certification template.

Parameters

Name Description

id string * required

ID of the template object

Request body

Media type: application/json

{
  "id": "string",
  "name": "string",
  "description": "string",
  "certificationType": "identity",
  "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6",
  "ownerId": "string",
  "schedule": {
    "id": "string",
    "type": "simple",
    "startTime": "string",
    "endTime": "string",
    "repeatCount": 0,
    "repeatInterval": 0,
    "schedule": "string",
    "invokeContext": {},
    "enabled": true
  },
  "allowSelfCertification": false,
  "targetFilter": {
    "user": {
      "operator": "EQUALS",
      "operand": {
        "targetName": "accountStatus",
        "targetValue": "active"
      }
    },
    "application": {
      "operator": "CONTAINS",
      "operand": {
        "targetName": "name",
        "targetValue": "SalesForce"
      }
    },
    "type": [
      "accountGrant"
    ],
    "memberOfOrg": [
      "52cf01b4-288e-4c21-aed6-f992be073988"
    ]
  },
  "stages": [
    {
      "name": "string",
      "certifierType": "user",
      "certifierId": "managed/user/79cc9f29-8d89-4958-8074-ce0df88979a"
    }
  ],
  "stageDuration": 0,
  "expirationAction": "certify",
  "expirationActionDelay": 0,
  "expirationReassignee": null,
  "stagingEnabled": true,
  "defaultCertifierId": "string",
  "allowBulkCertify": true,
  "allowPartialSignoff": true,
  "remediationRule": "string",
  "initializeRule": "",
  "finalizeRule": "",
  "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6",
  "exceptionDuration": 0,
  "enableForward": true,
  "enableReassign": true,
  "reassignPermissions": {
    "certify": true,
    "comment": true,
    "exception": true,
    "forward": true,
    "reassign": true,
    "reset": true,
    "revoke": true,
    "signoff": true
  },
  "selfCertificationRule": "all",
  "assignmentNotification": "string",
  "reassignNotification": "string",
  "expirationNotification": "string",
  "expirationNotificationDay": "string",
  "reminderNotification": "string",
  "reminderFrequency": 0,
  "escalationNotification": "string",
  "escalationFrequency": 0,
  "escalationOwner": "string",
  "remediationDelay": 0,
  "excludeConditionalAccess": true,
  "excludeRoleBasedAccess": true,
  "includeChildOrganizations": true,
  "parameters": [
    {
      "id": "string",
      "displayName": "string",
      "path": "string"
    }
  ],
  "templateEventType": "user"
}

Responses

Code Description

200

400

Invalid request

404

Template not found

500

Server error

Click for an example response

Media type: application/json

PUT /iga/governance/certification/template/5626c308-250f-4b50-9f92-0c7e122e95c9
[
  {
    "id": "string",
    "name": "string",
    "description": "string",
    "certificationType": "identity",
    "ownerId": "managed/user/926de311-0949-415d-a9e4-94a87632b0f6",
    "schedule": {
      "id": "string",
      "type": "simple",
      "startTime": "string",
      "endTime": "string",
      "repeatCount": 0,
      "repeatInterval": 0,
      "schedule": "string",
      "invokeContext": {},
      "enabled": true
    },
    "targetFilter": {
      "user": {
        "operator": "EQUALS",
        "operand": {
          "targetName": "accountStatus",
          "targetValue": "active"
        }
      },
      "application": {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "name",
          "targetValue": "SalesForce"
        }
      },
      "type": [
        "accountGrant"
      ],
      "memberOfOrg": [
        "52cf01b4-288e-4c21-aed6-f992be073988"
      ]
    },
    "stages": [
      {
        "name": "string",
        "certifierType": "user",
        "certifierId": "string"
      }
    ],
    "stageDuration": 0,
    "expirationAction": "certify",
    "expirationActionDelay": "string",
    "expirationReassignee": "string",
    "stagingEnabled": true,
    "defaultCertifierId": "string",
    "allowBulkCertify": true,
    "allowPartialSignoff": true,
    "remediationRule": "string",
    "remediationDelay": 0,
    "exceptionDuration": 0,
    "enableForward": true,
    "enableReassign": true,
    "reassignPermissions": {
      "certify": true,
      "comment": true,
      "exception": true,
      "forward": true,
      "reassign": true,
      "reset": true,
      "revoke": true,
      "signoff": true
    },
    "selfCertificationRule": "all",
    "assignmentNotification": "string",
    "reassignNotification": "string",
    "expirationNotification": "string",
    "expirationNotificationDay": "string",
    "reminderNotification": "string",
    "reminderFrequency": 0,
    "escalationNotification": "string",
    "escalationFrequency": 0,
    "escalationOwner": "string",
    "excludeConditionalAccess": true,
    "excludeRoleBasedAccess": true,
    "includeChildOrganizations": true,
    "parameters": [
      {
        "id": "string",
        "displayName": "string",
        "path": "string"
      }
    ],
    "templateEventType": "user",
    "status": "active",
    "scheduleId": "string",
    "ownerInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "defaultCertifierInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "escalationOwnerInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "expirationReassigneeInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "name": "string"
    }
  }
]

/iga/governance/certification/template/{id}

DELETE

Delete a single certification template at the requested ID in the path.

Parameters

Name Description

id string * required

ID of the template object

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "name": "string",
    "description": "string",
    "certificationType": "identity",
    "ownerId": "string",
    "schedule": {
      "id": "string",
      "type": "simple",
      "startTime": "string",
      "endTime": "string",
      "repeatCount": 0,
      "repeatInterval": 0,
      "schedule": "string",
      "invokeContext": {},
      "enabled": true
    },
    "targetFilter": {
      "user": {
        "operator": "EQUALS",
        "operand": {
          "targetName": "accountStatus",
          "targetValue": "active"
        }
      },
      "application": {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "name",
          "targetValue": "SalesForce"
        }
      },
      "type": [
        "accountGrant"
      ],
      "memberOfOrg": [
        "52cf01b4-288e-4c21-aed6-f992be073988"
      ]
    },
    "stages": [
      {
        "name": "string",
        "certifierType": "user",
        "certifierId": "string"
      }
    ],
    "stageDuration": 0,
    "expirationAction": "certify",
    "expirationActionDelay": "string",
    "expirationReassignee": "string",
    "stagingEnabled": true,
    "defaultCertifierId": "string",
    "allowBulkCertify": true,
    "allowPartialSignoff": true,
    "remediationRule": "string",
    "remediationDelay": 0,
    "exceptionDuration": 0,
    "enableForward": true,
    "enableReassign": true,
    "reassignPermissions": {
      "certify": true,
      "comment": true,
      "exception": true,
      "forward": true,
      "reassign": true,
      "reset": true,
      "revoke": true,
      "signoff": true
    },
    "selfCertificationRule": "all",
    "assignmentNotification": "string",
    "reassignNotification": "string",
    "expirationNotification": "string",
    "expirationNotificationDay": "string",
    "reminderNotification": "string",
    "reminderFrequency": 0,
    "escalationNotification": "string",
    "escalationFrequency": 0,
    "escalationOwner": "string",
    "excludeConditionalAccess": true,
    "excludeRoleBasedAccess": true,
    "includeChildOrganizations": true,
    "parameters": [
      {
        "id": "string",
        "displayName": "string",
        "path": "string"
      }
    ],
    "templateEventType": "user",
    "status": "active",
    "scheduleId": "string",
    "ownerInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "defaultCertifierInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "escalationOwnerInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "expirationReassigneeInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "name": "string"
    }
  }
]

/iga/governance/certification/get-filter-schema

POST

Get the available schema on which to filter certification templates.

Returns a collection of schema properties that are available to populate the certification templates target filter property, including properties of application, user, entitlement, role, and other objects.

Parameters

No parameters

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "application": [
    {
      "key": "application.description",
      "name": "description",
      "displayName": "Description",
      "description": "Application Description",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "application.name",
      "name": "name",
      "displayName": "Name",
      "description": "Application name",
      "type": "string",
      "isMultiValue": false
    }
  ],
  "entitlement": [
    {
      "key": "glossary.idx./entitlement.description",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": null,
      "searchable": true,
      "isInternal": true,
      "displayName": "Description",
      "name": "description",
      "description": "Description of entitlement",
      "objectType": "/openidm/managed/assignment",
      "type": "string"
    },
    {
      "key": "entitlement.displayName",
      "name": "displayName",
      "displayName": "Display Name",
      "description": "",
      "type": "text",
      "isMultiValue": false
    },
    {
      "key": "glossary.idx./entitlement.entitlementOwner",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": "/openidm/managed/user",
      "searchable": true,
      "isInternal": true,
      "displayName": "Entitlement Owner",
      "name": "entitlementOwner",
      "description": "Entitlement Owner of Object",
      "objectType": "/openidm/managed/assignment",
      "type": "managedObject"
    },
    {
      "key": "glossary.idx./entitlement.requestable",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": null,
      "searchable": true,
      "isInternal": true,
      "displayName": "Requestable",
      "name": "requestable",
      "description": "Can the entitlement be requested",
      "objectType": "/openidm/managed/assignment",
      "type": "boolean"
    }
  ],
  "role": [
    {
      "key": "role.applications._ref",
      "name": "applications",
      "displayName": "Applications",
      "description": "Role Applications",
      "type": "managedObject",
      "isMultiValue": true,
      "managedObjectType": "/openidm/managed/alpha_application"
    },
    {
      "key": "role.description",
      "name": "description",
      "displayName": "Description",
      "description": "The role description, used for display purposes.",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "role.id",
      "name": "_id",
      "displayName": "Name",
      "description": "Role ID",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "role.name",
      "name": "name",
      "displayName": "Name",
      "description": "The role name, used for display purposes.",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "glossary.idx./role.requestable",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": null,
      "searchable": true,
      "isInternal": true,
      "displayName": "Requestable",
      "name": "requestable",
      "description": "Can the role be requested",
      "objectType": "/openidm/managed/role",
      "type": "boolean"
    },
    {
      "key": "role.members._ref",
      "name": "members",
      "displayName": "Role Members",
      "description": "Role Members",
      "type": "managedObject",
      "isMultiValue": true,
      "managedObjectType": "/openidm/managed/alpha_user"
    }
  ]
}

/iga/governance/certification/admin/certification

GET

Query existing certification campaign instances.

Returns certification campaigns based on a set of query parameters.

Parameters

Name Description

queryString string

String to search against name and description.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

status string

Filter by status of the certification. The available values are active and closed.

certificationType string

Filter by certification type. The available value is identity.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "name": "string",
      "description": "string",
      "certificationType": "identity",
      "ownerId": "string",
      "schedule": {
        "id": "string",
        "type": "simple",
        "startTime": "string",
        "endTime": "string",
        "repeatCount": 0,
        "repeatInterval": 0,
        "schedule": "string",
        "invokeContext": {},
        "enabled": true
      },
      "targetFilter": {
        "user": {
          "operator": "EQUALS",
          "operand": {
            "targetName": "accountStatus",
            "targetValue": "active"
          }
        },
        "application": {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "name",
            "targetValue": "SalesForce"
          }
        },
        "type": [
          "accountGrant"
        ],
        "memberOfOrg": [
          "52cf01b4-288e-4c21-aed6-f992be073988"
        ]
      },
      "stages": [
        {
          "name": "string",
          "certifierType": "user",
          "certifierId": "string"
        }
      ],
      "stageDuration": 0,
      "expirationAction": "certify",
      "expirationActionDelay": "string",
      "expirationReassignee": "string",
      "stagingEnabled": true,
      "defaultCertifierId": "string",
      "allowBulkCertify": true,
      "allowPartialSignoff": true,
      "remediationRule": "string",
      "remediationDelay": 0,
      "exceptionDuration": 0,
      "enableForward": true,
      "enableReassign": true,
      "reassignPermissions": {
        "certify": true,
        "comment": true,
        "exception": true,
        "forward": true,
        "reassign": true,
        "reset": true,
        "revoke": true,
        "signoff": true
      },
      "selfCertificationRule": "all",
      "assignmentNotification": "string",
      "reassignNotification": "string",
      "expirationNotification": "string",
      "expirationNotificationDay": "string",
      "reminderNotification": "string",
      "reminderFrequency": 0,
      "escalationNotification": "string",
      "escalationFrequency": 0,
      "escalationOwner": "string",
      "excludeConditionalAccess": true,
      "excludeRoleBasedAccess": true,
      "includeChildOrganizations": true,
      "parameters": [
        {
          "id": "string",
          "displayName": "string",
          "path": "string"
        }
      ],
      "templateEventType": "user",
      "status": "active",
      "scheduleId": "string",
      "ownerInfo": {
        "id": "string",
        "userName": "string",
        "mail": "string",
        "givenName": "string",
        "sn": "string"
      },
      "defaultCertifierInfo": {
        "id": "string",
        "userName": "string",
        "mail": "string",
        "givenName": "string",
        "sn": "string"
      },
      "escalationOwnerInfo": {
        "id": "string",
        "userName": "string",
        "mail": "string",
        "givenName": "string",
        "sn": "string"
      },
      "expirationReassigneeInfo": {
        "id": "string",
        "userName": "string",
        "mail": "string",
        "givenName": "string",
        "sn": "string",
        "name": "string"
      },
      "templateId": "string",
      "startDate": "string",
      "deadline": "string",
      "completionDate": "string",
      "completedBy": {},
      "expirationNotificationDate": "string",
      "reminderNotificationDate": "string",
      "escalationNotificationDate": "string",
      "etlJobId": "string",
      "systemMessages": {
        "info": [
          {}
        ],
        "errors": [
          {}
        ]
      }
    }
  ],
  "totalHits": 0,
  "searchAfterKey": [
    "string"
  ]
}

/iga/governance/certification/admin/certification/{certId}

GET

Read a single certification campaign.

Returns the certification campaign from the provided campaign ID.

Parameters

Name Description

certId string * required

ID of the certification campaign

Responses

Code Description

200

400

Invalid request

404

Certification not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "description": "string",
  "certificationType": "identity",
  "ownerId": "string",
  "schedule": {
    "id": "string",
    "type": "simple",
    "startTime": "string",
    "endTime": "string",
    "repeatCount": 0,
    "repeatInterval": 0,
    "schedule": "string",
    "invokeContext": {},
    "enabled": true
  },
  "targetFilter": {
    "user": {
      "operator": "EQUALS",
      "operand": {
        "targetName": "accountStatus",
        "targetValue": "active"
      }
    },
    "application": {
      "operator": "CONTAINS",
      "operand": {
        "targetName": "name",
        "targetValue": "SalesForce"
      }
    },
    "type": [
      "accountGrant"
    ],
    "memberOfOrg": [
      "52cf01b4-288e-4c21-aed6-f992be073988"
    ]
  },
  "stages": [
    {
      "name": "string",
      "certifierType": "user",
      "certifierId": "string"
    }
  ],
  "stageDuration": 0,
  "expirationAction": "certify",
  "expirationActionDelay": "string",
  "expirationReassignee": "string",
  "stagingEnabled": true,
  "defaultCertifierId": "string",
  "allowBulkCertify": true,
  "allowPartialSignoff": true,
  "remediationRule": "string",
  "remediationDelay": 0,
  "exceptionDuration": 0,
  "enableForward": true,
  "enableReassign": true,
  "reassignPermissions": {
    "certify": true,
    "comment": true,
    "exception": true,
    "forward": true,
    "reassign": true,
    "reset": true,
    "revoke": true,
    "signoff": true
  },
  "selfCertificationRule": "all",
  "assignmentNotification": "string",
  "reassignNotification": "string",
  "expirationNotification": "string",
  "expirationNotificationDay": "string",
  "reminderNotification": "string",
  "reminderFrequency": 0,
  "escalationNotification": "string",
  "escalationFrequency": 0,
  "escalationOwner": "string",
  "excludeConditionalAccess": true,
  "excludeRoleBasedAccess": true,
  "includeChildOrganizations": true,
  "parameters": [
    {
      "id": "string",
      "displayName": "string",
      "path": "string"
    }
  ],
  "templateEventType": "user",
  "status": "active",
  "scheduleId": "string",
  "ownerInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string"
  },
  "defaultCertifierInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string"
  },
  "escalationOwnerInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string"
  },
  "expirationReassigneeInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string",
    "name": "string"
  },
  "templateId": "string",
  "startDate": "string",
  "deadline": "string",
  "completionDate": "string",
  "completedBy": {},
  "expirationNotificationDate": "string",
  "reminderNotificationDate": "string",
  "escalationNotificationDate": "string",
  "etlJobId": "string",
  "systemMessages": {
    "info": [
      {}
    ],
    "errors": [
      {}
    ]
  },
  "totalTargets": 0,
  "totalItems": 0,
  "totalItemsComplete": 0,
  "percentItemsComplete": 0
}

/iga/governance/certification/admin/certification/{certId}/tasks

GET

Get the actors (certifiers) tasks view for a certification.

Returns the tasks assigned to different actors (certifiers) as part of a certification.

Parameters

Name Description

certId string * required

ID of the certification campaign

queryString string

Search tasks based on reviewer information (userName, sn, givenName, mail)

_pageSize string

Number of response result objects to return

_pageNumber string

Page number of results to show.

sortBy string

Term on which to sort tasks (for example, actor.userName, progress)

_sortDir string

Direction of sort: asc, desc.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "actor": {
        "id": "string",
        "givenName": "string",
        "sn": "string",
        "userName": "string",
        "type": "user",
        "name": "string",
        "key": "string"
      },
      "inProgress": 0,
      "complete": 0,
      "total": 0,
      "progress": 0,
      "status": "staging"
    }
  ]
}

/iga/governance/certification/admin/certification/{certId}/update-deadline

POST

Update a certification’s deadline.

Update a certification’s deadline when you provide a new one.

Parameters

Name Description

certId string * required

ID of the certification campaign

Request body * required

Media type: application/json

{
  "newDeadline": "2023-05-01T12:00:00+00:00"
}

Responses

Code Description

200

400

Invalid request

404

Certification couldn’t be found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "description": "string",
  "certificationType": "identity",
  "ownerId": "string",
  "schedule": {
    "id": "string",
    "type": "simple",
    "startTime": "string",
    "endTime": "string",
    "repeatCount": 0,
    "repeatInterval": 0,
    "schedule": "string",
    "invokeContext": {},
    "enabled": true
  },
  "targetFilter": {
    "user": {
      "operator": "EQUALS",
      "operand": {
        "targetName": "accountStatus",
        "targetValue": "active"
      }
    },
    "application": {
      "operator": "CONTAINS",
      "operand": {
        "targetName": "name",
        "targetValue": "SalesForce"
      }
    },
    "type": [
      "accountGrant"
    ],
    "memberOfOrg": [
      "52cf01b4-288e-4c21-aed6-f992be073988"
    ]
  },
  "stages": [
    {
      "name": "string",
      "certifierType": "user",
      "certifierId": "string"
    }
  ],
  "stageDuration": 0,
  "expirationAction": "certify",
  "expirationActionDelay": "string",
  "expirationReassignee": "string",
  "stagingEnabled": true,
  "defaultCertifierId": "string",
  "allowBulkCertify": true,
  "allowPartialSignoff": true,
  "remediationRule": "string",
  "remediationDelay": 0,
  "exceptionDuration": 0,
  "enableForward": true,
  "enableReassign": true,
  "reassignPermissions": {
    "certify": true,
    "comment": true,
    "exception": true,
    "forward": true,
    "reassign": true,
    "reset": true,
    "revoke": true,
    "signoff": true
  },
  "selfCertificationRule": "all",
  "assignmentNotification": "string",
  "reassignNotification": "string",
  "expirationNotification": "string",
  "expirationNotificationDay": "string",
  "reminderNotification": "string",
  "reminderFrequency": 0,
  "escalationNotification": "string",
  "escalationFrequency": 0,
  "escalationOwner": "string",
  "excludeConditionalAccess": true,
  "excludeRoleBasedAccess": true,
  "includeChildOrganizations": true,
  "parameters": [
    {
      "id": "string",
      "displayName": "string",
      "path": "string"
    }
  ],
  "templateEventType": "user",
  "status": "active",
  "scheduleId": "string",
  "ownerInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string"
  },
  "defaultCertifierInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string"
  },
  "escalationOwnerInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string"
  },
  "expirationReassigneeInfo": {
    "id": "string",
    "userName": "string",
    "mail": "string",
    "givenName": "string",
    "sn": "string",
    "name": "string"
  },
  "templateId": "string",
  "startDate": "string",
  "deadline": "string",
  "completionDate": "string",
  "completedBy": {},
  "expirationNotificationDate": "string",
  "reminderNotificationDate": "string",
  "escalationNotificationDate": "string",
  "etlJobId": "string",
  "systemMessages": {
    "info": [
      {}
    ],
    "errors": [
      {}
    ]
  },
  "totalTargets": 0,
  "totalItems": 0,
  "totalItemsComplete": 0,
  "percentItemsComplete": 0
}

/iga/governance/certification/admin/certification/{certId}/cancel

POST

Cancel a certification campaign.

Cancels a certification campaign at the requested ID in the path. This only cancels existing in-progress action items. It will not revert any decisions that have been signed off and acted on.

Parameters

Name Description

certId string * required

ID of the certification campaign

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "name": "string",
    "description": "string",
    "certificationType": "identity",
    "ownerId": "string",
    "schedule": {
      "id": "string",
      "type": "simple",
      "startTime": "string",
      "endTime": "string",
      "repeatCount": 0,
      "repeatInterval": 0,
      "schedule": "string",
      "invokeContext": {},
      "enabled": true
    },
    "targetFilter": {
      "user": {
        "operator": "EQUALS",
        "operand": {
          "targetName": "accountStatus",
          "targetValue": "active"
        }
      },
      "application": {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "name",
          "targetValue": "SalesForce"
        }
      },
      "type": [
        "accountGrant"
      ],
      "memberOfOrg": [
        "52cf01b4-288e-4c21-aed6-f992be073988"
      ]
    },
    "stages": [
      {
        "name": "string",
        "certifierType": "user",
        "certifierId": "string"
      }
    ],
    "stageDuration": 0,
    "expirationAction": "certify",
    "expirationActionDelay": "string",
    "expirationReassignee": "string",
    "stagingEnabled": true,
    "defaultCertifierId": "string",
    "allowBulkCertify": true,
    "allowPartialSignoff": true,
    "remediationRule": "string",
    "remediationDelay": 0,
    "exceptionDuration": 0,
    "enableForward": true,
    "enableReassign": true,
    "reassignPermissions": {
      "certify": true,
      "comment": true,
      "exception": true,
      "forward": true,
      "reassign": true,
      "reset": true,
      "revoke": true,
      "signoff": true
    },
    "selfCertificationRule": "all",
    "assignmentNotification": "string",
    "reassignNotification": "string",
    "expirationNotification": "string",
    "expirationNotificationDay": "string",
    "reminderNotification": "string",
    "reminderFrequency": 0,
    "escalationNotification": "string",
    "escalationFrequency": 0,
    "escalationOwner": "string",
    "excludeConditionalAccess": true,
    "excludeRoleBasedAccess": true,
    "includeChildOrganizations": true,
    "parameters": [
      {
        "id": "string",
        "displayName": "string",
        "path": "string"
      }
    ],
    "templateEventType": "user",
    "status": "active",
    "scheduleId": "string",
    "ownerInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "defaultCertifierInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "escalationOwnerInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string"
    },
    "expirationReassigneeInfo": {
      "id": "string",
      "userName": "string",
      "mail": "string",
      "givenName": "string",
      "sn": "string",
      "name": "string"
    },
    "templateId": "string",
    "startDate": "string",
    "deadline": "string",
    "completionDate": "string",
    "completedBy": {},
    "expirationNotificationDate": "string",
    "reminderNotificationDate": "string",
    "escalationNotificationDate": "string",
    "etlJobId": "string",
    "systemMessages": {
      "info": [
        {}
      ],
      "errors": [
        {}
      ]
    }
  }
]

/iga/governance/certification/certification/items

GET

Query the review items (tasks) that are assigned to you.

Returns the certification tasks that are currently assigned to the logged in end user.

Parameters

Name Description

status * required

Status of the certification campaign. The available values are active, expired, and complete

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "results": [
    {
      "status": "in-progress",
      "campaignId": "19cf170e-5dd8-4159-a467-c4f018f1a0c8",
      "certifierId": "managed/user/f7089551-b8c6-402f-a4f7-5f8f0724ff30",
      "startDate": "2024-11-19T17:52:30+00:00",
      "deadline": "2024-12-03T17:52:30+00:00",
      "campaignName": "Quarterly Review",
      "totals": {
        "in-progress": 53,
        "total": 53
      },
      "progress": 0,
      "certifier": {
        "givenName": "Bernice",
        "id": "f7089551-b8c6-402f-a4f7-5f8f0724ff30",
        "mail": "Bernice@IGATestQA.onmicrosoft.com",
        "sn": "Hablot",
        "userName": "Bernice@IGATestQA.onmicrosoft.com",
        "type": "user",
        "key": "managed/user/f7089551-b8c6-402f-a4f7-5f8f0724ff30"
      }
    }
  ],
  "totalCount": 0
}

/iga/governance/certification/certification/{certId}/items

GET

Query line items of the certification campaign instance.

Returns the certification line items that belong to this campaign, filtered by parameters. Certifier sign-off is indicated by status. The certifier’s decision is indicated by decision.

Parameters

Name Description

certId string * required

ID of the certification campaign.

targetId string

ID of the target line item.

_pageSize string

Number of response result to return.

_pageNumber string

Number of response result to return.

_searchAfter string

An alternative to pageNumber, corresponds to the searchAfterKey value sent in previous page’s results.

status string

Status of the line item.The available values are in-progress, signed-off, pending, cancelled, and expired.

decision string

Decision taken on the line item. The available values are certify, revoke, exception, and abstain.

ownerId string

Owner ID of the line item.

user string

ID of the user the line items are certifying.

resource string

ID of the resource the line items are certifying.

application string

ID of the application the line items(s) are certifying.

actorId string

ID of any actor (certifier) in the line items actor list.

primaryReviwerId string

ID of the primary reviewer or certifier of the line items.

user.userName string

Username of the user the line items are certifying.

itemType string

Item type of the line item. The available values are Account Grant and Resource Grant.

account string

ID of the account the line items(s) are certifying.

groupBy string

Aggregates the results to allow the frontend to group line items.

appendUserPermissions boolean

Appends the logged in user permissions for each line item. Used by frontend.

taskStatus string

Task level alternative to status (which is item level). The available values are active, complete, closed, cancelled, and expired.

getCount boolean

If true, returns the line item count based on the query.

isAdmin boolean

If true and if the user has permission, returns the results as an admin.

Responses

Code Description

200

400

Invalid request

404

ID or value sent in parameters wasn’t found

500

Server error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "decision": {
        "certification": {
          "campaignId": "string",
          "targetId": "string",
          "status": "in-progress",
          "decision": "certify",
          "completionDate": "string",
          "completedBy": {},
          "decisionDate": "string",
          "decisionBy": {},
          "remediationDate": "string",
          "remediated": true,
          "remediationStatus": "pending",
          "confidenceScore": 0,
          "stageIndex": 0,
          "deadline": "string",
          "isExpired": true,
          "comments": [
            {
              "user": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "comment": "I need to find out more information before approving.  Will check back later.",
              "action": "comment",
              "timeStamp": "2023-09-11T12:00:00+00:00",
              "phase": "ManagerApproval"
            }
          ],
          "actors": [
            {
              "id": "string",
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true,
                "certify": true,
                "exception": true,
                "forward": true,
                "reset": true,
                "revoke": true,
                "signoff": true
              },
              "userName": "string",
              "mail": "string",
              "givenName": "string",
              "sn": "string",
              "name": "string"
            }
          ]
        }
      }
    }
  ],
  "resultCount": 0,
  "totalHits": 0,
  "searchAfterKey": [
    "string"
  ]
}

/iga/governance/certification/certification/{certId}/items/search

POST

Query line items of the certification campaign instance.

Returns the certification line items that belong to the specified campaign, filtered by parameters.

Parameters

Name Description

certId string * required

ID of the certification campaign

_fields string

The list of fields to return for each entry in the response result. Comma-separated for multiple values

_pageSize integer

Number of response result objects to return

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

appendUserPermissions boolean

Appends the logged in user permissions for each line item.

taskStatus string

Task level status search. The available values are active, complete, closed, cancelled, and expired.

Request body example

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "decision.certification.primaryReviewer.id",
          "targetValue": "managed/user/c1147059-b6ab-4cf6-937c-b93202c6cec8"
        }
      },
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "item.type",
           "targetValue": "accountGrant"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Invalid request

404

ID or value sent in parameters wasn’t found

500

Server error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "decision": {
        "certification": {
          "campaignId": "string",
          "targetId": "string",
          "status": "in-progress",
          "decision": "certify",
          "completionDate": "string",
          "completedBy": {},
          "decisionDate": "string",
          "decisionBy": {},
          "remediationDate": "string",
          "remediated": true,
          "remediationStatus": "pending",
          "confidenceScore": 0,
          "stageIndex": 0,
          "deadline": "string",
          "isExpired": true,
          "comments": [
            {
              "user": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "comment": "I need to find out more information before approving.  Will check back later.",
              "action": "comment",
              "timeStamp": "2023-09-11T12:00:00+00:00",
              "phase": "ManagerApproval"
            }
          ],
          "actors": [
            {
              "id": "string",
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true,
                "certify": true,
                "exception": true,
                "forward": true,
                "reset": true,
                "revoke": true,
                "signoff": true
              },
              "userName": "string",
              "mail": "string",
              "givenName": "string",
              "sn": "string",
              "name": "string"
            }
          ]
        }
      }
    }
  ],
  "resultCount": 0,
  "totalCount": 0,
  "searchAfterKey": [
    "string"
  ]
}

/iga/governance/certification/certification/{certId}/items/{action}

POST

Take action on line items.

Parameters

Name Description

certId string * required

ID of the certification campaign.

action string * required

The specific action to take. The available values are certify, revoke, exception, comment, forward, and signoff.

selectAllActorId string

When provided, the action targets all decision items the given actor is the primary reviewer for. The IDs array can be left empty.

Request body * required

Media type: application/json

{
  "ids": [
    "e9e4d260-1b55-4331-8468-5824344b8bc3",
    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
  ]
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "message": "string",
  "idsNotActedOn": [
    "string"
  ]
}

/iga/governance/certification/certification/{certId}/items/{lineItemId}/{action}

POST

Take action on a single line item.

Parameters

Name Description

certId string * required

ID of the certification campaign.

lineItemId string * required

ID of the line item.

action string * required

The specific action to take. The available values are certify, revoke, exception, comment, reassign, and forward.

Request body * required

Example: certify
Media type: application/json

{}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "message": "string",
  "idsNotActedOn": [
    "string"
  ]
}

Access request

In Identity Governance, end users can request access to resources. Resources are target applications, entitlements, or roles. You define which resources are requestable.

Learn more in access requests.

URI HTTP
method Description

/iga/governance/requests

POST

Create or validate a new access request for a list of users. When submitting a new request for access, the system validates the request’s contents. If no issues are found, IGA creates a request for each pairing of user and catalog items included in the request.

You can choose to only validate the request by using the validate action. This action displays any errors in the current request payload without creating any requests.

Parameters

Name Description

action string * required

Action to be performed for the requests endpoint. The available values are create and validate.

runPreventativeScan boolean

Check whether the requested access violates any policies.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body example

Media type: application/json

{
  "users": [
    "52cf01b4-288e-4c21-aed6-f992be073988"
  ],
  "catalogs": [
    {
      "type": "application",
      "id": "ea412dc4804ae80e625fdd8f7b7521d9ae3f7cae30f2401cf8f3be43d985176843404f1022c44537edeedc0bf11b5e5a028082cc05a7d90843b882c7c4b5d988",
      "data": {}
    }
  ],
  "startDate": "2023-09-11T12:00:00+00:00",
  "endDate": "2023-12-11T12:00:00+00:00",
  "expiryDate": "2023-09-05T12:00:00+00:00",
  "priority": "low",
  "justification": "I need this access to start working on a new project.",
  "accessModifier": "add",
  "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
  "requestIdPrefix": "REQ"
}

Responses

Code Description

200

Success

400

Request error

Click for an example response

Media type: application/json

{
  "result": [
    "f70b1565-8d42-4492-93dd-90173fa62635"
  ],
  "errors": [
    {
      "error": "DUPLICATE",
      "message": "Duplicate request already exists.",
      "user": "e7c38019-844f-4b70-93d1-9bdbfa00f1da",
      "requestId": "3cd52fdd-9725-411f-bcae-0f5f3254e24d",
      "catalogId": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1"
    }
  ]
}

/iga/governance/requests/{requestTypeId}

POST

Create request for the given request type.

Parameters

Name Description

requestTypeId string * required

ID of the request type.

Request body * required

Payload for creating the request. Properties must match the request type schema definition. Media type: application/json

{
  "id": "string",
  "requester": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "requestType": "applicationGrant",
  "request": {
    "common": {
      "startDate": "2023-09-11T12:00:00+00:00",
      "endDate": "2023-12-11T12:00:00+00:00",
      "justification": "I need this access to start working on a new project.",
      "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
      "isDraft": false,
      "requestIdPrefix": "REQ"
    }
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entitlementOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "roleOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "decision": {
    "status": "in-progress",
    "decision": "approved",
    "outcome": "provisioned",
    "startDate": "2023-09-10T12:00:00+00:00",
    "completionDate": "2023-09-10T12:00:00+00:00",
    "comments": [
      {
        "user": {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        },
        "comment": "I need to find out more information before approving.  Will check back later.",
        "action": "comment",
        "timeStamp": "2023-09-11T12:00:00+00:00",
        "phase": "ManagerApproval"
      }
    ],
    "actors": {
      "active": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ],
      "inactive": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ]
    },
    "phases": [
      {
        "phase": {
          "name": "ManagerApproval",
          "type": "request",
          "status": "in-progress",
          "decision": "approve",
          "startDate": "2023-09-10T12:00:00+00:00",
          "events": {
            "assignment": {
              "notification": "requestAssigned"
            },
            "reassign": {
              "notification": "requestReassigned"
            },
            "expiration": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestExpired",
              "action": "reassign",
              "actors": [
                {
                  "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                  "userName": "asmith",
                  "mail": "asmith01@forgerock.com",
                  "givenName": "Aaron",
                  "sn": "Smith",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                },
                {
                  "id": "string",
                  "name": "string",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                }
              ]
            },
            "escalation": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestEscalated",
              "actors": [
                {
                  "id": "875bbc8f-e868-451f-a690-453473205ca1"
                }
              ],
              "frequency": 3
            },
            "reminder": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestReminder",
              "frequency": 3
            }
          },
          "justification": "string",
          "workflowTaskId": "1025",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "2023-09-10T12:00:00+00:00"
        }
      }
    ]
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "id": "string",
  "requester": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "requestType": "applicationGrant",
  "request": {
    "common": {
      "startDate": "2023-09-11T12:00:00+00:00",
      "endDate": "2023-12-11T12:00:00+00:00",
      "justification": "I need this access to start working on a new project.",
      "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
      "isDraft": false,
      "requestIdPrefix": "REQ"
    }
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entitlementOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "roleOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "decision": {
    "status": "in-progress",
    "decision": "approved",
    "outcome": "provisioned",
    "startDate": "2023-09-10T12:00:00+00:00",
    "completionDate": "2023-09-10T12:00:00+00:00",
    "comments": [
      {
        "user": {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        },
        "comment": "I need to find out more information before approving.  Will check back later.",
        "action": "comment",
        "timeStamp": "2023-09-11T12:00:00+00:00",
        "phase": "ManagerApproval"
      }
    ],
    "actors": {
      "active": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ],
      "inactive": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ]
    },
    "phases": [
      {
        "phase": {
          "name": "ManagerApproval",
          "type": "request",
          "status": "in-progress",
          "decision": "approve",
          "startDate": "2023-09-10T12:00:00+00:00",
          "events": {
            "assignment": {
              "notification": "requestAssigned"
            },
            "reassign": {
              "notification": "requestReassigned"
            },
            "expiration": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestExpired",
              "action": "reassign",
              "actors": [
                {
                  "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                  "userName": "asmith",
                  "mail": "asmith01@forgerock.com",
                  "givenName": "Aaron",
                  "sn": "Smith",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                },
                {
                  "id": "string",
                  "name": "string",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                }
              ]
            },
            "escalation": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestEscalated",
              "actors": [
                {
                  "id": "875bbc8f-e868-451f-a690-453473205ca1"
                }
              ],
              "frequency": 3
            },
            "reminder": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestReminder",
              "frequency": 3
            }
          },
          "justification": "string",
          "workflowTaskId": "1025",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "2023-09-10T12:00:00+00:00"
        }
      }
    ]
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requests/{requestId}

GET

Retrieve the details of a single access request using a unique identifier, requestId.

Parameters

Name Description

requestId string * required

Unique identifier of the request.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

404

Request can’t be found

Click for an example response

Media type: application/json

{
  "id": "string",
  "requester": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "requestType": "applicationGrant",
  "request": {
    "common": {
      "startDate": "2023-09-11T12:00:00+00:00",
      "endDate": "2023-12-11T12:00:00+00:00",
      "justification": "I need this access to start working on a new project.",
      "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
      "isDraft": false,
      "requestIdPrefix": "REQ"
    }
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entitlementOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "roleOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "decision": {
    "status": "in-progress",
    "decision": "approved",
    "outcome": "provisioned",
    "startDate": "2023-09-10T12:00:00+00:00",
    "completionDate": "2023-09-10T12:00:00+00:00",
    "comments": [
      {
        "user": {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        },
        "comment": "I need to find out more information before approving.  Will check back later.",
        "action": "comment",
        "timeStamp": "2023-09-11T12:00:00+00:00",
        "phase": "ManagerApproval"
      }
    ],
    "actors": {
      "active": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ],
      "inactive": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ]
    },
    "phases": [
      {
        "phase": {
          "name": "ManagerApproval",
          "type": "request",
          "status": "in-progress",
          "decision": "approve",
          "startDate": "2023-09-10T12:00:00+00:00",
          "events": {
            "assignment": {
              "notification": "requestAssigned"
            },
            "reassign": {
              "notification": "requestReassigned"
            },
            "expiration": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestExpired",
              "action": "reassign",
              "actors": [
                {
                  "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                  "userName": "asmith",
                  "mail": "asmith01@forgerock.com",
                  "givenName": "Aaron",
                  "sn": "Smith",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                },
                {
                  "id": "string",
                  "name": "string",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                }
              ]
            },
            "escalation": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestEscalated",
              "actors": [
                {
                  "id": "875bbc8f-e868-451f-a690-453473205ca1"
                }
              ],
              "frequency": 3
            },
            "reminder": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestReminder",
              "frequency": 3
            }
          },
          "justification": "string",
          "workflowTaskId": "1025",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "2023-09-10T12:00:00+00:00"
        }
      }
    ]
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requests/{requestId}

PUT

Replace the content of a request. The only properties that can be changed are properties that are defined in the request schema and not in the nonModifiableProperties.

Parameters

Name Description

requestId string * required

Unique identifier of the request.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

The payload for replacing request content. Properties must match the request type schema definition of this request. Media type: application/json

{
  "id": "string",
  "requester": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "requestType": "applicationGrant",
  "request": {
    "common": {
      "startDate": "2023-09-11T12:00:00+00:00",
      "endDate": "2023-12-11T12:00:00+00:00",
      "justification": "I need this access to start working on a new project.",
      "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
      "isDraft": false,
      "requestIdPrefix": "REQ"
    }
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entitlementOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "roleOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "decision": {
    "status": "in-progress",
    "decision": "approved",
    "outcome": "provisioned",
    "startDate": "2023-09-10T12:00:00+00:00",
    "completionDate": "2023-09-10T12:00:00+00:00",
    "comments": [
      {
        "user": {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        },
        "comment": "I need to find out more information before approving.  Will check back later.",
        "action": "comment",
        "timeStamp": "2023-09-11T12:00:00+00:00",
        "phase": "ManagerApproval"
      }
    ],
    "actors": {
      "active": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ],
      "inactive": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ]
    },
    "phases": [
      {
        "phase": {
          "name": "ManagerApproval",
          "type": "request",
          "status": "in-progress",
          "decision": "approve",
          "startDate": "2023-09-10T12:00:00+00:00",
          "events": {
            "assignment": {
              "notification": "requestAssigned"
            },
            "reassign": {
              "notification": "requestReassigned"
            },
            "expiration": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestExpired",
              "action": "reassign",
              "actors": [
                {
                  "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                  "userName": "asmith",
                  "mail": "asmith01@forgerock.com",
                  "givenName": "Aaron",
                  "sn": "Smith",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                },
                {
                  "id": "string",
                  "name": "string",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                }
              ]
            },
            "escalation": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestEscalated",
              "actors": [
                {
                  "id": "875bbc8f-e868-451f-a690-453473205ca1"
                }
              ],
              "frequency": 3
            },
            "reminder": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestReminder",
              "frequency": 3
            }
          },
          "justification": "string",
          "workflowTaskId": "1025",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "2023-09-10T12:00:00+00:00"
        }
      }
    ]
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "id": "string",
  "requester": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "requestType": "applicationGrant",
  "request": {
    "common": {
      "startDate": "2023-09-11T12:00:00+00:00",
      "endDate": "2023-12-11T12:00:00+00:00",
      "justification": "I need this access to start working on a new project.",
      "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
      "isDraft": false,
      "requestIdPrefix": "REQ"
    }
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entitlementOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "roleOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "decision": {
    "status": "in-progress",
    "decision": "approved",
    "outcome": "provisioned",
    "startDate": "2023-09-10T12:00:00+00:00",
    "completionDate": "2023-09-10T12:00:00+00:00",
    "comments": [
      {
        "user": {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        },
        "comment": "I need to find out more information before approving.  Will check back later.",
        "action": "comment",
        "timeStamp": "2023-09-11T12:00:00+00:00",
        "phase": "ManagerApproval"
      }
    ],
    "actors": {
      "active": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ],
      "inactive": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ]
    },
    "phases": [
      {
        "phase": {
          "name": "ManagerApproval",
          "type": "request",
          "status": "in-progress",
          "decision": "approve",
          "startDate": "2023-09-10T12:00:00+00:00",
          "events": {
            "assignment": {
              "notification": "requestAssigned"
            },
            "reassign": {
              "notification": "requestReassigned"
            },
            "expiration": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestExpired",
              "action": "reassign",
              "actors": [
                {
                  "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                  "userName": "asmith",
                  "mail": "asmith01@forgerock.com",
                  "givenName": "Aaron",
                  "sn": "Smith",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                },
                {
                  "id": "string",
                  "name": "string",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                }
              ]
            },
            "escalation": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestEscalated",
              "actors": [
                {
                  "id": "875bbc8f-e868-451f-a690-453473205ca1"
                }
              ],
              "frequency": 3
            },
            "reminder": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestReminder",
              "frequency": 3
            }
          },
          "justification": "string",
          "workflowTaskId": "1025",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "2023-09-10T12:00:00+00:00"
        }
      }
    ]
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requests/{requestId}

PATCH

Update the contents of a request. The only properties that can be updated are properties that are defined in the request schema and not in the nonModifiableProperties.

Parameters

Name Description

requestId string * required

Unique identifier of the request.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Payload for updating the request. Media type: application/json

[
  {
    "operation": "add",
    "field": "/type",
    "value": "string"
  }
]

Responses

Code Description

200

Click for an example

Media type: application/json

{
  "id": "string",
  "requester": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "requestType": "applicationGrant",
  "request": {
    "common": {
      "startDate": "2023-09-11T12:00:00+00:00",
      "endDate": "2023-12-11T12:00:00+00:00",
      "justification": "I need this access to start working on a new project.",
      "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
      "isDraft": false,
      "requestIdPrefix": "REQ"
    }
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entitlementOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "roleOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "decision": {
    "status": "in-progress",
    "decision": "approved",
    "outcome": "provisioned",
    "startDate": "2023-09-10T12:00:00+00:00",
    "completionDate": "2023-09-10T12:00:00+00:00",
    "comments": [
      {
        "user": {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        },
        "comment": "I need to find out more information before approving.  Will check back later.",
        "action": "comment",
        "timeStamp": "2023-09-11T12:00:00+00:00",
        "phase": "ManagerApproval"
      }
    ],
    "actors": {
      "active": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ],
      "inactive": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        },
        {
          "id": "string",
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          },
          "phase": "ManagerApproval"
        }
      ]
    },
    "phases": [
      {
        "phase": {
          "name": "ManagerApproval",
          "type": "request",
          "status": "in-progress",
          "decision": "approve",
          "startDate": "2023-09-10T12:00:00+00:00",
          "events": {
            "assignment": {
              "notification": "requestAssigned"
            },
            "reassign": {
              "notification": "requestReassigned"
            },
            "expiration": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestExpired",
              "action": "reassign",
              "actors": [
                {
                  "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                  "userName": "asmith",
                  "mail": "asmith01@forgerock.com",
                  "givenName": "Aaron",
                  "sn": "Smith",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                },
                {
                  "id": "string",
                  "name": "string",
                  "permissions": {
                    "approve": true,
                    "comment": true,
                    "modify": true,
                    "reassign": true,
                    "reject": true
                  }
                }
              ]
            },
            "escalation": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestEscalated",
              "actors": [
                {
                  "id": "875bbc8f-e868-451f-a690-453473205ca1"
                }
              ],
              "frequency": 3
            },
            "reminder": {
              "date": "2023-09-04T12:00:00+00:00",
              "notification": "requestReminder",
              "frequency": 3
            }
          },
          "justification": "string",
          "workflowTaskId": "1025",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "2023-09-10T12:00:00+00:00"
        }
      }
    ]
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requests/{requestId}

POST

Perform various actions on a specific request, such as approve, reject, comment, cancel, update, or reassign. Each action could have different payloads depending on the information the caller needs to provide.

Parameters

Name Description

requestId string * required

Unique identifier of the request.

phaseName string

For approval task-specific actions. The name of the task that the action applies to.

_action string * required

Action to be performed on a single request. The available values are cancel, approve, reject, comment, reassign, update, and modify.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Example: modify
Media type: application/json

{
  "common": {
    "priority": "low",
    "justification": "Request justification",
    "roleId": "3030d401-90f2-4219-82ea-4f71b3ed4abc",
    "userId": "f5dcd246-92f6-4e32-a696-7ec3253cec16",
    "externalRequestId": "237",
    "isDraft": false
  }
}

Responses

Code Description

200

400

Invalid action

401

User is not authorized to use this endpoint.

404

Request can’t be found.

/iga/governance/user/{userId}/requests

GET

Get requests for which the authenticated user has permissions to view. For additional search capabilities, use the POST /governance/user/{userId}/requests?_action=search API.

Parameters

Name Description

userId * required

Unique identifier of the user.

_fields string

The list of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "requester": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "requestType": "applicationGrant",
      "request": {
        "common": {
          "startDate": "2023-09-11T12:00:00+00:00",
          "endDate": "2023-12-11T12:00:00+00:00",
          "justification": "I need this access to start working on a new project.",
          "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
          "isDraft": false,
          "requestIdPrefix": "REQ"
        }
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "entitlementOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "roleOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "decision": {
        "status": "in-progress",
        "decision": "approved",
        "outcome": "provisioned",
        "startDate": "2023-09-10T12:00:00+00:00",
        "completionDate": "2023-09-10T12:00:00+00:00",
        "comments": [
          {
            "user": {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith"
            },
            "comment": "I need to find out more information before approving.  Will check back later.",
            "action": "comment",
            "timeStamp": "2023-09-11T12:00:00+00:00",
            "phase": "ManagerApproval"
          }
        ],
        "actors": {
          "active": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ],
          "inactive": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ]
        },
        "phases": [
          {
            "phase": {
              "name": "ManagerApproval",
              "type": "request",
              "status": "in-progress",
              "decision": "approve",
              "startDate": "2023-09-10T12:00:00+00:00",
              "events": {
                "assignment": {
                  "notification": "requestAssigned"
                },
                "reassign": {
                  "notification": "requestReassigned"
                },
                "expiration": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestExpired",
                  "action": "reassign",
                  "actors": [
                    {
                      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                      "userName": "asmith",
                      "mail": "asmith01@forgerock.com",
                      "givenName": "Aaron",
                      "sn": "Smith",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    },
                    {
                      "id": "string",
                      "name": "string",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    }
                  ]
                },
                "escalation": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestEscalated",
                  "actors": [
                    {
                      "id": "875bbc8f-e868-451f-a690-453473205ca1"
                    }
                  ],
                  "frequency": 3
                },
                "reminder": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestReminder",
                  "frequency": 3
                }
              },
              "justification": "string",
              "workflowTaskId": "1025",
              "completedBy": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "completionDate": "2023-09-10T12:00:00+00:00"
            }
          }
        ]
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

/iga/governance/user/{userId}/requests

POST

Get requests for which the authenticated user has permissions to view. The targetFilter property in the API payload can be used to filter the requests based on the desired criteria.

Parameters

Name Description

_action * required

Action to be performed on user requests endpoint. The available value is search.

_fields string

The list of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

userId string * required

Unique identifier of the user.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "requester": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "requestType": "applicationGrant",
      "request": {
        "common": {
          "startDate": "2023-09-11T12:00:00+00:00",
          "endDate": "2023-12-11T12:00:00+00:00",
          "justification": "I need this access to start working on a new project.",
          "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
          "isDraft": false,
          "requestIdPrefix": "REQ"
        }
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "entitlementOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "roleOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "decision": {
        "status": "in-progress",
        "decision": "approved",
        "outcome": "provisioned",
        "startDate": "2023-09-10T12:00:00+00:00",
        "completionDate": "2023-09-10T12:00:00+00:00",
        "comments": [
          {
            "user": {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith"
            },
            "comment": "I need to find out more information before approving.  Will check back later.",
            "action": "comment",
            "timeStamp": "2023-09-11T12:00:00+00:00",
            "phase": "ManagerApproval"
          }
        ],
        "actors": {
          "active": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ],
          "inactive": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ]
        },
        "phases": [
          {
            "phase": {
              "name": "ManagerApproval",
              "type": "request",
              "status": "in-progress",
              "decision": "approve",
              "startDate": "2023-09-10T12:00:00+00:00",
              "events": {
                "assignment": {
                  "notification": "requestAssigned"
                },
                "reassign": {
                  "notification": "requestReassigned"
                },
                "expiration": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestExpired",
                  "action": "reassign",
                  "actors": [
                    {
                      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                      "userName": "asmith",
                      "mail": "asmith01@forgerock.com",
                      "givenName": "Aaron",
                      "sn": "Smith",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    },
                    {
                      "id": "string",
                      "name": "string",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    }
                  ]
                },
                "escalation": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestEscalated",
                  "actors": [
                    {
                      "id": "875bbc8f-e868-451f-a690-453473205ca1"
                    }
                  ],
                  "frequency": 3
                },
                "reminder": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestReminder",
                  "frequency": 3
                }
              },
              "justification": "string",
              "workflowTaskId": "1025",
              "completedBy": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "completionDate": "2023-09-10T12:00:00+00:00"
            }
          }
        ]
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

/iga/governance/user/{userId}/approvals

POST

Get requests for which the authenticated user is assigned, either directly, through a role, or through a delegate. The targetFilter property in the API payload can be used to filter the requests based on the desired criteria.

Parameters

Name Description

_action * required

Action to be performed on user requests endpoint. The available value is search.

_fields string

The list of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

actorStatus string

Status of the approver to search on, for example, "active", "inactive". Active shows tasks that are currently assigned to the user, while inactive shows tasks that were assigned and have been completed.

userId string * required

Unique identifier of the user.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "requester": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "requestType": "applicationGrant",
      "request": {
        "common": {
          "startDate": "2023-09-11T12:00:00+00:00",
          "endDate": "2023-12-11T12:00:00+00:00",
          "justification": "I need this access to start working on a new project.",
          "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
          "isDraft": false,
          "requestIdPrefix": "REQ"
        }
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "entitlementOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "roleOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "decision": {
        "status": "in-progress",
        "decision": "approved",
        "outcome": "provisioned",
        "startDate": "2023-09-10T12:00:00+00:00",
        "completionDate": "2023-09-10T12:00:00+00:00",
        "comments": [
          {
            "user": {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith"
            },
            "comment": "I need to find out more information before approving.  Will check back later.",
            "action": "comment",
            "timeStamp": "2023-09-11T12:00:00+00:00",
            "phase": "ManagerApproval"
          }
        ],
        "actors": {
          "active": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ],
          "inactive": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ]
        },
        "phases": [
          {
            "phase": {
              "name": "ManagerApproval",
              "type": "request",
              "status": "in-progress",
              "decision": "approve",
              "startDate": "2023-09-10T12:00:00+00:00",
              "events": {
                "assignment": {
                  "notification": "requestAssigned"
                },
                "reassign": {
                  "notification": "requestReassigned"
                },
                "expiration": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestExpired",
                  "action": "reassign",
                  "actors": [
                    {
                      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                      "userName": "asmith",
                      "mail": "asmith01@forgerock.com",
                      "givenName": "Aaron",
                      "sn": "Smith",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    },
                    {
                      "id": "string",
                      "name": "string",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    }
                  ]
                },
                "escalation": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestEscalated",
                  "actors": [
                    {
                      "id": "875bbc8f-e868-451f-a690-453473205ca1"
                    }
                  ],
                  "frequency": 3
                },
                "reminder": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestReminder",
                  "frequency": 3
                }
              },
              "justification": "string",
              "workflowTaskId": "1025",
              "completedBy": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "completionDate": "2023-09-10T12:00:00+00:00"
            }
          }
        ]
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      },
      "phases": [
        {
          "name": "string",
          "permissions": {
            "approve": true,
            "comment": true,
            "modify": true,
            "reassign": true,
            "reject": true
          }
        }
      ]
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

Access request form

Identity Governance enables administrators to create custom forms presented to users during request workflows.

URI HTTP
method Description

/iga/governance/requestForms

GET

Search request forms.

Parameters

Name Description

_queryFilter string

Search query filter.

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_pageSize integer

Number of response result objects to return.

_sortKeys string

Property on which to sort the results.

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requestForms

POST

Create a request form.

Parameters

No parameters

Request body * required

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requestForms/{id}

GET

Get a request form by ID.

Parameters

Name Description

id string * required

ID of the request form.

Responses

Code Description

200

404

Request form not found

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requestForms/{id}

PUT

Replace an existing request form by ID.

Parameters

Name Description

id string * required

ID of the request form.

Request body * required

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requestForms/{id}

PATCH

Update an existing request form by ID.

Parameters

Name Description

id string * required

ID of the request form.

Request body * required

Media type: application/json

[
  {
    "operation": "add",
    "field": "/type",
    "value": "string"
  }
]

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "type": "request",
  "categories": {
    "applicationType": "active.directory",
    "objectType": "__ACCOUNT__",
    "operation": "create"
  },
  "form": {},
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/requestFormAssignments

GET

Search the request form assignments.

Parameters

Name Description

_queryFilter string

Search query filter.

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_pageSize integer

Number of response result objects to return.

_sortKeys string

Property on which to sort the results.

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "objectId": "string",
  "formId": "string"
}

/iga/governance/requestFormAssignments

POST

Assign and unassign a request form.

Parameters

Name Description

_action string * required

Action to be taken. The available values are assign and unassign.

Request body * required

Media type: application/json

{
  "objectId": "string",
  "formId": "string"
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "objectId": "string",
  "formId": "string"
}

Access request type

URI HTTP
method Description

/iga/governance/requestTypes

GET

Get a list of supported request types.

Parameters

Name Description

_queryFilter string

Search query filter.

_pageSize integer

Number of response result objects to return.

_pageNumber string

Page number of results to show.

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_sortBy string

The property to be sorted by.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

Responses

Code Description

200

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "schemas": {
      "custom": [
        {
          "_meta": {
            "type": "string",
            "displayName": "string",
            "properties": {}
          },
          "properties": {}
        }
      ]
    }
  }
]

/iga/governance/requestTypes

POST

Create a new custom request type.

Parameters

No parameters

Request body

Media type: application/json

{
  "id": "string",
  "schemas": {
    "custom": [
      {
        "_meta": {
          "type": "string",
          "displayName": "string",
          "properties": {}
        },
        "properties": {}
      }
    ]
  }
}

Responses

Code Description

200

400

Missing required properties

Click for an example response

Media type: application/json

{
  "id": "string",
  "schemas": {
    "custom": [
      {
        "_meta": {
          "type": "string",
          "displayName": "string",
          "properties": {}
        },
        "properties": {}
      }
    ]
  }
}

/iga/governance/requestTypes/{requestTypeId}

GET

Get a request type by ID.

Parameters

Name Description

requestTypeId string * required

ID of the request type.

Responses

Code Description

200

400

Request type ID not found

Click for an example response

Media type: application/json

{
  "id": "string",
  "schemas": {
    "custom": [
      {
        "_meta": {
          "type": "string",
          "displayName": "string",
          "properties": {}
        },
        "properties": {}
      }
    ]
  }
}

/iga/governance/requestTypes/{requestTypeId}

PUT

Replace an existing request type.

Parameters

Name Description

requestTypeId string * required

ID of the request type.

Request body

Media type: application/json

{
  "id": "string",
  "schemas": {
    "custom": [
      {
        "_meta": {
          "type": "string",
          "displayName": "string",
          "properties": {}
        },
        "properties": {}
      }
    ]
  }
}

Responses

Code Description

200

400

Missing required properties

Click for an example response

Media type: application/json

{
  "id": "string",
  "schemas": {
    "custom": [
      {
        "_meta": {
          "type": "string",
          "displayName": "string",
          "properties": {}
        },
        "properties": {}
      }
    ]
  }
}

/iga/governance/requestTypes/{requestTypeId}

PATCH

Update an existing request type.

Parameters

Name Description

requestTypeId string * required

ID of the request type.

Request body

Media type: application/json

[
  {
    "operation": "add",
    "field": "/type",
    "value": "string"
  }
]

Responses

Code Description

200

400

Missing required properties

Click for an example response

Media type: application/json

{
  "id": "string",
  "schemas": {
    "custom": [
      {
        "_meta": {
          "type": "string",
          "displayName": "string",
          "properties": {}
        },
        "properties": {}
      }
    ]
  }
}

/iga/governance/requestTypes/{requestTypeId}

DELETE

Delete a request type.

Parameters

Name Description

requestTypeId string * required

ID of the request type.

Responses

Code Description

200

404

Request type ID not found

Account

Accounts are user profiles in applications. For example, when you provision an end user to an application, an account is created for them.

URI HTTP
method Description

/iga/governance/account

GET

Retrieve all account objects across all applications that have been onboarded as part of any application.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

400

Request error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609",
      "keys": {
        "type": "accountGrant",
        "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259",
        "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3",
        "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363"
      },
      "account": {
        "state": "PA",
        "status": "3",
        "isManager": "no",
        "depName": "Human Resources",
        "__UID__": "2014",
        "phone": "555-1212",
        "city": "Allentown",
        "jobCode": "2002",
        "address": "1234 Spruce St",
        "__NAME__": "2014",
        "uid": "2014",
        "lastName": "Hart",
        "firstName": "Jeremy",
        "country": "US",
        "depId": "200",
        "email": "jhart@forgerock.com",
        "empType": "1",
        "postalCode": "12345",
        "_id": "2014"
      },
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "descriptor": {
        "idx": {
          "/account": {
            "displayName": "Example Account"
          }
        }
      },
      "glossary": {
        "idx": {
          "/account": {
            "accountType": "normal",
            "accountStatus": "active"
          },
          "/application": {
            "requestable": true,
            "classification": "internal"
          }
        }
      },
      "item": {
        "decision": {
          "campaignId": "string",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "string",
          "decision": "certify",
          "decisionBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "decisionDate": "string"
        }
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 1,
  "resultCount": 1
}

/iga/governance/account

POST

Retrieve all account objects across all applications that have been onboarded as part of any application. Additional filter criteria can be provided to allow searching by application, user, or glossary data.

Parameters

Name Description

_action * required

Action to be performed on user requests endpoint. The available value is search.

_fields string

The list of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Request error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609",
      "keys": {
        "type": "accountGrant",
        "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259",
        "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3",
        "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363"
      },
      "account": {
        "state": "PA",
        "status": "3",
        "isManager": "no",
        "depName": "Human Resources",
        "__UID__": "2014",
        "phone": "555-1212",
        "city": "Allentown",
        "jobCode": "2002",
        "address": "1234 Spruce St",
        "__NAME__": "2014",
        "uid": "2014",
        "lastName": "Hart",
        "firstName": "Jeremy",
        "country": "US",
        "depId": "200",
        "email": "jhart@forgerock.com",
        "empType": "1",
        "postalCode": "12345",
        "_id": "2014"
      },
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "descriptor": {
        "idx": {
          "/account": {
            "displayName": "Example Account"
          }
        }
      },
      "glossary": {
        "idx": {
          "/account": {
            "accountType": "normal",
            "accountStatus": "active"
          },
          "/application": {
            "requestable": true,
            "classification": "internal"
          }
        }
      },
      "item": {
        "decision": {
          "campaignId": "string",
          "completedBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "completionDate": "string",
          "decision": "certify",
          "decisionBy": {
            "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
            "userName": "asmith",
            "mail": "asmith01@forgerock.com",
            "givenName": "Aaron",
            "sn": "Smith"
          },
          "decisionDate": "string"
        }
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 1,
  "resultCount": 1
}

/iga/governance/account/{accountId}

GET

Retrieve by details of a single account object using its unique identifier.

Parameters

Name Description

accountId string * required

Unique identifier of the account to get.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

404

Request can’t be found.

Click for an example response

Media type: application/json

{
  "id": "system/TargetADApp/User/8df77c8b-dac0-4cc5-9f38-b4a467983609",
  "keys": {
    "type": "accountGrant",
    "userId": "041ae68e-c54d-43ae-957d-5bda01d6f259",
    "applicationId": "a87e3d1f-1f9e-4597-bb0a-2ed56d2484a3",
    "accountId": "system/TargetADApp/User/6841028f-2cf7-4439-afa2-51cc3fcb0363"
  },
  "account": {
    "state": "PA",
    "status": "3",
    "isManager": "no",
    "depName": "Human Resources",
    "__UID__": "2014",
    "phone": "555-1212",
    "city": "Allentown",
    "jobCode": "2002",
    "address": "1234 Spruce St",
    "__NAME__": "2014",
    "uid": "2014",
    "lastName": "Hart",
    "firstName": "Jeremy",
    "country": "US",
    "depId": "200",
    "email": "jhart@forgerock.com",
    "empType": "1",
    "postalCode": "12345",
    "_id": "2014"
  },
  "user": {
    "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
    "userName": "asmith",
    "mail": "asmith01@forgerock.com",
    "givenName": "Aaron",
    "sn": "Smith"
  },
  "application": {
    "authoritative": false,
    "connectorId": "AzureAD",
    "description": "AzureAD application",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
    "mappingNames": [
      "systemAzureadUser_managedAlpha_user",
      "systemAzureadDirectoryrole_managedAlpha_assignment",
      "systemAzuread__group___managedAlpha_assignment",
      "managedAlpha_user_systemAzureadUser"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-08-31T21:23:35.809Z"
    },
    "name": "AzureAD",
    "templateName": "azure.ad",
    "templateVersion": "2.0",
    "objectTypes": [
      {
        "name": "__ACCOUNT__"
      },
      {
        "name": "__GROUP__",
        "accountAttribute": "memberOf"
      }
    ]
  },
  "applicationOwner": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "descriptor": {
    "idx": {
      "/account": {
        "displayName": "Example Account"
      }
    }
  },
  "glossary": {
    "idx": {
      "/account": {
        "accountType": "normal",
        "accountStatus": "active"
      },
      "/application": {
        "requestable": true,
        "classification": "internal"
      }
    }
  },
  "item": {
    "decision": {
      "campaignId": "string",
      "completedBy": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "completionDate": "string",
      "decision": "certify",
      "decisionBy": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "decisionDate": "string"
    }
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  }
}

/iga/governance/account/{accountId}/glossary

GET

Retrieve the glossary-specific details of a single account object using its unique identifier.

Parameters

Name Description

accountId string * required

Unique identifier of the account to get.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

404

Request cannot be found.

Click for an example response

Media type: application/json

{
  "accountType": "normal",
  "accountStatus": "active"
}

/iga/governance/account/{accountId}/glossary

POST

Create glossary entry for a single account object using its unique identifier.

Parameters

Name Description

accountId string * required

Unique identifier of the account to get.

_action string * required

Action to be performed on user requests endpoint. The available value is create.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Success.

400

Request error.

Click for an example response

Media type: application/json

{
  "accountType": "normal",
  "accountStatus": "active"
}

/iga/governance/account/{accountId}/glossary

PUT

Create or update a glossary entry for a single account object using its unique identifier.

Parameters

Name Description

accountId string * required

Unique identifier of the account to get.

_action string * required

Action to be performed on user requests endpoint. The available value is create.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Success.

400

Request error.

Click for an example response

Media type: application/json

{
  "accountType": "normal",
  "accountStatus": "active"
}

Audit

Endpoints associated with IDM’s audit functionality.

To use the iga/governance/workflow and iga/governance/audit endpoints, your authorization token must have the following scope:

fr:idc:analytics.*

This is a temporary requirement and will be removed in a future release.

URI HTTP
method Description

/iga/governance/audit

GET

Get audit reports.

Parameters

Name Description

objectId string

ID of the object to retrieve the report.

startDate

First date to include in the report.

endDate string

Last date to include in the report.

actor string

Actor associated with the audit events.

objectType string

Type of object involved in the audit events.

eventType string

Type of event to filter by.

action string

Type of action to filter by.

pageSize integer

Number of results per page (default is 20).

order string

Order of results. The available values are asc and desc (default is desc).

page integer

Page number for pagination.

searchAfter string

A JSON-encoded array for deep pagination. Example: [1742976841833].

Responses

Code Description

200

400

Bad request

500

Internal service error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "actor": "string",
      "eventType": "string",
      "objectId": "string",
      "objectType": "string",
      "action": "string",
      "timestamp": "2025-04-19T10:54:08.584Z",
      "changes": [
        {
          "after_value": "string",
          "field_name": "string"
        }
      ],
      "metadata": {
        "modifiedDate": "2025-04-19T10:54:08.585Z",
        "createdDate": "2025-04-19T10:54:08.585Z"
      }
    }
  ],
  "resultCount": 0,
  "totalCount": 0,
  "pagination": {
    "page": 0,
    "pageSize": 0,
    "totalPages": 0,
    "searchAfter": [
      0
    ]
  }
}

/iga/governance/user/{userId}/audit

GET

Get the audit reports for a given user.

Parameters

Name Description

userId string * string

ID of the user to retrieve the report.

queryId

Required parameter for pagination. Use the value from previous response.

dataSetId string

Required parameter for pagination. Use the value from previous response.

pagedResultCookie string

Used for pagination of results.

Responses

Code Description

200

400

Error with provided payload

404

Job not found

500

Server error

Click for an example response

endDate string (query) Last date to include in the report

{
  "result": [
    {
      "actor": "string",
      "eventType": "string",
      "objectId": "string",
      "action": "string",
      "timestamp": "string",
      "changes": [
        {
          "after_value": "New City",
          "before_value": "Old City",
          "field_name": "city"
        }
      ]
    }
  ],
  "resultCount": 0,
  "totalCount": 0,
  "queryId": "string",
  "dataSetId": "string",
  "pageToken": "string"
}

Catalog

The Catalog endpoint provides a list of requestable access items. The current supported types of access that are requestable are application, entitlement, and role.

URI HTTP
method Description

/iga/governance/catalog

GET

Get a list of items from the Identity Governance access catalog. Each entry represents a single type of requestable access that can be added to a request. The current supported types of access that are requestable are application, entitlement, and role.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

_ignoreRequestable string

For admin use: allow admin to view catalog items not marked as requestable when set to true.

userId string

For admin use: when provided, returns the scoped catalog access that matches the given user ID.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Click for an example response

Example: application
Media type: application/json

{
  "id": "26f2bd6b-3d23-4fbb-92f7-9aecd0183852",
  "item": {
    "type": "accountGrant"
  },
  "application": {
    "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-50136",
    "authoritative": true,
    "connectorId": "AzureADAuth1",
    "description": "AD Auth App1",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg",
    "id": "26f2bd6b-3d23-4fbb-92f7-9aecd0183852",
    "mappingNames": [
      "systemAzureadauth1User_managedAlpha_user"
    ],
    "metadata": {
      "entityType": "/openidm/managed/application",
      "created": "2023-06-09T15:01:49.259Z"
    },
    "name": "AzureADAuth1",
    "templateName": "azure.ad",
    "templateVersion": "2.0"
  },
  "applicationOwner": [
    {
      "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944",
      "accountStatus": "active",
      "cn": "iga admin",
      "fr": {
        "realm": "alpha"
      },
      "givenName": "iga",
      "id": "b409de90-dc24-42ee-b315-7e133c7cfaca",
      "mail": "iga-admin@fr.net",
      "metadata": {
        "entityType": "/openidm/managed/user",
        "created": "2023-06-08T23:02:15.385Z"
      },
      "sn": "admin",
      "userName": "iga-admin"
    }
  ]
}

/iga/governance/catalog

POST

Get a list of items from the Identity Governance access catalog using additional filter criteria. Each entry represents a single type of requestable access that can be added to a request. The current supported types of access that are requestable are application, entitlement, and role.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

_ignoreRequestable string

For admin use: allow admin to view catalog items not marked as requestable when set to true.

userId string

For admin use: when provided, returns the scoped catalog access that matches the given user ID.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
      "item": {
        "type": "entitlementGrant"
      },
      "descriptor": {
        "idx": {
          "/entitlement": {
            "displayName": "Directory Readers"
          }
        }
      },
      "glossary": {
        "idx": {
          "/entitlement": {
            "requestable": true
          }
        }
      },
      "entitlement": {
        "_id": "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
        "description": "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
        "displayName": "Directory Readers"
      },
      "assignment": {
        "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-72216",
        "attributes": [
          {
            "name": "__roles__",
            "value": [
              "08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4"
            ]
          }
        ],
        "description": "Can read basic directory information. Commonly used to grant directory read access to applications and guests.",
        "fr": {
          "realm": "alpha"
        },
        "id": "system_TargetADApp2_directoryRole_08ec32b7-b9c5-4d71-bd72-ea7b8584c5a4",
        "mapping": "managedAlpha_user_systemTargetadapp2User",
        "metadata": {
          "entityType": "/openidm/managed/assignment",
          "created": "2023-06-09T22:09:42.877Z"
        },
        "name": "Directory Readers",
        "type": "__ENTITLEMENT__"
      },
      "application": {
        "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-67718",
        "authoritative": false,
        "connectorId": "TargetADApp2",
        "description": "Target AD App2",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://openam-glossary-fix-0608.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a4e54fcb-9088-4d42-bb4a-138d69b2486e",
        "mappingNames": [
          "systemTargetadapp2User_managedAlpha_user",
          "systemTargetadapp2Directoryrole_managedAlpha_assignment",
          "systemTargetadapp2__group___managedAlpha_assignment",
          "managedAlpha_user_systemTargetadapp2User"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-06-09T20:43:57.74Z"
        },
        "name": "TargetADApp2",
        "ssoIdentities": {
          "oidcId": "TargetADApp2"
        },
        "templateName": "azure.ad",
        "templateVersion": "2.0"
      },
      "applicationOwner": [
        {
          "_rev": "23b2b11e-3ee6-499d-9e66-88ea2a867f98-1944",
          "accountStatus": "active",
          "cn": "iga admin",
          "fr": {
            "realm": "alpha"
          },
          "givenName": "iga",
          "id": "b409de90-dc24-42ee-b315-7e133c7cfaca",
          "mail": "iga-admin@fr.net",
          "metadata": {
            "entityType": "/openidm/managed/user",
            "created": "2023-06-08T23:02:15.385Z"
          },
          "sn": "admin",
          "userName": "iga-admin"
        }
      ],
      "metadata": {
        "firstCreated": "2024-01-11T12:00:00+00:00",
        "created": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 1,
  "resultCount": 1
}

/iga/governance/search/schema

GET

Retrieve all currently configured properties eligible to be used for search or sort when searching against the catalog API. Each property includes some additional metadata about the property, such as whether it is multivalued or not and its datatype.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

201

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

{
  "application": [
    {
      "key": "application.description",
      "name": "description",
      "displayName": "Description",
      "description": "Application Description",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "application.name",
      "name": "name",
      "displayName": "Name",
      "description": "Application name",
      "type": "string",
      "isMultiValue": false
    }
  ],
  "entitlement": [
    {
      "key": "glossary.idx./entitlement.description",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": null,
      "searchable": true,
      "isInternal": true,
      "displayName": "Description",
      "name": "description",
      "description": "Description of entitlement",
      "objectType": "/openidm/managed/assignment",
      "type": "string"
    },
    {
      "key": "entitlement.displayName",
      "name": "displayName",
      "displayName": "Display Name",
      "description": "",
      "type": "text",
      "isMultiValue": false
    },
    {
      "key": "glossary.idx./entitlement.entitlementOwner",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": "/openidm/managed/user",
      "searchable": true,
      "isInternal": true,
      "displayName": "Entitlement Owner",
      "name": "entitlementOwner",
      "description": "Entitlement Owner of Object",
      "objectType": "/openidm/managed/assignment",
      "type": "managedObject"
    },
    {
      "key": "glossary.idx./entitlement.requestable",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": null,
      "searchable": true,
      "isInternal": true,
      "displayName": "Requestable",
      "name": "requestable",
      "description": "Can the entitlement be requested",
      "objectType": "/openidm/managed/assignment",
      "type": "boolean"
    }
  ],
  "role": [
    {
      "key": "role.applications._ref",
      "name": "applications",
      "displayName": "Applications",
      "description": "Role Applications",
      "type": "managedObject",
      "isMultiValue": true,
      "managedObjectType": "/openidm/managed/alpha_application"
    },
    {
      "key": "role.description",
      "name": "description",
      "displayName": "Description",
      "description": "The role description, used for display purposes.",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "role.id",
      "name": "_id",
      "displayName": "Name",
      "description": "Role ID",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "role.name",
      "name": "name",
      "displayName": "Name",
      "description": "The role name, used for display purposes.",
      "type": "string",
      "isMultiValue": false
    },
    {
      "key": "glossary.idx./role.requestable",
      "allowedValues": [],
      "isIndexed": true,
      "isMultiValue": false,
      "managedObjectType": null,
      "searchable": true,
      "isInternal": true,
      "displayName": "Requestable",
      "name": "requestable",
      "description": "Can the role be requested",
      "objectType": "/openidm/managed/role",
      "type": "boolean"
    },
    {
      "key": "role.members._ref",
      "name": "members",
      "displayName": "Role Members",
      "description": "Role Members",
      "type": "managedObject",
      "isMultiValue": true,
      "managedObjectType": "/openidm/managed/alpha_user"
    }
  ]
}

/iga/governance/search/schema/{objectType}

GET

Retrieve all currently configured properties eligible to be used for search or sort for a single object when searching against the catalog API. For example, you can use the endpoint to search for all specific entitlement properties. Each property includes some additional metadata about the property, such as whether it is multivalued or not and its datatype.

Parameters

Name Description

objectType string * required

Type of object involved in the audit events. The available values are application, entitlement, and role.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "key": "application.description",
    "name": "description",
    "displayName": "Description",
    "description": "Application Description",
    "type": "string",
    "isMultiValue": false
  },
  {
    "key": "application.name",
    "name": "name",
    "displayName": "Name",
    "description": "Application name",
    "type": "string",
    "isMultiValue": false
  }
]

Config

Identity Governance has overarching configurations, such as requiring a justification when rejecting an access request.

URI HTTP
method Description

/commons/config

GET

Reads and returns all Identity Governance configuration properties across all categories.

Only access request-related properties are available. These properties are used to determine the behavior behind functionality. For example, access request features contain configuration on whether justification is required to reject a request or whether a user can approve their own access.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

400

IGA configuration settings can’t be read.

Click for an example response

Media type: application/json

{
  "iga_access_request": {
    "requireRequestJustification": true,
    "requireRejectJustification": true,
    "requireApproveJustification": true,
    "preventRequestWithViolation": true,
    "requireRequestJustificationWithViolation": true,
    "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
    "allowSelfApproval": true
  },
  "iga_global": {
    "enableScoping": false
  },
  "iga_autoid_integration": {
    "enableAutoId": true,
    "highScorePercentThreshold": 0,
    "mediumScorePercentThreshold": 0,
    "lowScorePercentThreshold": 0,
    "training_features_filter": [
      "user.managerId"
    ]
  },
  "iga_ui_config": {}
}

/commons/config

PUT

Update all Identity Governance configuration properties across all categories. Only access request-related properties are available.

You must include all current configurations when saving changes, Identity Governance replaces any omitted keys with default values.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Request body

Media type: application/json

{
  "iga_access_request": {
    "requireRequestJustification": true,
    "requireRejectJustification": true,
    "requireApproveJustification": true,
    "preventRequestWithViolation": true,
    "requireRequestJustificationWithViolation": true,
    "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
    "allowSelfApproval": true
  },
  "iga_global": {
    "enableScoping": false
  },
  "iga_autoid_integration": {
    "enableAutoId": true,
    "highScorePercentThreshold": 0,
    "mediumScorePercentThreshold": 0,
    "lowScorePercentThreshold": 0,
    "training_features_filter": [
      "user.managerId"
    ]
  },
  "iga_ui_config": {}
}

Responses

Code Description

200

400

Invalid settings or error saving.

401

User is not authorized to use this endpoint.

Click for an example response

{
  "iga_access_request": {
    "requireRequestJustification": true,
    "requireRejectJustification": true,
    "requireApproveJustification": true,
    "preventRequestWithViolation": true,
    "requireRequestJustificationWithViolation": true,
    "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
    "allowSelfApproval": true
  },
  "iga_global": {
    "enableScoping": false
  },
  "iga_autoid_integration": {
    "enableAutoId": true,
    "highScorePercentThreshold": 0,
    "mediumScorePercentThreshold": 0,
    "lowScorePercentThreshold": 0,
    "training_features_filter": [
      "user.managerId"
    ]
  },
  "iga_ui_config": {}
}

/commons/config/{key}

GET

Get Identity Governance configuration settings for a given category (for example, iga_access_request).

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

key string * required

Responses

Code Description

200

400

IGA configuration settings can’t be read

Click for an example response

Media type: application/json

{
  "requireRequestJustification": true,
  "requireRejectJustification": true,
  "requireApproveJustification": true,
  "preventRequestWithViolation": true,
  "requireRequestJustificationWithViolation": true,
  "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
  "allowSelfApproval": true
}

/commons/config/{key}

PUT

Update Identity Governance configuration settings for a given category (for example, iga_access_request).

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

key string * required

Request body

Example: iga_access_request
Media type: application/json

{
  "requireRequestJustification": true,
  "requireRejectJustification": true,
  "requireApproveJustification": true,
  "preventRequestWithViolation": true,
  "requireRequestJustificationWithViolation": true,
  "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
  "allowSelfApproval": true
}

Responses

Code Description

200

400

Invalid settings or error saving.

401

User is not authorized to use this endpoint

Click for an example response

Media type: application/json

{
  "requireRequestJustification": true,
  "requireRejectJustification": true,
  "requireApproveJustification": true,
  "preventRequestWithViolation": true,
  "requireRequestJustificationWithViolation": true,
  "defaultApprover": "managed/role/0e3de08d-fb8f-4f7f-91a8-4e65576fcac4",
  "allowSelfApproval": true
}

Entitlement

All users can access the query entitlements endpoint, but the results they see are filtered automatically based on their granted authorizations.

For example, administrators can see all entitlements. A user who is an application owner can see all entitlements that belong to their applications but not other applications' entitlements. A user who is the entitlement owner of three entitlements can see the entitlements that they own. A user who has been scoped permissions to view or act on a subset of entitlements can access that subset.

This endpoint also supports all standard pagination and query filtering abilities of other search APIs.

Every entitlement object in Identity Governance now includes an additional property at the item.objectType path. This attribute stores the object type of the entitlement and can be used in searching and filtering options.

URI HTTP
method Description

/iga/governance/entitlement

GET

Search for all entitlements provided by the query parameters.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter

Responses

Code Description

200

400

Error with request

500

Server error

Click for an example to query entitlements

Media type: application/json

GET iga/governance/entitlement?_pageSize=10&_queryFilter=true
{
  "result": [
    {
      "application": {
        "authoritative": false,
        "connectorId": "SNOW",
        "description": "Sanjay's SNOW",
        "icon": "",
        "id": "e35d09cd-2b9b-41bc-8246-dc23d4a36502",
        "name": "SNOW",
        "objectTypes": [
          {
            "name": "Role",
            "accountAttribute": "__user_role_ids__"
          },
          {
            "name": "Group",
            "accountAttribute": "__user_group_ids__"
          },
          {
            "name": "Department",
            "accountAttribute": "department"
          },
          {
            "name": "Company",
            "accountAttribute": "company"
          },
          {
            "name": "User"
          },
          {
            "name": "CostCenter",
            "accountAttribute": "costCenter"
          },
          {
            "name": "Location",
            "accountAttribute": "location"
          }
        ],
        "templateName": "servicenow",
        "templateVersion": "3.3"
      },
      "applicationOwner": [
        {
          "id": "75982e79-40dc-4ad2-8b85-abe1ebd2e2b9",
          "userName": "fyork",
          "givenName": "Frank",
          "sn": "York",
          "mail": "fyork@example.com"
        }
      ],
      "descriptor": {
        "idx": {
          "/entitlement": {
            "displayName": "web_analytics_viewer"
          }
        }
      },
      "entitlement": {
        "can_delegate": true,
        "sys_package": "3b5ad2be150022104f3415f71eacd930",
        "grantable": true,
        "sys_name": "web_analytics_viewer",
        "description": "Web Analytics Viewer",
        "sys_scope": "global",
        "__NAME__": "0a7f57c053101010d69cddeeff7b12b7",
        "elevated_privilege": false,
        "_id": "0a7f57c053101010d69cddeeff7b12b7",
        "sys_class_name": "sys_user_role"
      },
      "glossary": {
        "idx": {
          "/application": {
            "num": 0
          }
        }
      },
      "id": "system_SNOW_Role_0a7f57c053101010d69cddeeff7b12b7",
      "item": {
        "type": "entitlementGrant",
        "objectType": "Role",
        "accountAttribute": "__user_role_ids__"
      },
      "metadata": {
        "modifiedDate": "2025-04-23T17:30:52.031Z",
        "createdDate": "2025-03-24T16:35:34.005468359Z"
      },
      "permissions": {
        "modifyEntitlement": true,
        "viewGrants": true
      }
    }
  ],
  "searchAfterKey": [
    "10240914227d6fbbd85000df72f39d812975f30825f1eb4bf847c1a222fc7a96c58baffb7a31fbf0eee6e40ab3add5f73c87d2e7ead7915e06daec7cd2311d18"
  ],
  "totalCount": 400,
  "resultCount": 1
}

An important part of the response is the permissions key. This key provides additional details for each entitlement in the list, indicating the specific permissions the authorized user has been granted. This allows the UI and other API consumers to understand what actions the user is allowed to perform.

/iga/governance/entitlement

POST

Create a new entitlement.

Users can submit a request using the Create Entitlement request type. The request type accepts four properties when submitting a new request, all under the entitlement key payload:

applicationID: type string. Displays the application ID to which the entitlement belongs.
objectType: type string. Displays the object type of the entitlement (for example, GROUP).
object: type object. Displays the contents of the entitlement that follows the object type schema as defined in the application.
glossary: type object. Displays the contents of the entitlement’s glossary data, if present.

This endpoint creates the entitlement in the target system, creates the associated entry (if required), and ensures the entitlement is available in Identity Governance.

Parameters

Name Description

_action string * required

Action to be performed on a single request. The available value is create.

Request body

Example: create
Media type: application/json

{
  "applicationId": "7174f301-dc29-4cbe-bf95-a1cba356fc6c",
  "objectType": "__GROUP__",
  "object": {
    "description": "HR Approvers",
    "displayName": "HR Approvers",
    "id": "8989f1f4-1518-49bf-8a45-7a84d3c6b17f",
    "mailEnabled": false,
    "proxyAddresses": [],
    "securityEnabled": true
  },
  "glossary": {
    "requestable": true,
    "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
  }
}

Responses

Code Description

200

400

Error with provided payload

404

Entitlement not found

500

Server error

Click for an example to submit a Create entitlement request

Media type: application/json

POST iga/governance/requests/createEntitlement?_action=publish
{
   "common": {
       "justification": "Need to create this new entitlement"
   },
   "entitlement": {
       "objectType": "Role",
       "applicationId": "825c6e15-b860-4be4-bef9-55d28a0cd2de",
       "object": {
           "can_delegate": true,
           "sys_package": "b1c465bee8c2121087debb3e47d14f22",
           "grantable": true,
           "sys_name": "entitlement_lcm_role",
           "description": "Entitlement Demo Role 333",
           "sys_scope": "global",
           "elevated_privilege": false,
           "sys_class_name": "sys_user_role"
       },
       "glossary": {
           "requestable": true,
           "entitlementOwner": "managed/user/8d24a6ff-bd37-4e49-bbb6-52168bf2a69c"
       }
   }
}

By default, the workflow for Create Entitlement is set to the out-of-the-box example workflow, CreateEntitlement. After the workflow’s approval process is completed, it calls the Identity Governance API directly creating the entitlement within a scripted task.

/iga/governance/entitlement/{id}

GET

Return a single entitlement object by ID.

Reading an entitlement specifically by ID returns the full object type scheme under the entitlement key. For normal query use cases, the entitlement key only shows the keys that have actual values persisted. For get entitlement by ID, the response has all object type schema keys present. If no value is stored, the keys display a null value.

Parameters

Name Description

id string * required

ID of the entitlement

Responses

Code Description

200

404

Entitlement not found

500

Server error

Click for an example response

Media type: application/json

{
  "application": {
    "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-819546",
    "authoritative": false,
    "connectorId": "TargetApp",
    "description": "Testing 3",
    "fr": {
      "realm": "alpha"
    },
    "icon": "https://img.freepik.com/free-vector/vector-logo-unique-letter-e-colorful-gradient-design-illustration_474888-2292.jpg",
    "id": "825c6e15-b860-4be4-bef9-55d28a0cd2de",
    "name": "TargetApp",
    "objectTypes": [
      {
        "name": "Role",
        "accountAttribute": "__user_role_ids__"
      },
      {
        "name": "Group",
        "accountAttribute": "__user_group_ids__"
      },
      {
        "name": "Department",
        "accountAttribute": "department"
      },
      {
        "name": "Company",
        "accountAttribute": "company"
      },
      {
        "name": "User"
      },
      {
        "name": "CostCenter",
        "accountAttribute": "costCenter"
      },
      {
        "name": "Location",
        "accountAttribute": "location"
      }
    ],
    "templateName": "servicenow",
    "templateVersion": "3.3"
  },
  "applicationOwner": [
    {
      "id": "d09f3dda-bd62-4c73-95fa-b1cb8daa438e",
      "userName": "fyork",
      "givenName": "Frank",
      "sn": "York",
      "mail": "fyork@example.com"
    }
  ],
  "descriptor": {
    "idx": {
      "/entitlement": {
        "displayName": "tracked_file_reader"
      }
    }
  },
  "entitlement": {
    "can_delegate": true,
    "sys_package": "16ccd5fee802121087debb3e47d14fbf",
    "grantable": true,
    "description": "Read role for tracked configuration files",
    "sys_name": "tracked_file_reader",
    "sys_scope": "global",
    "__NAME__": "80b4cd57c3013300daa79624a1d3aea1",
    "elevated_privilege": false,
    "_id": "80b4cd57c3013300daa79624a1d3aea1",
    "sys_class_name": "sys_user_role"
  },
  "entitlementOwner": [
    {
      "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc",
      "userName": "christian.marnell",
      "givenName": "Christian",
      "sn": "Marnell",
      "mail": "christian.marnell@example.com"
    }
  ],
  "glossary": {
    "idx": {
      "/entitlement": {
        "complianceObjective": "HIPAA",
        "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc",
        "lob": "Finance",
        "requestable": true
      },
      "/application": {
        "requestable": true
      }
    }
  },
  "id": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1",
  "item": {
    "type": "entitlementGrant",
    "objectType": "Role"
  },
  "permissions": {
    "modifyEntitlement": true,
    "viewGrants": true
  },
  "metadata": {
    "modifiedDate": "2025-01-29T14:33:09.168Z",
    "createdDate": "2025-01-22T18:15:48.763702117Z"
  }
}

/iga/governance/entitlement/{id}

PUT

Modify an existing entitlement.

Users can submit a request using the Modify Entitlement request type. The request type accepts three properties when submitting a new request, all under the entitlement key payload. The endpoint takes the entitlementId for the existing entitlement:

object: type object. Displays the contents of the entitlement that follows the object type schema as defined in the application.
glossary: type object. Displays the contents of the entitlement’s glossary data, if present.

To modify an entitlement, you must include the full technical and glossary details in the request API call, as the entire object provided is used as the contents.

Parameters

Name Description

id string * required

ID of the entitlement

Request body

Media type: application/json

{
  "object": {
    "description": "HR Approvers",
    "displayName": "HR Approvers",
    "id": "8989f1f4-1518-49bf-8a45-7a84d3c6b17f",
    "mailEnabled": false,
    "proxyAddresses": [],
    "securityEnabled": true
  },
  "glossary": {
    "requestable": true,
    "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
  }
}

Responses

Code Description

200

400

Error with provided payload

404

Entitlement not found

500

Server error

Click for an example to submit a Modify entitlement request

Media type: application/json

POST iga/governance/requests/modifyEntitlement?_action=publish
{
   "common": {
       "justification": "Need to modify this entitlement"
   },
   "entitlement": {
       "entitlementId": "system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1",
       "object": {
           "can_delegate": true,
           "sys_package": "b1c465bee8c2121087debb3e47d14f22",
           "grantable": true,
           "sys_name": "entitlement_lcm_role",
           "description": "Entitlement Demo Role 333",
           "sys_scope": "global",
           "elevated_privilege": false,
           "sys_class_name": "sys_user_role"
       },
       "glossary": {
           "requestable": true,
           "entitlementOwner": "managed/user/8d24a6ff-bd37-4e49-bbb6-52168bf2a69c"
       }
   }
}

By default, the workflow for the Create Entitlement is set to the out-of-the-box example workflow, CreateEntitlement. After the workflow’s approval process is completed, it calls the Identity Governance modify API directly using the entitlementId, object, and glossary contents in the payload.

Click for an example to modify an entitlement directly

Media type: application/json

PUT iga/governance/entitlement/\{entitlementId}  (example: system_TargetApp_Role_80b4cd57c3013300daa79624a1d3aea1)
{
     "object": {
         "can_delegate": true,
         "sys_package": "b1c465bee8c2121087debb3e47d14f22",
         "grantable": true,
         "sys_name": "entitlement_lcm_role",
         "description": "Entitlement Demo Role 333",
         "sys_scope": "global",
         "elevated_privilege": false,
         "sys_class_name": "sys_user_role"
     },
     "glossary": {
         "requestable": true,
         "entitlementOwner": "managed/user/8d24a6ff-bd37-4e49-bbb6-52168bf2a69c"
     }
}

/iga/governance/entitlement/{id}/grants

GET

Returns the entitlement grants for the given entitlement ID.

Users who have the permissions to do so can view the users who are currently granted a given entitlement. Administrators, application owners, and entitlement owners are granted this privilege implicitly. Additional end users can be scoped to have this permission also.

Parameters

Name Description

id string * required

ID of the entitlement.

_fields string

The list of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter

Responses

Code Description

200

500

Server error

Click for an example to view grants

Media type: application/json

GET iga/governance/entitlement/\{entitlementId}/grants?_pageSize=10&_queryFilter=true
{
   "result": [
       {
           "account": {
               "calendar_integration": "1",
               "user_name": "guillermo.frohich",
               "sys_updated_on": "2025-01-02 21:29:47",
               "__user_group_ids__": [
                   "0a52d3dcd7011200f2d224837e6103f2"
               ],
               "title": "Chief Financial Officer",
               "sys_class_name": "sys_user",
               "notification": "2",
               "sys_updated_by": "developer.program.hop@snc",
               "sys_created_on": "2024-11-30 15:04:03",
               "sys_domain": "global",
               "__NAME__": "62526fa1d701120035ae23c7ce6103c6",
               "vip": false,
               "department": "221f3db5c6112284009f4becd3039cc9",
               "first_name": "Guillermo",
               "sys_created_by": "admin",
               "email": "guillermo.frohlich@example.com",
               "__user_role_ids__": [
                   "cc6f85b5ebc31300a210a2505206fec0",
                   "45af8773d7002200c1ed0fbc5e61037a",
                   "20d2eaa35320330030c3ddeeff7b1213",
                   "ba4509c60a00070400cc0f3a60a0d30a",
                   "a47f56c15310330030c3ddeeff7b1295",
                   "7423767053ef0010763eddeeff7b12c0",
                   "408934d18733320025fbd1a936cb0b88",
                   "d18b9793c0a80a6b00ac0456923a1c0f",
                   "fc32695d73e3a410960c6039faf6a7f1",
                   "b523f1d037001300a213a7f07e41f15b",
                   "8536f54bc713330072b211d4d8c26080",
                   "6d3c40d33b981300ad3cc9bb34efc415",
                   "b3dd3ccec32203003e76741e81d3ae95",
                   "959c82e3535201109ea3ddeeff7b1227",
                   "d8e675e8532323008ef67c2c0fc587f6",
                   "ceb92b8153c833004558ddeeff7b12df",
                   "a731753ee886121087debb3e47d14f00",
                   "260c203a870033000e56d61e36cb0bbc",
                   "20803f15870033000e56d61e36cb0b7d",
                   "64c3259d73e3a410960c6039faf6a7d6",
                   "edd0b83353520110610bddeeff7b12e8",
                   "f98446040f103300402c6b198b767e1e",
                   "3bf8d5b65344130084acddeeff7b122b",
                   "f3feb8a577831010d7159b71a9106123",
                   "80b4cd57c3013300daa79624a1d3aea1",
                   "0956f6390a0a0bc50064623d5d51c556",
                   "14fa2dc39f230200ee6219eb552e7006",
                   "3c4bc8f5534330108e4dddeeff7b12a7",
                   "0d6c490a3b2010108ed00d8044efc40e",
                   "ca27b5e8532323008ef67c2c0fc5879c",
                   "f13ae18b3bc63300c869c2c703efc418",
                   "a5d7367c5b5320104db40a8a3d81c771",
                   "ab250967b31213005e3de13516a8dc26",
                   "71cb2cf2530033004558ddeeff7b126a",
                   "e776c6af531201109ea3ddeeff7b12aa",
                   "553b1f166723220097eeff5557415a6a",
                   "89d4c6040f103300402c6b198b767e3c",
                   "c627309e53722010af64ddeeff7b1232",
                   "282bf1fac6112285017366cb5f867469",
                   "1bc156f3771000101ecaff046910619e",
                   "8a454be00a0a0b8c00de7dae26869165"
               ],
               "locked_out": "false",
               "sys_mod_count": "3",
               "active": "true",
               "last_name": "Frohlich",
               "time_zone": "Europe/London",
               "name": "Guillermo Frohlich",
               "_id": "62526fa1d701120035ae23c7ce6103c6"
           },
           "application": {
               "name": "TargetApp",
               "description": "Testing 3",
               "objectTypes": [
                   {
                       "name": "Role",
                       "accountAttribute": "__user_role_ids__"
                   },
                   {
                       "name": "Group",
                       "accountAttribute": "__user_group_ids__"
                   },
                   {
                       "name": "Department",
                       "accountAttribute": "department"
                   },
                   {
                       "name": "Company",
                       "accountAttribute": "company"
                   },
                   {
                       "name": "User"
                   },
                   {
                       "name": "CostCenter",
                       "accountAttribute": "costCenter"
                   },
                   {
                       "name": "Location",
                       "accountAttribute": "location"
                   }
               ]
           },
           "catalog": {
               "id": "1195eadf8cf40105f2c91976f32834b31bfdb1661e8c8680b7d7f59c27f9978dedd53b8171237ff6d056c79b6e77679ccc1da21ec611b3ac6c6d4ffda5e90827"
           },
           "compositeId": "ae4dc3705eab9887753a2b6027748979d789ffc4b34cb28872613600764c75d74dad6802db54f3841cc7341c9a0c1b7a61eb25cf3d99f4d9b6161ed422330b96",
           "descriptor": {
               "idx": {
                   "/entitlement": {
                       "displayName": "tracked_file_reader"
                   },
                   "/account": {
                       "displayName": "guillermo.frohich"
                   }
               }
           },
           "entitlement": {
               "can_delegate": true,
               "sys_package": "16ccd5fee802121087debb3e47d14fbf",
               "grantable": true,
               "description": "Read role for tracked configuration files",
               "sys_name": "tracked_file_reader",
               "sys_scope": "global",
               "__NAME__": "80b4cd57c3013300daa79624a1d3aea1",
               "elevated_privilege": false,
               "_id": "80b4cd57c3013300daa79624a1d3aea1",
               "sys_class_name": "sys_user_role"
           },
           "glossary": {
               "idx": {
                   "/entitlement": {
                       "complianceObjective": [
                           "HIPAA",
                           "test"
                       ],
                       "entitlementOwner": "managed/user/bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc",
                       "lob": "Finance",
                       "multiUser": "managed/user/95648547-febc-4757-9b31-7b24fe36db24",
                       "requestable": true
                   },
                   "/application": {
                       "requestable": true
                   }
               },
               "types": [
                   {
                       "attrKey": "/assignment",
                       "modified": "2025-02-07T17:58:12.384Z",
                       "type": "entityType/id/realm"
                   },
                   {
                       "attrKey": "/application",
                       "modified": "2025-02-03T22:08:38.874Z",
                       "type": "entityType/id/realm"
                   }
               ]
           },
           "item": {
               "type": "entitlementGrant",
               "objectType": "Role"
           },
           "keys": {
               "type": "entitlementGrant",
               "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219",
               "applicationId": "825c6e15-b860-4be4-bef9-55d28a0cd2de",
               "accountId": "system/TargetApp/User/62526fa1d701120035ae23c7ce6103c6",
               "entitlementId": "system/TargetApp/Role/80b4cd57c3013300daa79624a1d3aea1"
           },
           "relationship": {
               "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-61186",
               "properties": {
                   "grantTypes": [
                       {
                           "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-61186",
                           "grantType": "recon"
                       }
                   ]
               }
           },
           "user": {
               "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-20187",
               "accountStatus": "active",
               "assignedDashboard": [
                   "TargetApp"
               ],
               "cn": "Guillermo Frohlich",
               "fr": {
                   "realm": "alpha"
               },
               "givenName": "Guillermo",
               "id": "ff1d2def-b44e-468f-9079-3b5a2a7dd219",
               "mail": "guillermo.frohlich@example.com",
               "metadata": {
                   "created": "2025-01-22T18:17:03.931Z",
                   "entityType": "/openidm/managed/user",
                   "version": 10
               },
               "scopes": {
                   "view": [
                       {
                           "id": "e8abd5fb-64c2-493d-8415-e7a0e4a35984",
                           "timestamp": "2025-01-28T14:45:52.119497214Z"
                       }
                   ]
               },
               "sn": "Frohlich",
               "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219",
               "userName": "guillermo.frohich"
           },
           "metadata": {
               "modifiedDate": "2025-02-08T01:35:24.671Z",
               "createdDate": "2025-01-22T18:16:04.268082497Z"
           }
       }
   ],
   "searchAfterKey": [
       "ae4dc3705eab9887753a2b6027748979d789ffc4b34cb28872613600764c75d74dad6802db54f3841cc7341c9a0c1b7a61eb25cf3d99f4d9b6161ed422330b96"
   ],
   "totalCount": 1,
   "resultCount": 1
}

/iga/governance/entitlement/{id}/grants/glossary

GET

Get an entitlement’s glossary metadata by ID.

Parameters

Name Description

entitlementId string * required

Unique identifier of the entitlement for which to get glossary information.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

404

Request can’t be found

Click for an example response

Media type: application/json

{
  "requestable": true,
  "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
}

/iga/governance/entitlement/{id}/grants/glossary

POST

Create a glossary entry for a single entitlement using its unique identifier.

Parameters

Name Description

entitlementId string * required

Unique identifier of the entitlement for which to get glossary information.

__action string *required

Action to be performed for entitlement glossary endpoint. The available value is create.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "requestable": true,
  "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
}

Responses

Code Description

200

Success

400

Request error

Click for an example response

Media type: application/json

{
  "requestable": true,
  "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
}

/iga/governance/entitlement/{id}/grants/glossary

PUT

Create or update a glossary entry for a single entitlement using its unique identifier.

Parameters

Name Description

entitlementId string * required

Unique identifier of the entitlement to get.

__action string *required

Action to be performed for entitlement glossary endpoint. The available values is create.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "requestable": true,
  "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
}

Responses

Code Description

200

Success

400

Request error

Click for an example response

Media type: application/json

{
  "requestable": true,
  "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
}

/iga/governance/entitlement/{id}/grants/glossary

DELETE

Delete a glossary entry for a single entitlement using its unique identifier.

Parameters

Name Description

entitlementId string * required

Unique identifier of the entitlement to get.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Success

400

Request error

Click for an example response

Media type: application/json

{
  "requestable": true,
  "entitlementOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
}

Event

Events are rules defined to detect a change in the IGA system. Each rule has two core parts: a condition for the event and the action taken when that event occurs. For example, a rule might define that whenever someone creates a user in IGA, they should also generate a certification for that user.

URI HTTP
method Description

/iga/governance/event

GET

Get and search for a list of event rules defined in IGA. Each entry represents a single event rule defined to detect a change in the system.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc or desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Error with request

500

Server error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "name": "User Creation Event",
      "description": "This event will create an identity certification for a new user upon creation",
      "owners": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "entityType": "user",
      "mutationType": "create",
      "condition": {
        "version": "v2",
        "filter": {
          "and": [
            {
              "equals": {
                "left": "user.after.country",
                "right": {
                  "literal": "USA"
                }
              }
            }
          ]
        }
      },
      "action": {
        "type": "orchestration",
        "template": {
          "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
        },
        "name": "IdentityCertificationKickOff",
        "parameters": {}
      },
      "status": "active",
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      },
      "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
    }
  ],
  "resultCount": 0,
  "totalCount": 0,
  "searchAfterKey": [
    "string"
  ]
}

/iga/governance/event

POST

Create a single IGA event rule. A single event rule is defined to detect a change in the system.

Parameters

Name Description

_action string * required

Action to be performed for the event endpoint. The available value is create.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Example: orchestration
Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will kick off an orchestration for a new user upon creation.",
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "name": "IdentityCertificationKickOff"
  },
  "status": "active",
  "owners": [
    {
      "id": "managed/user/02612d23-2f7e-4fd0-98f2-3c3d0988df27",
      "mail": "aparsons@frgov.net",
      "givenName": "Alvin",
      "sn": "Parsons",
      "userName": "aparsons"
    }
  ]
}

Responses

Code Description

200

400

Error with provided payload

404

Event not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will create an identity certification for a new user upon creation",
  "owners": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "template": {
      "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
    },
    "name": "IdentityCertificationKickOff",
    "parameters": {}
  },
  "status": "active",
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/event/{id}

GET

Get a single IGA event by ID. The response is a single event rule defined to detect a change in the system.

Parameters

Name Description

id string * required

ID of the event.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Event not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will create an identity certification for a new user upon creation",
  "owners": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "template": {
      "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
    },
    "name": "IdentityCertificationKickOff",
    "parameters": {}
  },
  "status": "active",
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/event/{id}

PUT

Update a single IGA event by ID. This call requires that the entire object be provided and that it replaces the entire existing event definition.

Parameters

Name Description

id string * required

ID of the event.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will create an identity certification for a new user upon creation",
  "owners": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "template": {
      "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
    },
    "name": "IdentityCertificationKickOff",
    "parameters": {}
  },
  "status": "active"
}

Responses

Code Description

200

400

Error with provided payload

404

Event not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will create an identity certification for a new user upon creation",
  "owners": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "template": {
      "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
    },
    "name": "IdentityCertificationKickOff",
    "parameters": {}
  },
  "status": "active",
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/event/{id}

PATCH

Update a single IGA event by ID. This call allows the caller to update specific properties of the event only without providing the entire object.

Parameters

Name Description

id string * required

ID of the event.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Example: patchArray
Media type: application/json

[
  {
    "operation": "replace",
    "field": "/status",
    "value": "active"
  }
]

Responses

Code Description

200

400

Error with provided payload

404

Event not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will create an identity certification for a new user upon creation",
  "owners": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "template": {
      "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
    },
    "name": "IdentityCertificationKickOff",
    "parameters": {}
  },
  "status": "active",
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/event/{id}

DELETE

Delete a single IGA event by ID.

Parameters

Name Description

id string * required

ID of the event.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

404

Event not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "User Creation Event",
  "description": "This event will create an identity certification for a new user upon creation",
  "owners": [
    {
      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
      "userName": "asmith",
      "mail": "asmith01@forgerock.com",
      "givenName": "Aaron",
      "sn": "Smith"
    }
  ],
  "entityType": "user",
  "mutationType": "create",
  "condition": {
    "version": "v2",
    "filter": {
      "and": [
        {
          "equals": {
            "left": "user.after.country",
            "right": {
              "literal": "USA"
            }
          }
        }
      ]
    }
  },
  "action": {
    "type": "orchestration",
    "template": {
      "id": "8baa49a4-2c22-40e1-a2b9-5cbe4930f8da-46357"
    },
    "name": "IdentityCertificationKickOff",
    "parameters": {}
  },
  "status": "active",
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/event/entity

GET

Get the list of available event entities from which you can define a condition.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

500

Server error

Click for an example response

Media type: application/json

{
  "entities": [
    "user"
  ]
}

/iga/governance/event/entity/{object}

GET

Get the available schema for defining a condition on a given object. For example, user returns the attributes available for defining an event for users in IGA.

Parameters

Name Description

object string * required

Type of object for which to return the schema.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

404

Event rule schema not found

500

Server error

Click for an example response

Media type: application/json

{
  "schema": {
    "user.after.profileImage": {
      "class": "json",
      "type": "string"
    },
    "user.before.description": {
      "class": "json",
      "type": "string"
    },
    "user.before._id": {
      "class": "json",
      "type": "string"
    },
    "user.after.manager": {
      "class": "json",
      "reference": "/openidm/managed/alpha_user",
      "type": "reference"
    },
    "user.before.postalAddress": {
      "class": "json",
      "type": "string"
    },
    "user.after.applications": {
      "class": "json",
      "item": {
        "type": "reference",
        "reference": "/openidm/managed/alpha_application"
      },
      "type": "array"
    },
    "user.before.accountStatus": {
      "class": "json",
      "type": "string"
    },
    "user.before.groups": {
      "class": "json",
      "item": {
        "type": "reference",
        "reference": "/openidm/managed/alpha_group"
      },
      "type": "array"
    },
    "user.before.adminOfOrg": {
      "class": "json",
      "item": {
        "type": "reference",
        "reference": "/openidm/managed/alpha_organization"
      },
      "type": "array"
    },
    "user.after.country": {
      "class": "json",
      "type": "string"
    },
    "user.after.telephoneNumber": {
      "class": "json",
      "type": "string"
    },
    "user.after.reports": {
      "class": "json",
      "item": {
        "type": "reference",
        "reference": "/openidm/managed/alpha_user"
      },
      "type": "array"
    },
    "user.before.frUnindexedMultivalued4": {
      "class": "json",
      "item": {
        "type": "string"
      },
      "type": "array"
    },
    "user.before.ownerOfApp": {
      "class": "json",
      "item": {
        "type": "reference",
        "reference": "/openidm/managed/alpha_application"
      },
      "type": "array"
    },
    "user.before.frUnindexedMultivalued5": {
      "class": "json",
      "item": {
        "type": "string"
      },
      "type": "array"
    },
    "user.before.frUnindexedMultivalued2": {
      "class": "json",
      "item": {
        "type": "string"
      },
      "type": "array"
    },
    "user.after.givenName": {
      "class": "json",
      "type": "string"
    },
    "user.before.frUnindexedMultivalued3": {
      "class": "json",
      "item": {
        "type": "string"
      },
      "type": "array"
    },
    "user.before.manager": {
      "class": "json",
      "reference": "/openidm/managed/alpha_user",
      "type": "reference"
    },
    "user.after.mail": {
      "class": "json",
      "type": "string"
    }
  }
}

Job

You can manually trigger a governance job.

URI HTTP
method Description

/iga/governance/jobs/{id}

POST

Manually trigger a governance job by ID.

Parameters

Name Description

id string * required

ID of the scope. The available value is autoIdTraining.

_action string * required

Action to be taken. The available value is trigger.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{}

Responses

Code Description

200

400

Bad request

404

Workflow with ID wasn’t found

500

Internal service error

Click for an example response

Media type: application/json

{
  "message": "string"
}

Provisioning

In the Advanced Identity Cloud admin console, you can add or remove, or provision, resources from end users. You can do the same through REST APIs.

URI HTTP
method Description

/iga/governance/user/{userId}/applications

POST

Provision or de-provision applications for an end user.

Parameters

Name Description

userId string * required

Unique identifier of the user.

action string * required

Action to be performed for the requests endpoint. The available values are add and remove.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body example

Media type: application/json

{
  "applicationId": "0c067d47-f07c-46d6-9162-14476d18d87a",
  "startDate": "2023-09-11T12:00:00+00:00",
  "endDate": "2023-12-11T12:00:00+00:00",
  "grantType": "request"
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{}

/iga/governance/user/{userId}/roles

POST

Provision or de-provision roles for an end user.

Parameters

Name Description

userId string * required

Unique identifier of the user.

action string * required

Action to be performed for the requests endpoint. The available values are add and remove.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body example

Media type: application/json

{
  "roleId": "0c067d47-f07c-46d6-9162-14476d18d87a",
  "startDate": "2023-09-11T12:00:00+00:00",
  "endDate": "2023-12-11T12:00:00+00:00",
  "grantType": "request"
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{}

/iga/governance/user/{userId}/entitlements

POST

Provision or de-provision entitlements for an end user.

Parameters

Name Description

userId string * required

Unique identifier of the user.

action string * required

Action to be performed for the requests endpoint. The available values are add and remove.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body example

Media type: application/json

{
  "entitlementId": "0c067d47-f07c-46d6-9162-14476d18d87a",
  "startDate": "2023-09-11T12:00:00+00:00",
  "endDate": "2023-12-11T12:00:00+00:00",
  "grantType": "request"
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{}

Scope

Scope determines which specific users are able to view or interact with particular target objects. Scoping rules comprise of two core parts: a condition for the source object (who or what the scope applies to) and a condition for the target object that can be viewed or acted upon.

URI HTTP
method Description

/iga/governance/scope

GET

Get and search for a list of scoping rules defined in IGA. Each entry represents a single scoping rule defined to assign a set of conditions that allows a subset of users visibility on a subset of target objects.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Success

400

Error with request

500

Server error

Click for an example response

Media type: application/json

{
  "result": [
    {
      "name": "Contractor Scope",
      "description": "This event will create a scoping rule for users who are contractors",
      "status": "active",
      "sourceCondition": {
        "user": {
          "version": "v2",
          "filter": {
            "and": [
              {
                "equals": {
                  "left": "user.employeeType",
                  "right": {
                    "literal": "contractor"
                  }
                }
              }
            ]
          }
        }
      },
      "targetCondition": {
        "application": {
          "version": "v2",
          "filter": {
            "and": [
              {
                "equals": {
                  "left": "application.templateName",
                  "right": {
                    "literal": "azure.ad"
                  }
                }
              }
            ]
          }
        },
        "role": {
          "version": "v2",
          "filter": {
            "and": [
              {
                "contains": {
                  "search_string_array": [
                    {
                      "literal": "contractor"
                    },
                    {
                      "literal": "temp"
                    }
                  ],
                  "in_string": "role.name"
                }
              }
            ]
          }
        },
        "entitlement": {
          "version": "v2",
          "filter": {
            "and": [
              {
                "equals": {
                  "left": "entitlement.name",
                  "right": {
                    "literal": "Directory Admin"
                  }
                }
              }
            ]
          }
        }
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      },
      "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
    }
  ],
  "resultCount": 0,
  "totalCount": 0,
  "searchAfterKey": [
    "string"
  ]
}

/iga/governance/scope

POST

Create a single scoping rule in IGA. Each scoping rule is defined to assign a set of conditions that allows a subset of users visibility on a subset of target objects. IGA scoping rules consist of two core parts: a condition for the source object (who/what the scope applies to) and a condition for the target object that can be viewed or acted upon.

Parameters

Name Description

_action string * required

Action to be performed on a single request. The available value is create.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  }
}

Responses

Code Description

200

400

Error with provided payload

404

Scope not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/scope/{id}

GET

Get a single scoping rule in IGA by ID. Each scoping rule is defined to assign a set of conditions that allows a subset of users visibility on a subset of target objects.

Parameters

Name Description

id string * required

ID of the scope.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

404

Scope not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/scope/{id}

PUT

Update a single IGA scope by ID. This call expects the entire object to be provided and replaces the entire existing scope definition.

Parameters

Name Description

id string * required

ID of the scope.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Request body

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  }
}

Responses

Code Description

200

404

Error with provided payload

404

Scope not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/scope/{id}

PATCH

Update a single IGA scope by ID. This call allows the caller to update specific properties of the scope only without providing the entire object.

Parameters

Name Description

id string * required

ID of the scope.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Request body

Example: patchArray
Media type: application/json

[
  {
    "operation": "replace",
    "field": "/status",
    "value": "active"
  }
]

Responses

Code Description

200

404

Error with provided payload

404

Scope not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/scope/{id}

DELETE

Delete a single IGA scope by ID.

Parameters

Name Description

id string * required

ID of the scope.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

404

Scope not found

500

Server error

Click for an example response

Media type: application/json

{
  "name": "Contractor Scope",
  "description": "This event will create a scoping rule for users who are contractors",
  "status": "active",
  "sourceCondition": {
    "user": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "user.employeeType",
              "right": {
                "literal": "contractor"
              }
            }
          }
        ]
      }
    }
  },
  "targetCondition": {
    "application": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "application.templateName",
              "right": {
                "literal": "azure.ad"
              }
            }
          }
        ]
      }
    },
    "role": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "contains": {
              "search_string_array": [
                {
                  "literal": "contractor"
                },
                {
                  "literal": "temp"
                }
              ],
              "in_string": "role.name"
            }
          }
        ]
      }
    },
    "entitlement": {
      "version": "v2",
      "filter": {
        "and": [
          {
            "equals": {
              "left": "entitlement.name",
              "right": {
                "literal": "Directory Admin"
              }
            }
          }
        ]
      }
    }
  },
  "metadata": {
    "createdDate": "2024-01-11T12:00:00+00:00",
    "modifiedDate": "2024-04-24T12:00:00+00:00"
  },
  "id": "100a7fba-fd8b-47ca-bc6e-16fbec3a578d"
}

/iga/governance/scope/entity

GET

Get a list of available entities on which a condition can be defined.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

500

Server error

Click for an example response

Media type: application/json

{
  "entities": [
    "user",
    "catalog"
  ]
}

/iga/governance/scope/entity/{object}

GET

Get the available schema for defining a condition on a given object. For example, 'user' returns the attributes available for defining a scope for users in IGA.

Parameters

Name Description

object string * required

Type of object for which to return the schema.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Responses

Code Description

200

404

Scope schema not found

500

Server error

Click for an example response

Media type: application/json

{
  "schema": {
    "user.userName": {
      "class": "json",
      "type": "string"
    },
    "user.description": {
      "class": "json",
      "type": "string"
    },
    "user._id": {
      "class": "json",
      "type": "string"
    },
    "user.givenName": {
      "class": "json",
      "type": "string"
    },
    "user.sn": {
      "class": "json",
      "type": "string"
    }
  }
}

Segregation of Duty

Segregation of Duties (SoD) is an internal control process ensuring no single individual is granted privileges that could lead to a conflict of interest or fraud. Administrators can configure SoD using policies and policy rules that let them identify violations and run actions, such as create an exception, allow or remediate the violation, and others.

You can view the entire API using a YAML file based on the OpenAPI specification.

Adjust the configurations of the file to match your specific details, such as your Advanced Identity Cloud tenant FQDN.

URI HTTP
method Description

/iga/governance/policy

GET

Search policies. The endpoint returns policies stored within the Identity Governance store, based on a set of query parameters.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  }
]

/iga/governance/policy

POST

Create a new policy object within Identity Governance.

Parameters

Name Description

_action string * required

Action to be taken. The available values are create and duplicate.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "name": "string",
  "description": "string",
  "policyOwner": {
    "id": "string"
  },
  "policyRuleIds": [
    "string"
  ],
  "schedule": {
    "type": "simple",
    "scheduled": true,
    "schedule": "string",
    "repeatInterval": 864000000,
    "repeatCount": -1,
    "startTime": "2023-12-21T22:41:00.000Z",
    "endTime": "2024-01-01T22:41:00.000Z"
  }
}

Responses

Code Description

201

Creation success. Returns the saved policy object.

400

Invalid data provided.

500

Server error on save.

Click for an example response

Media type: application/json

{
  "id": "string",
  "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
  "name": "string",
  "description": "string",
  "policyOwner": {
    "id": "string"
  },
  "policyRuleIds": [
    "string"
  ]
}

/iga/governance/policy/search

POST

Query policy objects using a targeted search filter.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

Sort property values of the last entry to continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  }
]

/iga/governance/policy/{id}

GET

Get policy by ID. The endpoint returns the policy with the provided ID.

Parameters

Name Description

id string * required

ID of the policy.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

404

Policy does not exist

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
  "name": "string",
  "description": "string",
  "policyOwner": {
    "id": "string"
  },
  "policyRuleIds": [
    "string"
  ]
}

/iga/governance/policy/{id}

PUT

Update an existing policy object within Identity Governance.

Parameters

Name Description

id string * required

ID of the event.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "name": "string",
  "description": "string",
  "policyOwner": {
    "id": "string"
  },
  "policyRuleIds": [
    "string"
  ]
}

Responses

Code Description

200

Update success. Returns the saved policy object.

400

Invalid data provided.

404

Policy does not exist.

500

Server error on save.

Click for an example response

Media type: application/json

{
  "id": "string",
  "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
  "name": "string",
  "description": "string",
  "policyOwner": {
    "id": "string"
  },
  "policyRuleIds": [
    "string"
  ]
}

/iga/governance/policy/{id}

DELETE

Delete an existing policy object within Identity Governance.

Parameters

Name Description

id string * required

ID of the policy.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid data provided

404

Policy does not exist

500

Server error on save

Click for an example response

Media type: application/json

{
  "id": "string",
  "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
  "name": "string",
  "description": "string",
  "policyOwner": {
    "id": "string"
  },
  "policyRuleIds": [
    "string"
  ]
}

/iga/governance/policy/{id}/scan

POST

Run a scan on all given rules of a policy and create violations if desired.

Parameters

Name Description

id string * required

ID of the policy.

simulate string

Indicates if this scan is a simulation, true means no violation tasks are created; false or not present creates violations.

waitForCompletion string

Specifies if you should wait for the completion of the scan before returning. true waits; false or not present returns after scan creation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{}

Responses

Code Description

201

Policy scan started

400

Invalid data provided

404

Policy does not exist

500

Server error on save

Click for an example response

Media type: application/json

{
  "id": "string",
  "policy": {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  },
  "policyRule": {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  },
  "isSimulation": true,
  "status": "string",
  "startDate": "string",
  "completionDate": "string",
  "scanTarget": "string",
  "results": [
    {}
  ]
}

/iga/governance/policy/{id}/rules

GET

Get policy rules associated with a policy ID.

Parameters

Name Description

id string * required

ID of the policy rule.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid data provided

404

Policy doesn’t exist

500

Server error on save

Click for an example response

Media type: application/json

{
  "result": [
    {
      "name": "string",
      "description": "string",
      "documentationUrl": "string",
      "policyRuleOwner": {
        "id": "string"
      },
      "violationOwner": {
        "id": "string"
      },
      "active": true,
      "scanTypes": {
        "preventative": true,
        "detective": true
      },
      "maxExceptionDuration": 0,
      "decisionOptions": {
        "allow": true,
        "exception": true,
        "remediate": true
      },
      "remediation": {
        "type": "string",
        "id": "string",
        "schemas": [
          "string"
        ]
      },
      "userFilter": {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      },
      "ruleDefinition": [
        {
          "operator": "AND",
          "operand": [
            {
              "operator": "EQUALS",
              "operand": {
                "targetName": "user.userName",
                "targetValue": "ljones"
              }
            },
            {
              "operator": "CONTAINS",
              "operand": {
                "targetName": "application.name",
                "targetValue": "Active Directory"
              }
            }
          ]
        }
      ],
      "workflow": {
        "type": "bpmn",
        "id": "BasicViolationProcess"
      },
      "violationOwnerType": "user",
      "id": "string",
      "ruleDefinitionTags": [
        "targetName=entitlement.displayName&targetValue=IT%20Admin",
        "targetValue=IT%20Admin&targetName=entitlement.displayName"
      ]
    }
  ]
}

/iga/governance/policy/rule

GET

Query policy rules based on a set of query parameters.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  }
]

/iga/governance/policy/rule

POST

Create a new policy rule object within Identity Governance.

Parameters

Name Description

_action string * required

Action to be performed on a single request. The available values are create and duplicate.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user"
}

Responses

Code Description

201

Creation success. Returns the saved policy rule object.

400

Invalid data provided

500

Server error on save.

Click for an example response

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user",
  "id": "string",
  "ruleDefinitionTags": [
    "targetName=entitlement.displayName&targetValue=IT%20Admin",
    "targetValue=IT%20Admin&targetName=entitlement.displayName"
  ]
}

/iga/governance/policy/rule/search

POST

Query the policy rule objects using a targeted search filter.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of the API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  }
]

/iga/governance/policy/rule/{id}

GET

Get policy rule by ID.

Parameters

Name Description

id string * required

ID of the policy rule.

resolveSchemas string

When true, enrich the remediation.schemas property with the full schema objects rather than just the IDs.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

404

Policy doesn’t exist

500

Server error

Click for an example response

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user",
  "id": "string",
  "ruleDefinitionTags": [
    "targetName=entitlement.displayName&targetValue=IT%20Admin",
    "targetValue=IT%20Admin&targetName=entitlement.displayName"
  ]
}

/iga/governance/policy/rule/{id}

POST

Duplicate a given policy rule. The rule will be set as inactive by default.

Parameters

Name Description

_action string * required

Action to be performed on a single request. The available values are create and duplicate

id string * required

ID of the policy rule.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{}

Responses

Code Description

201

Returns new policy rule. NOTE: Rule is set to inactive by default.

400

Invalid request

404

Policy doesn’t exist

500

Server error

Click for an example response

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user"
}

/iga/governance/policy/rule/{id}

PUT

Update an existing policy rule object.

Parameters

Name Description

id string * required

ID of the policy rule to update.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user"
}

Responses

Code Description

200

Update success. Returns the saved policy rule object.

400

Invalid data provided

404

Policy doesn’t exist

500

Server error on save

Click for an example response

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user",
  "id": "string",
  "ruleDefinitionTags": [
    "targetName=entitlement.displayName&targetValue=IT%20Admin",
    "targetValue=IT%20Admin&targetName=entitlement.displayName"
  ]
}

/iga/governance/policy/rule/{id}

DELETE

Delete an existing policy rule.

Parameters

Name Description

id string * required

ID of policy rule to delete.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Delete success. Returns the removed policy rule object

400

Invalid data provided

404

Policy doesn’t exist

500

Server error on save

Click for an example response

Media type: application/json

{
  "name": "string",
  "description": "string",
  "documentationUrl": "string",
  "policyRuleOwner": {
    "id": "string"
  },
  "violationOwner": {
    "id": "string"
  },
  "active": true,
  "scanTypes": {
    "preventative": true,
    "detective": true
  },
  "maxExceptionDuration": 0,
  "decisionOptions": {
    "allow": true,
    "exception": true,
    "remediate": true
  },
  "remediation": {
    "type": "string",
    "id": "string",
    "schemas": [
      "string"
    ]
  },
  "userFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  },
  "ruleDefinition": [
    {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    }
  ],
  "workflow": {
    "type": "bpmn",
    "id": "BasicViolationProcess"
  },
  "violationOwnerType": "user",
  "id": "string",
  "ruleDefinitionTags": [
    "targetName=entitlement.displayName&targetValue=IT%20Admin",
    "targetValue=IT%20Admin&targetName=entitlement.displayName"
  ]
}

/iga/governance/policy/rule/{id}/scan

POST

Run a scan the given policy for violations and create violations if desired.

Parameters

Name Description

id string * required

ID of the policy rule to scan.

simulate string

Indicates if this scan is a simulation: true means no violation tasks are created; false or not present creates violations.

waitForCompletion string

Specifies if you should wait for the completion of the scan before returning: true means wait; false or not present returns after scan creation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

201

Policy rule scan started

400

Invalid data provided

404

Policy doesn’t exist

500

Server error on save

Click for an example response

Media type: application/json

{
  "id": "string",
  "policy": {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  },
  "policyRule": {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  },
  "isSimulation": true,
  "status": "string",
  "startDate": "string",
  "completionDate": "string",
  "scanTarget": "string",
  "results": [
    {}
  ]
}

/iga/governance/policy/user/{id}/scan

POST

Run a scan on a given user rule and return potential violations.

Parameters

Name Description

id string * required

ID of the user to scan.

simulate string

Indicate if this scan is a simulation: true means no violation tasks are created; false or not present creates violations.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "additionalAccess": [
    {
      "type": "string",
      "entitlementId": "string",
      "accountId": "string"
    }
  ],
  "policyRuleFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

201

User policy scan started

400

Invalid data provided

500

Server error on save

Click for an example response

Media type: application/json

{
  "id": "string",
  "policy": {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  },
  "policyRule": {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  },
  "isSimulation": true,
  "status": "string",
  "startDate": "string",
  "completionDate": "string",
  "scanTarget": "string",
  "results": [
    {}
  ]
}

/iga/governance/policy/scan

GET

Query policy scans with the Identity Governance store based on a set of query parameters.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "policy": {
      "id": "string",
      "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
      "name": "string",
      "description": "string",
      "policyOwner": {
        "id": "string"
      },
      "policyRuleIds": [
        "string"
      ]
    },
    "policyRule": {
      "name": "string",
      "description": "string",
      "documentationUrl": "string",
      "policyRuleOwner": {
        "id": "string"
      },
      "violationOwner": {
        "id": "string"
      },
      "active": true,
      "scanTypes": {
        "preventative": true,
        "detective": true
      },
      "maxExceptionDuration": 0,
      "decisionOptions": {
        "allow": true,
        "exception": true,
        "remediate": true
      },
      "remediation": {
        "type": "string",
        "id": "string",
        "schemas": [
          "string"
        ]
      },
      "userFilter": {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      },
      "ruleDefinition": [
        {
          "operator": "AND",
          "operand": [
            {
              "operator": "EQUALS",
              "operand": {
                "targetName": "user.userName",
                "targetValue": "ljones"
              }
            },
            {
              "operator": "CONTAINS",
              "operand": {
                "targetName": "application.name",
                "targetValue": "Active Directory"
              }
            }
          ]
        }
      ],
      "workflow": {
        "type": "bpmn",
        "id": "BasicViolationProcess"
      },
      "violationOwnerType": "user",
      "id": "string",
      "ruleDefinitionTags": [
        "targetName=entitlement.displayName&targetValue=IT%20Admin",
        "targetValue=IT%20Admin&targetName=entitlement.displayName"
      ]
    },
    "isSimulation": true,
    "status": "string",
    "startDate": "string",
    "completionDate": "string",
    "scanTarget": "string",
    "results": [
      {}
    ]
  }
]

/iga/governance/policy/scan/search

POST

Query policy scan objects using a targeted search filter.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "policy": {
      "id": "string",
      "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
      "name": "string",
      "description": "string",
      "policyOwner": {
        "id": "string"
      },
      "policyRuleIds": [
        "string"
      ]
    },
    "policyRule": {
      "name": "string",
      "description": "string",
      "documentationUrl": "string",
      "policyRuleOwner": {
        "id": "string"
      },
      "violationOwner": {
        "id": "string"
      },
      "active": true,
      "scanTypes": {
        "preventative": true,
        "detective": true
      },
      "maxExceptionDuration": 0,
      "decisionOptions": {
        "allow": true,
        "exception": true,
        "remediate": true
      },
      "remediation": {
        "type": "string",
        "id": "string",
        "schemas": [
          "string"
        ]
      },
      "userFilter": {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      },
      "ruleDefinition": [
        {
          "operator": "AND",
          "operand": [
            {
              "operator": "EQUALS",
              "operand": {
                "targetName": "user.userName",
                "targetValue": "ljones"
              }
            },
            {
              "operator": "CONTAINS",
              "operand": {
                "targetName": "application.name",
                "targetValue": "Active Directory"
              }
            }
          ]
        }
      ],
      "workflow": {
        "type": "bpmn",
        "id": "BasicViolationProcess"
      },
      "violationOwnerType": "user",
      "id": "string",
      "ruleDefinitionTags": [
        "targetName=entitlement.displayName&targetValue=IT%20Admin",
        "targetValue=IT%20Admin&targetName=entitlement.displayName"
      ]
    },
    "isSimulation": true,
    "status": "string",
    "startDate": "string",
    "completionDate": "string",
    "scanTarget": "string",
    "results": [
      {}
    ]
  }
]

/iga/governance/policy/scan/{id}

GET

Get policy scan by ID.

Parameters

Name Description

id string * required

ID of the policy to scan.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

404

ID not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "policy": {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  },
  "policyRule": {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  },
  "isSimulation": true,
  "status": "string",
  "startDate": "string",
  "completionDate": "string",
  "scanTarget": "string",
  "results": [
    {}
  ]
}

/iga/governance/policy/scan/{id}

DELETE

Delete an existing policy scan object within Identity Governance.

Parameters

Name Description

id string * required

ID of the policy to scan to delete.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Delete success. Returns the removed policy scan object

400

Invalid data provided

404

ID not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "policy": {
    "id": "string",
    "scheduleId": "policySchedule1a5cefd6a67f4303b16f1b5d5740cfd1",
    "name": "string",
    "description": "string",
    "policyOwner": {
      "id": "string"
    },
    "policyRuleIds": [
      "string"
    ]
  },
  "policyRule": {
    "name": "string",
    "description": "string",
    "documentationUrl": "string",
    "policyRuleOwner": {
      "id": "string"
    },
    "violationOwner": {
      "id": "string"
    },
    "active": true,
    "scanTypes": {
      "preventative": true,
      "detective": true
    },
    "maxExceptionDuration": 0,
    "decisionOptions": {
      "allow": true,
      "exception": true,
      "remediate": true
    },
    "remediation": {
      "type": "string",
      "id": "string",
      "schemas": [
        "string"
      ]
    },
    "userFilter": {
      "operator": "AND",
      "operand": [
        {
          "operator": "EQUALS",
          "operand": {
            "targetName": "user.userName",
            "targetValue": "ljones"
          }
        },
        {
          "operator": "CONTAINS",
          "operand": {
            "targetName": "application.name",
            "targetValue": "Active Directory"
          }
        }
      ]
    },
    "ruleDefinition": [
      {
        "operator": "AND",
        "operand": [
          {
            "operator": "EQUALS",
            "operand": {
              "targetName": "user.userName",
              "targetValue": "ljones"
            }
          },
          {
            "operator": "CONTAINS",
            "operand": {
              "targetName": "application.name",
              "targetValue": "Active Directory"
            }
          }
        ]
      }
    ],
    "workflow": {
      "type": "bpmn",
      "id": "BasicViolationProcess"
    },
    "violationOwnerType": "user",
    "id": "string",
    "ruleDefinitionTags": [
      "targetName=entitlement.displayName&targetValue=IT%20Admin",
      "targetValue=IT%20Admin&targetName=entitlement.displayName"
    ]
  },
  "isSimulation": true,
  "status": "string",
  "startDate": "string",
  "completionDate": "string",
  "scanTarget": "string",
  "results": [
    {}
  ]
}

/iga/governance/user/violation

GET

Query the signed-in user’s violation objects.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
]

/iga/governance/violation

GET

Query the violation objects.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
]

/iga/governance/violation

POST

Creates a violation with the given body.

Parameters

Name Description

_action string * required

Action to be taken. The available values are create and duplicate.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
]

/iga/governance/violation/allow

POST

Once a phase (or phases) have chosen to allow a violation, close and complete the violations with the outcome of allow.

Parameters

Name Description

waitForCompletion string

Specifies if you should wait the completion of the scan before returning. true waits; false or not present returns after scan creation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "ids": [
    "e9e4d260-1b55-4331-8468-5824344b8bc3",
    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
  ],
  "comment": "Justification for this action."
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to allow violations

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "message": "Action 'allow' complete.",
  "idsNotActedOn": [
    {
      "id": "09e01632-b22f-407b-bacb-aa1e2cac8214",
      "errorMessage": "This violation is not eligible to be allowed.",
      "errorCode": 400
    }
  ]
}

/iga/governance/violation/cancel-exception

POST

As a user who can take action on violations, cancel existing exceptions, reverting the violations to in-progress.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "ids": [
    "e9e4d260-1b55-4331-8468-5824344b8bc3",
    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
  ],
  "comment": "Justification for this action."
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to comment violations

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "message": "Action 'allow' complete.",
  "idsNotActedOn": [
    {
      "id": "09e01632-b22f-407b-bacb-aa1e2cac8214",
      "errorMessage": "This violation is not eligible to be allowed.",
      "errorCode": 400
    }
  ]
}

/iga/governance/violation/comment

POST

As a user who can take action on violations, add a comment to the violation objects.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "ids": [
    "e9e4d260-1b55-4331-8468-5824344b8bc3",
    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
  ],
  "comment": "Justification for this action."
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to comment violations

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "message": "Action 'allow' complete.",
  "idsNotActedOn": [
    {
      "id": "09e01632-b22f-407b-bacb-aa1e2cac8214",
      "errorMessage": "This violation is not eligible to be allowed.",
      "errorCode": 400
    }
  ]
}

/iga/governance/violation/exception

POST

As a user who can take action on violations, grant an exception to the violating access.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "ids": [
    "e9e4d260-1b55-4331-8468-5824344b8bc3",
    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
  ],
  "comment": "Justification for this action.",
  "exceptionExpirationDate": "2024-04-24T20:36:14+00:00"
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to comment violations

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "message": "Action 'allow' complete.",
  "idsNotActedOn": [
    {
      "id": "09e01632-b22f-407b-bacb-aa1e2cac8214",
      "errorMessage": "This violation is not eligible to be allowed.",
      "errorCode": 400
    }
  ]
}

/iga/governance/violation/reassign

POST

As a user who can take action on violations, edit the list of active actors on the violation tasks.

Parameters

Name Description

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "ids": [
    "e9e4d260-1b55-4331-8468-5824344b8bc3",
    "01d8ccf0-e132-49f1-9c82-c52a6fea0154"
  ],
  "comment": "Justification for this action.",
  "updatedActors": [
    {
      "id": {
        "value": "string",
        "isExpression": true
      },
      "permissions": {
        "approve": true,
        "reject": true,
        "reassign": true,
        "modify": true,
        "comment": true,
        "allow": true,
        "exception": true,
        "remediate": true
      }
    }
  ]
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to comment violations

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "message": "Action 'allow' complete.",
  "idsNotActedOn": [
    {
      "id": "09e01632-b22f-407b-bacb-aa1e2cac8214",
      "errorMessage": "This violation is not eligible to be allowed.",
      "errorCode": 400
    }
  ]
}

/iga/governance/violation/search

POST

Query the violation objects using a targeted search filter.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

The sort property values of the last entry to continue searching from. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
]

/iga/governance/user/violation/search

POST

Query the signed-in user’s violation object using a targeted search filter.

Parameters

Name Description

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_searchAfter string

The sort property values of the last entry to continue searching from. Comma-separated for multiple values.

_queryFilter string

Search query filter.

actorStatus string

Actor status to search. Comma-separated for multiple values. For example: active, inactive, or active, inactive.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

!_searchAfter string !The sort property values of the last entry to continue searching from. Comma-separated for multiple values.

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: `application/json`å

[
  {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
]

/iga/governance/violation/{id}

GET

Query the contents of a single violation object.

Parameters

Name Description

id string * required

ID of the violation.

resolveSchemas string

When true, enrich the policyRule remediation schemas property with the full schema objects rather than just the IDs.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

404

Violation doesn’t exist

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}

PUT

Updates a given violation with the given body.

Parameters

Name Description

id string * required

ID of the violation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "targetFilter": {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
}

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

[
  {
    "id": "string",
    "user": {},
    "policyRule": {},
    "decision": {
      "status": "pending",
      "decision": "exception",
      "comments": [
        {}
      ],
      "events": {
        "assignment": {},
        "expiration": {},
        "escalation": {},
        "reminder": {}
      },
      "actors": {
        "active": [
          {}
        ],
        "inactive": [
          {}
        ]
      },
      "completionDate": "string",
      "completedBy": {}
    }
  }
]

/iga/governance/violation/{id}

DELETE

Deletes a violation with a given ID.

Parameters

Name Description

id string * required

ID of the violation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example response

Media type: application/json

"string"

/iga/governance/violation/{id}/allow

POST

Once a phase (or phases) have chosen to allow a violation, close and complete the violation with an outcome of allow.

Parameters

Name Description

id string * required

ID of the violation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to allow violation

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/#{id}/comment

POST

As an actor on a violation, add a comment to a violation object.

Parameters

Name Description

id string * required

ID of the violation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "comment": "string"
}

Responses

Code Description

201

Comment added

400

Invalid request

403

User is not authorized to comment on violation

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/remediate

POST

Once a phase (or phases) have chosen to remediate a violation, complete the violation with an outcome of remediate and continue the workflow on to either the automated or manual process for fulfilling the remediation.

Parameters

Name Description

id string * required

ID of the violation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "id": "string"
}

Responses

Code Description

200

Remediation process begun

400

Invalid request

403

User is not authorized to remediate violation

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/remediation/status/{status}

POST

For violations with an outcome of remediate, allow the remediationStatus key to be updated. For example, from in-progress to complete and finalize the violation when appropriate.

Parameters

Name Description

id string * required

ID of the violation.

status string * required

Status to update remediationStatus to.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{}

Responses

Code Description

200

400

Invalid request

404

Violation ID not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{violationId}/phases

POST

Add a phase to a violation. A phase is a task that must be completed to move the violation forward, which depends on the task configuration, such as expiration, assignee, notifications, and others. For type=violation, the task allows users to select allow or remediate.

Parameters

Name Description

violationId string * required

ID of the violation.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "phase": {
    "phase": {
      "name": "ManagerApproval",
      "type": "request",
      "status": "in-progress",
      "decision": "approve",
      "startDate": "2023-09-10T12:00:00+00:00",
      "events": {
        "assignment": {
          "notification": "requestAssigned"
        },
        "reassign": {
          "notification": "requestReassigned"
        },
        "expiration": {
          "date": "2023-09-04T12:00:00+00:00",
          "notification": "requestExpired",
          "action": "reassign",
          "actors": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              }
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              }
            }
          ]
        },
        "escalation": {
          "date": "2023-09-04T12:00:00+00:00",
          "notification": "requestEscalated",
          "actors": [
            {
              "id": "875bbc8f-e868-451f-a690-453473205ca1"
            }
          ],
          "frequency": 3
        },
        "reminder": {
          "date": "2023-09-04T12:00:00+00:00",
          "notification": "requestReminder",
          "frequency": 3
        }
      },
      "justification": "string",
      "workflowTaskId": "1025",
      "completedBy": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "completionDate": "2023-09-10T12:00:00+00:00"
    }
  },
  "actors": [
    {
      "id": {
        "value": "string",
        "isExpression": true
      },
      "permissions": {
        "approve": true,
        "reject": true,
        "reassign": true,
        "modify": true,
        "comment": true,
        "allow": true,
        "exception": true,
        "remediate": true
      }
    }
  ]
}

Responses

Code Description

200

400

Invalid request

404

Violation not found

500

Server error

/iga/governance/violation/{id}/phases/{phaseName}/allow

POST

As an actor on a violation, allow the user to continue to violate the defined rule in perpetuity.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "comment": "string"
}

Responses

Code Description

200

400

Invalid request

403

User not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/cancel-exception

POST

As an actor on a violation, cancel an existing exception, reverting the violation to in-progress.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "comment": "string"
}

Responses

Code Description

200

Exception canceled

400

Invalid request

403

User is not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/comment

POST

Add a comment to a violation object.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "comment": "string"
}

Responses

Code Description

200

Comment added

400

Invalid request

403

User is not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/exception

POST

As an actor on a violation, grant an exception to the violating access.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "exceptionExpirationDate": "string",
  "comment": "string"
}

Responses

Code Description

200

Exception granted

400

Invalid request

401

User is not authorized to make exception on violation

403

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/reassign

POST

As an actor on a violation, edit the actors and permissions on a violation task.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * string

Media type: application/json

{
  "updatedActors": [
    {
      "id": {
        "value": "string",
        "isExpression": true
      },
      "permissions": {
        "approve": true,
        "reject": true,
        "reassign": true,
        "modify": true,
        "comment": true,
        "allow": true,
        "exception": true,
        "remediate": true
      }
    }
  ]
}

Responses

Code Description

200

Actors reassigned

400

Invalid request

403

User is not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/remediate

POST

As an actor on a violation, choose to remediate the access, kicking off the remediation workflow assigned to the violation.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body * required

Media type: application/json

{
  "id": "string"
}

Responses

Code Description

200

Remediation process begun

400

Invalid request

403

User is not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/complete

POST

As an actor on a manual provisioning task to handle the violation remediation, mark the action as completed.

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "comment": "string"
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

/iga/governance/violation/{id}/phases/{phaseName}/cancel

POST

As an actor on a manual provisioning task to handle the violation remediation, mark the action as canceled (not completed).

Parameters

Name Description

id string * required

ID of the violation.

phaseName string * required

Name of the phase.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

Media type: application/json

{
  "comment": "string"
}

Responses

Code Description

200

400

Invalid request

403

User is not authorized to take action

404

Violation not found

500

Server error

Click for an example response

Media type: application/json

{
  "id": "string",
  "user": {},
  "policyRule": {},
  "decision": {
    "status": "pending",
    "decision": "exception",
    "comments": [
      {}
    ],
    "events": {
      "assignment": {},
      "expiration": {},
      "escalation": {},
      "reminder": {}
    },
    "actors": {
      "active": [
        {}
      ],
      "inactive": [
        {}
      ]
    },
    "completionDate": "string",
    "completedBy": {}
  }
}

Task

Endpoints for fulfillment tasks.

URI HTTP
method Description

/iga/governance/user/{userId}/tasks

GET

Get the tasks for which the authenticated user has permissions to view.

Parameters

Name Description

userId string * required

Unique identifier of the user.

Type string

The type of task to filter by. The available values are request, violation, and fulfillment

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "requester": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "requestType": "applicationGrant",
      "request": {
        "common": {
          "startDate": "2023-09-11T12:00:00+00:00",
          "endDate": "2023-12-11T12:00:00+00:00",
          "justification": "I need this access to start working on a new project.",
          "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
          "isDraft": false,
          "requestIdPrefix": "REQ"
        }
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "entitlementOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "roleOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "decision": {
        "status": "in-progress",
        "decision": "approved",
        "outcome": "provisioned",
        "startDate": "2023-09-10T12:00:00+00:00",
        "completionDate": "2023-09-10T12:00:00+00:00",
        "comments": [
          {
            "user": {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith"
            },
            "comment": "I need to find out more information before approving.  Will check back later.",
            "action": "comment",
            "timeStamp": "2023-09-11T12:00:00+00:00",
            "phase": "ManagerApproval"
          }
        ],
        "actors": {
          "active": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ],
          "inactive": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ]
        },
        "phases": [
          {
            "phase": {
              "name": "ManagerApproval",
              "type": "request",
              "status": "in-progress",
              "decision": "approve",
              "startDate": "2023-09-10T12:00:00+00:00",
              "events": {
                "assignment": {
                  "notification": "requestAssigned"
                },
                "reassign": {
                  "notification": "requestReassigned"
                },
                "expiration": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestExpired",
                  "action": "reassign",
                  "actors": [
                    {
                      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                      "userName": "asmith",
                      "mail": "asmith01@forgerock.com",
                      "givenName": "Aaron",
                      "sn": "Smith",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    },
                    {
                      "id": "string",
                      "name": "string",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    }
                  ]
                },
                "escalation": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestEscalated",
                  "actors": [
                    {
                      "id": "875bbc8f-e868-451f-a690-453473205ca1"
                    }
                  ],
                  "frequency": 3
                },
                "reminder": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestReminder",
                  "frequency": 3
                }
              },
              "justification": "string",
              "workflowTaskId": "1025",
              "completedBy": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "completionDate": "2023-09-10T12:00:00+00:00"
            }
          }
        ]
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

/iga/governance/user/{userId}/tasks

POST

Get the tasks for which the authenticated user has permissions to view. The targetFilter property in the payload can be used to filter requests based on the desired criteria.

Parameters

Name Description

userId string * required

Unique identifier of the user.

Type string

The type of task to filter by. The available values are request, violation, and fulfillment

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

userId string * string

Unique identifier of the user.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Request body

{
  "targetFilter": {
    "operator": "AND",
    "operand": [
      {
        "operator": "EQUALS",
        "operand": {
          "targetName": "user.userName",
          "targetValue": "ljones"
        }
      },
      {
        "operator": "CONTAINS",
        "operand": {
          "targetName": "application.name",
          "targetValue": "Active Directory"
        }
      }
    ]
  }
}

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "id": "string",
      "requester": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "requestType": "applicationGrant",
      "request": {
        "common": {
          "startDate": "2023-09-11T12:00:00+00:00",
          "endDate": "2023-12-11T12:00:00+00:00",
          "justification": "I need this access to start working on a new project.",
          "externalRequestId": "c926c10f-300a-4222-876f-348e0ca07d63",
          "isDraft": false,
          "requestIdPrefix": "REQ"
        }
      },
      "application": {
        "authoritative": false,
        "connectorId": "AzureAD",
        "description": "AzureAD application",
        "fr": {
          "realm": "alpha"
        },
        "icon": "https://example.forgeblocks.com/platform/img/microsoft.8a785075.svg",
        "id": "a09030e6-f4d1-4442-9c7c-1a51ce4683c1",
        "mappingNames": [
          "systemAzureadUser_managedAlpha_user",
          "systemAzureadDirectoryrole_managedAlpha_assignment",
          "systemAzuread__group___managedAlpha_assignment",
          "managedAlpha_user_systemAzureadUser"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2023-08-31T21:23:35.809Z"
        },
        "name": "AzureAD",
        "templateName": "azure.ad",
        "templateVersion": "2.0",
        "objectTypes": [
          {
            "name": "__ACCOUNT__"
          },
          {
            "name": "__GROUP__",
            "accountAttribute": "memberOf"
          }
        ]
      },
      "applicationOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "entitlementOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "roleOwner": [
        {
          "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
          "userName": "asmith",
          "mail": "asmith01@forgerock.com",
          "givenName": "Aaron",
          "sn": "Smith"
        }
      ],
      "user": {
        "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
        "userName": "asmith",
        "mail": "asmith01@forgerock.com",
        "givenName": "Aaron",
        "sn": "Smith"
      },
      "decision": {
        "status": "in-progress",
        "decision": "approved",
        "outcome": "provisioned",
        "startDate": "2023-09-10T12:00:00+00:00",
        "completionDate": "2023-09-10T12:00:00+00:00",
        "comments": [
          {
            "user": {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith"
            },
            "comment": "I need to find out more information before approving.  Will check back later.",
            "action": "comment",
            "timeStamp": "2023-09-11T12:00:00+00:00",
            "phase": "ManagerApproval"
          }
        ],
        "actors": {
          "active": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ],
          "inactive": [
            {
              "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
              "userName": "asmith",
              "mail": "asmith01@forgerock.com",
              "givenName": "Aaron",
              "sn": "Smith",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            },
            {
              "id": "string",
              "name": "string",
              "permissions": {
                "approve": true,
                "comment": true,
                "modify": true,
                "reassign": true,
                "reject": true
              },
              "phase": "ManagerApproval"
            }
          ]
        },
        "phases": [
          {
            "phase": {
              "name": "ManagerApproval",
              "type": "request",
              "status": "in-progress",
              "decision": "approve",
              "startDate": "2023-09-10T12:00:00+00:00",
              "events": {
                "assignment": {
                  "notification": "requestAssigned"
                },
                "reassign": {
                  "notification": "requestReassigned"
                },
                "expiration": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestExpired",
                  "action": "reassign",
                  "actors": [
                    {
                      "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                      "userName": "asmith",
                      "mail": "asmith01@forgerock.com",
                      "givenName": "Aaron",
                      "sn": "Smith",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    },
                    {
                      "id": "string",
                      "name": "string",
                      "permissions": {
                        "approve": true,
                        "comment": true,
                        "modify": true,
                        "reassign": true,
                        "reject": true
                      }
                    }
                  ]
                },
                "escalation": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestEscalated",
                  "actors": [
                    {
                      "id": "875bbc8f-e868-451f-a690-453473205ca1"
                    }
                  ],
                  "frequency": 3
                },
                "reminder": {
                  "date": "2023-09-04T12:00:00+00:00",
                  "notification": "requestReminder",
                  "frequency": 3
                }
              },
              "justification": "string",
              "workflowTaskId": "1025",
              "completedBy": {
                "id": "a3ad098f-93b1-47dc-a31d-f37bbb4c15d1-160761",
                "userName": "asmith",
                "mail": "asmith01@forgerock.com",
                "givenName": "Aaron",
                "sn": "Smith"
              },
              "completionDate": "2023-09-10T12:00:00+00:00"
            }
          }
        ]
      },
      "metadata": {
        "createdDate": "2024-01-11T12:00:00+00:00",
        "modifiedDate": "2024-04-24T12:00:00+00:00"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

User

Endpoint for a user’s grants and recommendations.

URI HTTP
method Description

/iga/governance/user/{userId}/privileges

GET

Get the privileges a user currently has.

The endpoint returns the Identity Governance-related authorization details for the authenticated users and includes the following information:

userInfo: Displayable information of the user.
owner: Identity Governance entities for which the user is an owner.
groups: Groups the user belongs to (via their authorization token).
permissions: List of Identity Governance permissions that apply to the user
scopes: List of scopes that currently apply to this user.

Parameters

Name Description

userId string * required

Unique identifier of the user.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example to get a user’s privileges

Media type: application/json

GET iga/governance/user/{userId}/privileges
{
   "userInfo": {
       "userName": "christian.marnell",
       "id": "bfd816e1-b9fe-4ea9-90f5-45e2e906cdfc",
       "givenName": "Christian",
       "sn": "Marnell",
       "mail": "christian.marnell@example.com"
   },
   "owner": {
       "certification": false,
       "entitlement": true,
       "policy": false
   },
   "groups": [],
   "permissions": [
       "createEntitlement",
       "modifyEntitlement"
   ],
   "scopes": [
       "e8abd5fb-64c2-493d-8415-e7a0e4a35984"
   ]
}

/iga/governance/user/{userId}/grants

GET

Get the grants a user currently has.

Parameters

Name Description

userId string * required

Unique identifier of the user.

queryString string * required

Search term. Searches against display names of the grant being targeted.

grantType string

Type of grant being searched for. The available values are entitlement, account, and role

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

400

Invalid request

500

Server error

Click for an example to get a user’s privileges

Media type: application/json

{
  "result": [
    {
      "account": {
        "calendar_integration": "1",
        "user_name": "guillermo.frohich",
        "sys_updated_on": "2025-01-02 21:29:47",
        "__user_group_ids__": [
          "0a52d3dcd7011200f2d224837e6103f2"
        ],
        "title": "Chief Financial Officer",
        "sys_class_name": "sys_user",
        "notification": "2",
        "sys_updated_by": "developer.program.hop@snc",
        "sys_created_on": "2024-11-30 15:04:03",
        "sys_domain": "global",
        "__NAME__": "62526fa1d701120035ae23c7ce6103c6",
        "vip": false,
        "department": "221f3db5c6112284009f4becd3039cc9",
        "first_name": "Guillermo",
        "sys_created_by": "admin",
        "email": "guillermo.frohlich@example.com",
        "__user_role_ids__": [
          "cc6f85b5ebc31300a210a2505206fec0",
          "8a454be00a0a0b8c00de7dae26869165"
        ],
        "locked_out": "false",
        "sys_mod_count": "3",
        "active": "true",
        "last_name": "Frohlich",
        "time_zone": "Europe/London",
        "name": "Guillermo Frohlich",
        "_id": "62526fa1d701120035ae23c7ce6103c6"
      },
      "application": {
        "name": "TargetApp",
        "description": "Testing 3",
        "objectTypes": [
          {
            "name": "Role",
            "accountAttribute": "__user_role_ids__"
          },
          {
            "name": "Group",
            "accountAttribute": "__user_group_ids__"
          },
          {
            "name": "User"
          }
        ]
      },
      "catalog": {
        "id": "16758965550a4cf40f25c0f6a8bb7a5b347292785141e7f4e59644f77cf0811010cd55da8f1f27e3401676ada5b57734682167d3ef5fb26c98acb660390f44b4"
      },
      "compositeId": "12b505cfad20126bf03f49106aeeff3d85a9cb8fe4f882e5422e408a82d85a75dcb78ef282cc90a32259c64b0a4990eb55cec5adfbf22817aabe43152c2e183",
      "descriptor": {
        "idx": {
          "/entitlement": {
            "displayName": "interaction_agent"
          },
          "/account": {
            "displayName": "guillermo.frohich"
          }
        }
      },
      "entitlement": {
        "can_delegate": true,
        "sys_package": "7db62d76e806121087debb3e47d14f20",
        "grantable": true,
        "description": "A required role to perform interaction agent and interaction queue transfer",
        "sys_name": "interaction_agent",
        "sys_scope": "global",
        "__NAME__": "b523f1d037001300a213a7f07e41f15b",
        "elevated_privilege": false,
        "_id": "b523f1d037001300a213a7f07e41f15b",
        "sys_class_name": "sys_user_role"
      },
      "glossary": {
        "idx": {
          "/entitlement": {
            "entitlementOwner": "managed/user/e8e8636e-33ad-4764-8c13-feba9a973bb1"
          },
          "/application": {
            "requestable": true
          }
        },
        "types": [
          {
            "attrKey": "/assignment",
            "modified": "2025-02-04T14:22:27.287176855Z",
            "type": "entityType/id/realm"
          },
          {
            "attrKey": "/application",
            "modified": "2025-02-03T22:08:38.874Z",
            "type": "entityType/id/realm"
          }
        ]
      },
      "item": {
        "type": "entitlementGrant",
        "objectType": "Role"
      },
      "keys": {
        "type": "entitlementGrant",
        "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219",
        "applicationId": "825c6e15-b860-4be4-bef9-55d28a0cd2de",
        "accountId": "system/TargetApp/User/62526fa1d701120035ae23c7ce6103c6",
        "entitlementId": "system/TargetApp/Role/b523f1d037001300a213a7f07e41f15b"
      },
      "relationship": {
        "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-60718",
        "properties": {
          "grantTypes": [
            {
              "id": "55f1f1d0-fc1f-4d69-a550-e6f354aefb5e-60718",
              "grantType": "recon"
            }
          ]
        }
      },
      "user": {
        "_rev": "ffe3f7ed-1022-425c-845e-210b35f392e8-20187",
        "accountStatus": "active",
        "assignedDashboard": [
          "TargetApp"
        ],
        "cn": "Guillermo Frohlich",
        "fr": {
          "realm": "alpha"
        },
        "givenName": "Guillermo",
        "id": "ff1d2def-b44e-468f-9079-3b5a2a7dd219",
        "mail": "guillermo.frohlich@example.com",
        "metadata": {
          "created": "2025-01-22T18:17:03.931Z",
          "entityType": "/openidm/managed/user",
          "version": 8
        },
        "scopes": {
          "view": [
            {
              "id": "e8abd5fb-64c2-493d-8415-e7a0e4a35984",
              "timestamp": "2025-01-28T14:45:52.119497214Z"
            }
          ]
        },
        "sn": "Frohlich",
        "userId": "ff1d2def-b44e-468f-9079-3b5a2a7dd219",
        "userName": "guillermo.frohich"
      },
      "metadata": {
        "modifiedDate": "2025-02-04T14:30:59.277Z",
        "createdDate": "2025-01-22T18:16:03.576225515Z"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

/iga/governance/user/{userId}/recommendations

GET

Get the access recommendations for a given user.

Parameters

Name Description

userId string * required

Unique identifier of the user.

_fields string

List of fields to return for each entry in the response result. Comma-separated for multiple values.

_pageSize integer

Number of response result objects to return.

_pagedResultsOffset integer

Offset number of the record from which to start the paginated results.

_sortKeys string

Property on which to sort the results.

_sortDir string

Direction of sort: asc, desc.

_sortType string

Type of sort value. Special types of fields need to use this parameter to sort properly. Currently, the supported special types are date and integer. This can be omitted for other fields.

_searchAfter string

Sort property values of the last entry to which continue searching. Comma-separated for multiple values.

_queryFilter string

Search query filter.

Accept-API-Version string

API version to use for the request. If no value is provided, the latest version of API is used to process the request.

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "prediction": {
        "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b",
        "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e",
        "confidence": 0.75,
        "rule": [
          "12_CHIEF_YES_NO_Yes",
          "12_USR_EMP_TYPE_Employee",
          "14_USR_MANAGER_ID_benjamin.rosenfield",
          "19_USR_DEPARTMENT_NAME_Customer Operations South"
        ],
        "freq": 5,
        "freqUnion": 4
      },
      "glossary": {
        "idx": {
          "/application": {
            "requestable": true,
            "testInt": "0"
          }
        },
        "types": [
          {
            "attrKey": "/application",
            "modified": "2024-06-05T22:12:51.892Z",
            "type": "entityType/id/realm"
          }
        ]
      },
      "descriptor": {
        "idx": {
          "/entitlement": {
            "displayName": "Customer Support - QA"
          }
        }
      },
      "entitlement": {
        "__NAME__": "Customer Support - QA",
        "_id": "ac77bdcb-659f-4276-beb9-14604d62986e",
        "displayName": "Customer Support - QA",
        "id": "ac77bdcb-659f-4276-beb9-14604d62986e",
        "mailEnabled": false,
        "securityEnabled": true
      },
      "assignment": {
        "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21526",
        "attributes": [
          {
            "name": "memberOf",
            "value": [
              "ac77bdcb-659f-4276-beb9-14604d62986e"
            ]
          }
        ],
        "description": "ac77bdcb-659f-4276-beb9-14604d62986e",
        "fr": {
          "realm": "alpha"
        },
        "id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e",
        "mapping": "managedAlpha_user_systemTargettestigaautom1User",
        "metadata": {
          "entityType": "/openidm/managed/assignment",
          "created": "2024-04-17T00:50:43.452Z"
        },
        "name": "Customer Support - QA",
        "type": "__ENTITLEMENT__"
      },
      "application": {
        "_rev": "c528ae0a-b382-424a-8af1-f08c11af5abc-21516",
        "authoritative": false,
        "connectorId": "Targettestigaautom1",
        "description": "Target AD App",
        "fr": {
          "realm": "alpha"
        },
        "icon": "",
        "id": "bb97f388-8c11-4314-9691-22a9f1a799df",
        "mappingNames": [
          "systemTargettestigaautom1User_managedAlpha_user",
          "systemTargettestigaautom1__group___managedAlpha_assignment",
          "managedAlpha_user_systemTargettestigaautom1User",
          "systemTargettestigaautom1Directoryrole_managedAlpha_assignment"
        ],
        "metadata": {
          "entityType": "/openidm/managed/application",
          "created": "2024-06-05T22:12:40.911Z"
        },
        "name": "Targettestigaautom1",
        "templateName": "azure.ad",
        "templateVersion": "2.2"
      },
      "catalog": {
        "id": "81cbcb5edbb422f68b5407ccf0987714c6418051fffdb132649eafaa4b436d02f4402a9820d48af843230186cfb033ec4e21431778ef1796fef2ad47423957e0"
      },
      "keys": {
        "usr_id": "44aac3af-23ae-47ad-a760-e5f4d94da54b",
        "ent_id": "system_Targettestigaautom1___GROUP___ac77bdcb-659f-4276-beb9-14604d62986e"
      },
      "compositeId": "bae206ad1fa95d701344e2a7050cd2ee54e607d4fe1da2cdcd2b07b6522b5deafb1ab03326d95f18b6ca659fa0a84539ce3cb54a80ddbf6f7284e73e4caec274",
      "latestCreationTime": 1731096658.93
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

Workflow

To use the iga/governance/workflow and iga/governance/audit endpoints, your authorization token must have the following scope:

fr:idc:analytics.*

This is a temporary requirement and will be removed in a future release.

URI HTTP
method Description

/iga/governance/workflow

GET

Get the workflow definitions.

Parameters

Name Description

_searchAfter string

Elasticsearch after key. Used for pageNumber.

_pagedResultsOffset string

Offset number of the record from which to start the paginated results.

_pageSize string

Number of documents to return.

_queryString string

String to filter the workflows. Matches the workflow displayName, description, and name keys.

Responses

Code Description

201

Creation success. Returns the saved workflow object.

/iga/governance/workflow

Post

Create and/or publish workflow definitions.

Parameters

Name Description

_action string * required

Action to be performed for the workflow endpoint. The available values are create, validate, publish, and execute.

Request body * required

Media type: application/json

{
  "id": "string",
  "name": "string",
  "displayName": "string",
  "description": "string",
  "type": "provisioning",
  "steps": [
    {
      "name": "string",
      "displayName": "string",
      "type": "scriptTask",
      "scriptTask": {
        "language": "javascript",
        "gatewayType": "inclusive",
        "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}",
        "nextStep": [
          {
            "condition": "string",
            "outcome": "string",
            "step": "string"
          }
        ]
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    }
  ]
}

Responses

Code Description

200

400

Invalid data provided.

500

Server error on save.

Click for an example response

Media type: application/json

{}

/iga/governance/workflow/{id}/{status}

GET

Get the workflow definition.

Parameters

Name Description

id string * required

ID of the workflow.

status string * required

Status of the workflow.

Responses

Code Description

200

400

Bad request

404

Workflow with ID wasn’t found

500

Internal service error

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "displayName": "string",
  "description": "string",
  "type": "provisioning",
  "steps": [
    {
      "name": "string",
      "displayName": "string",
      "type": "scriptTask",
      "scriptTask": {
        "language": "javascript",
        "gatewayType": "inclusive",
        "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}",
        "nextStep": [
          {
            "condition": "string",
            "outcome": "string",
            "step": "string"
          }
        ]
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    }
  ]
}

/iga/governance/workflow/{id}/{status}

DELETE

Delete the workflow definition. If the status is published, it will try to delete the workflow model and process the definition in IDM.

Parameters

Name Description

id string * required

ID of the workflow.

status string * required

Status of the workflow.

Responses

Code Description

200

Click for an example response

Media type: application/json

{
  "result": [
    {
      "role": {
        "_rev": "9b32dc1c-c0fe-4cf6-a24c-2b9374dd15ad-820870",
        "description": "Test",
        "fr": {
          "realm": "alpha"
        },
        "id": "7136a3c4-0c12-488a-8cfd-2fd71a24e4bd",
        "metadata": {
          "entityType": "/openidm/managed/role",
          "created": "2024-09-09T15:28:28.887Z"
        },
        "name": "Approver Role"
      },
      "user": {
        "_rev": "9b32dc1c-c0fe-4cf6-a24c-2b9374dd15ad-1200974",
        "accountStatus": "active",
        "cn": "Ariela Stonuary",
        "custom_debugObj": {
          "task-started": "2024-09-04T21:08:01.019057006"
        },
        "custom_debugObjTwo": {
          "task-completed": "2024-09-04T21:08:01.290865442"
        },
        "description": "updateNow1",
        "fr": {
          "realm": "alpha"
        },
        "givenName": "Ariela",
        "id": "e8224d8b-a5b6-4120-83d4-fd9b69844aca",
        "mail": "Ariela@IGATestQA.onmicrosoft.com",
        "metadata": {
          "created": "2024-09-06T15:31:18.399Z",
          "entityType": "/openidm/managed/user",
          "version": 7
        },
        "preferences": {
          "marketing": false,
          "updates": false
        },
        "sn": "Stonuary",
        "userId": "e8224d8b-a5b6-4120-83d4-fd9b69844aca",
        "userName": "Ariela@IGATestQA.onmicrosoft.com"
      },
      "catalog": {
        "id": "87b51036e699e772f9e4f81617f5e3adb6c012974a594e6aa4bc50254419be7ccf7d26c85b42df8fa7147798a75966cad432528eef9e9f32f4f78c4a4607c4c"
      },
      "compositeId": "e546e458a04626344e478139309b21f35fcba24e1f9429a19c769897d3928c66408cdd50f9e08170fb810751bd70ca929840c894e346d11126c57326e7d9a33d",
      "glossary": {
        "idx": {
          "/role": {
            "requestable": true,
            "roleOwner": "managed/user/153e48df-12fa-4499-9078-4bdf5c62c3ea"
          }
        },
        "types": [
          {
            "attrKey": "/role",
            "modified": "2024-09-12T12:51:42.108Z",
            "type": "entityType/id/realm"
          }
        ]
      },
      "item": {
        "type": "roleMembership"
      },
      "keys": {
        "type": "roleMembership",
        "roleId": "7136a3c4-0c12-488a-8cfd-2fd71a24e4bd",
        "userId": "e8224d8b-a5b6-4120-83d4-fd9b69844aca"
      },
      "relationship": {
        "id": "7065a955-275f-4e70-969b-4cf19c479af6-8621418",
        "conditional": false
      },
      "metadata": {
        "modifiedDate": "2024-09-12T12:57:46.847Z",
        "createdDate": "2024-09-03T13:08:13.306772183Z"
      }
    }
  ],
  "searchAfterKey": [
    "a321329c-a7e6-47ad-8349-99b6e38f9a59"
  ],
  "totalCount": 0,
  "resultCount": 0
}

/iga/governance/workflow/{id}

PUT

Update or publish the workflow definition.

Parameters

Name Description

id string * required

ID of the workflow.

Request body * required

{
  "id": "string",
  "name": "string",
  "displayName": "string",
  "description": "string",
  "type": "provisioning",
  "steps": [
    {
      "name": "string",
      "displayName": "string",
      "type": "scriptTask",
      "scriptTask": {
        "language": "javascript",
        "gatewayType": "inclusive",
        "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}",
        "nextStep": [
          {
            "condition": "string",
            "outcome": "string",
            "step": "string"
          }
        ]
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    }
  ]
}

Responses

Code Description

200

400

Bad request

404

Workflow with ID wasn’t found

500

Internal service error

Click for an example response

Media type: application/json

{
  "id": "string",
  "name": "string",
  "displayName": "string",
  "description": "string",
  "type": "provisioning",
  "steps": [
    {
      "name": "string",
      "displayName": "string",
      "type": "scriptTask",
      "scriptTask": {
        "language": "javascript",
        "gatewayType": "inclusive",
        "script": "logger.info(\"Auto-Deprovisioning\");\n\nvar content = execution.getVariables();\nvar requestId = content.get('id');\nvar failureReason = null;\n\ntry {\n var requestObj = openidm.action('iga/governance/requests/' + requestId, 'GET', {}, {});\n logger.info(\"requestObj: \" + requestObj);\n}\ncatch (e) {\n failureReason = \"Deprovisioning failed: Error reading request with id \" + requestId;\n}\n\nif(!failureReason) {\n try {\n var request = requestObj.request;\n var payload = {\n \"roleId\": request.common.roleId,\n \"startDate\": request.common.startDate,\n \"endDate\": request.common.endDate,\n \"auditContext\": {},\n \"grantType\": \"request\"\n };\n var queryParams = {\n \"_action\": \"remove\"\n }\n\n var result = openidm.action('iga/governance/user/' + request.common.userId + '/roles' , 'POST', payload,queryParams);\n }\n catch (e) {\n failureReason = \"Deprovisioning failed: Error deprovisioning role to user \" + request.common.userId + \" for role \" + request.common.roleId + \". Error message: \" + e.message;\n }\n \n var decision = {'status': 'complete'};\n if (failureReason) {\n decision.outcome = 'not provisioned';\n decision.comment = failureReason;\n decision.failure = true;\n }\n else {\n decision.outcome = 'provisioned';\n }\n\n var queryParams = { '_action': 'update'};\n openidm.action('iga/governance/requests/' + requestId, 'POST', decision, queryParams);\n logger.info(\"Request \" + requestId + \" completed.\");\n}",
        "nextStep": [
          {
            "condition": "string",
            "outcome": "string",
            "step": "string"
          }
        ]
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    },
    {
      "name": "string",
      "displayName": "string",
      "type": "approvalTask",
      "nextStep": [
        {
          "condition": "string",
          "outcome": "string",
          "step": "string"
        }
      ],
      "actors": [
        {
          "id": {
            "value": "string",
            "isExpression": true
          },
          "permissions": {
            "approve": true,
            "reject": true,
            "reassign": true,
            "modify": true,
            "comment": true
          }
        }
      ],
      "events": {
        "assignment": {
          "notification": "string"
        },
        "reassign": {
          "notification": "string"
        },
        "reminder": {
          "notification": "string",
          "frequency": 0,
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "escalation": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          }
        },
        "expiration": {
          "notification": "string",
          "actors": [
            {
              "id": {
                "value": "string",
                "isExpression": true
              },
              "permissions": {
                "approve": true,
                "reject": true,
                "reassign": true,
                "modify": true,
                "comment": true
              }
            }
          ],
          "date": {
            "isExpression": true,
            "value": "string"
          },
          "action": "string"
        }
      }
    }
  ]
}

Evolving APIs

The APIs referenced in this section are evolving, which means they can change or become deprecated at any time.

The current evolving APIs focus on entitlements. You can find more information in Manage entitlements.

URI HTTP
method Description

/iga/governance/resource/{id}

GET

Get an entitlement by an ID.

/iga/governance/resource/search

POST

Search for a list of all entitlements that match the target filter.

/iga/governance/resource/{id}/assignments/user

GET

Gets the users assigned to a specific entitlement.

Deprecated

These endpoints are no longer being updated and might be removed in a future release.

URI HTTP
method Description

/iga/governance/resource/{id}

GET

Returns the entitlement with the provided ID.

/iga/governance/resource/search

POST

Searches for entitlements that match a query.

/iga/governance/resource/{id}/assignments/user

GET

Returns users assigned the given entitlement.

PingOne Advanced Identity Cloud

Identity Governance-related APIs

YAML file

Access token

Endpoints

Application

Certification

Access request

Access request form

Access request type

Account

Audit

Catalog

Config

Entitlement

Event

Job

Provisioning

Scope

Segregation of Duty

Task

User

Workflow

Evolving APIs

Deprecated