openapi: 3.1.0 info: title: Atomicwork Public accessManagement API version: 1.0.0 servers: - url: https://{tenant}.atomicwork.com description: Your Atomicwork tenant tags: - name: accessManagement paths: /api/v1/iga/grants: post: operationId: postapi-v-1-iga-grants summary: Create a grant for a user description: 'Create an identity grant directly without going through the IGA approval workflow. This is the primary endpoint for programmatic access provisioning — use it when an external system (HRMS, onboarding tool, compliance platform) needs to grant access to a user. **Required fields:** `user_id` and `entitlement_id`. Call `GET /iga/apps` then `GET /iga/entitlements?app_id={id}` to discover valid entitlement IDs. **Optional fields:** - `policy_id` or `policy_key` — link the grant to a specific access policy - `granted_by` — record which user or system initiated the grant - `granted_at` — backdate the grant timestamp (ISO 8601); defaults to now The grant method (how provisioning happens) is automatically derived from the entitlement''s provisioning configuration — Okta, Azure AD, JumpCloud, Google Workspace, or manual service request. Returns the created grant with its `id`, resolved `status`, `entitlement`, `app`, and provisioning details. ' tags: - accessManagement parameters: - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_postapi_v1_iga_grants_Response_200' requestBody: description: Request body for creating a grant via the public API content: application/json: schema: type: object properties: user_id: type: integer format: int64 description: The ID of the user who will receive the grant entitlement_id: type: integer format: int64 description: The ID of the entitlement to grant policy_id: type: integer format: int64 description: Optional policy ID to associate with the grant policy_key: type: string description: Optional policy key (alternative to policy_id) granted_by: type: integer format: int64 description: Optional user ID of who authorized this grant. Defaults to the API key owner. granted_at: type: string format: date-time description: Optional timestamp of when the grant was authorized. Defaults to current time. required: - user_id - entitlement_id /api/v1/iga/grants/list: post: operationId: postapi-v-1-iga-grants-list summary: List grants with filters description: "Search and list identity grants with advanced filtering. This is the primary query endpoint for building compliance dashboards, access reviews, and audit reports.\n\nSupports filtering by user, app, entitlement, status, and date ranges via request body filters. Combine multiple filters for precise queries — for example, find all active grants for a specific app that were created in the last 90 days.\n\nUse query parameters for quick filtering (`app_id`, `policy_id`, `sort_order`) or the request body for structured filter objects with operators like `IS_ANY_OF`, `IS_BETWEEN`, etc.\n\n**Pagination:** Returns paginated results with `page`, `per_page` (default 25), and `next_page_token` for cursor-based pagination. Pass `next_page_token` from the previous response to fetch the next page.\n\n**Response** includes full grant details: user info, entitlement, app, policy, provisioning status, revocation status, and timestamps.\n\n### Filtering\n\nThe request body is an **array of filter objects**. Send an empty array (`[]`) to retrieve all records.\n\nEach filter object has the following fields:\n\n| Field | Type | Description |\n|---|---|---|\n| `attribute` | string | The field to filter on (see Supported attributes below) |\n| `operator` | string | Comparison operator (see Available operators below) |\n| `values` | array | One or more `{ \"value\": }` objects |\n\n**Supported attributes**\n\n| Attribute | Typical operator | Description |\n|---|---|---|\n| `status` | `IS_ANY_OF` | Grant status **bucket** (not the raw status). Accepted values: `ACTIVE` (includes GRANTED and EXTENDED grants), `INACTIVE` (includes REVOKED and EXPIRED grants), `REVOKED` (revoked only). See the Status Reference table below. |\n| `user` | `IS_ANY_OF` | Numeric user ID of the grant recipient (the `id` field from `GET /api/v1/users`). Pass one or more user IDs to filter grants belonging to specific people. |\n| `app` | `IS_ANY_OF` | Application ID — the identity resource app the entitlement belongs to (the `id` field from `GET /api/v1/iga/apps`). Filters grants to entitlements under a specific app. |\n| `entitlement` | `IS_ANY_OF` | Entitlement ID — the specific entitlement (group, role, license, etc.) the grant was issued for. Use `GET /api/v1/iga/entitlements` to discover IDs. |\n| `entitlement_value` | `IS_ANY_OF` | Entitlement value string — filters by the human-readable entitlement value (e.g. the group name or role name) rather than the numeric ID. |\n| `granted_at` | `IS_BETWEEN` | Grant creation timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 format (`2024-01-01T00:00:00Z`). |\n| `expires_at` | `IS_BETWEEN` | Grant expiration timestamp. Same format as `granted_at`. Use this to find grants expiring within a specific window. |\n| `last_login_at` | `IS_BETWEEN` | Last login timestamp for the grant recipient. Same format as `granted_at`. Useful for identifying unused grants where the user hasn't logged in recently. |\n\n**Available operators**\n\n| Operator | Meaning |\n|---|---|\n| `EQUALS` | Exact match |\n| `NOT_EQUALS` | Exclude exact match |\n| `IN` / `IS_ANY_OF` | Match any value in the list |\n| `IS_NOT_ANY_OF` | Exclude all listed values |\n| `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` |\n| `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons |\n| `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership |\n| `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty |\n| `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match |\n\n\n**Status Reference**\n\nGrants have a raw status and a **status bucket** used for filtering:\n\n| Filter value | Raw statuses included | Description |\n|---|---|---|\n| `ACTIVE` | GRANTED, EXTENDED | Currently valid grants |\n| `INACTIVE` | REVOKED, EXPIRED | No longer valid grants |\n| `REVOKED` | REVOKED | Only manually or system-revoked grants |\n\n**Grant types** (returned in responses, not used as filter attributes)\n\n| Type | Description |\n|---|---|\n| `BIRTHRIGHT` | Automatically assigned based on user attributes (department, role, etc.) |\n| `PREAPPROVED` | Pre-approved via an access policy — no approval workflow required |\n| `APPROVED` | Granted after completing an approval workflow |\n\n**Entitlement types** (filter via the entitlements endpoint, not on grants directly)\n\n| Type | Description |\n|---|---|\n| `GROUP` | Identity provider group membership (e.g. Azure AD group, Okta group) |\n| `ROLE` | Application role assignment |\n| `LICENSE` | Software license entitlement |\n| `REPO` | Repository access |\n| `OTHER` | Custom entitlement type |\n\n**Provisioning providers** (shown in grant responses)\n\n| Provider | Description |\n|---|---|\n| `OKTA` | Okta identity provider |\n| `AZURE_AD` | Microsoft Entra ID (Azure AD) |\n| `JUMPCLOUD` | JumpCloud directory |\n| `GOOGLE_WORKSPACE` | Google Workspace |\n| `MS_INTUNE` | Microsoft Intune device management |\n| `MANUAL` | Manual provisioning (service request created for IT team) |\n\n\n**Example**\n\n```json\n[\n {\n \"attribute\": \"status\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": \"ACTIVE\"\n }\n ]\n },\n {\n \"attribute\": \"app\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 42\n }\n ]\n },\n {\n \"attribute\": \"granted_at\",\n \"operator\": \"IS_BETWEEN\",\n \"values\": [\n {\n \"value\": \"2024-01-01T00:00:00Z\"\n },\n {\n \"value\": \"2024-12-31T23:59:59Z\"\n }\n ]\n },\n {\n \"attribute\": \"user\",\n \"operator\": \"IS_ANY_OF\",\n \"values\": [\n {\n \"value\": 123\n },\n {\n \"value\": 456\n }\n ]\n }\n]\n```\n" tags: - accessManagement parameters: - name: search_key in: query description: Free-text search across grant, entitlement, and user fields. required: false schema: type: string - name: sort_order in: query description: 'Sort order for results. Common values: GRANTED_AT_DESC (newest first), GRANTED_AT_ASC (oldest first), EXPIRES_AT_ASC (expiring soonest first).' required: false schema: $ref: '#/components/schemas/ApiV1IgaGrantsListPostParametersSortOrder' - name: policy_id in: query description: Filter grants linked to a specific access policy by its UUID key. required: false schema: type: string - name: app_id in: query description: Filter grants to entitlements under a specific app (from GET /iga/apps). required: false schema: type: integer format: int64 - name: page in: query description: Page number (1-indexed). Default 1. required: false schema: type: integer default: 1 - name: per_page in: query description: Results per page (default 25, max 100). required: false schema: type: integer default: 25 - name: next_page_token in: query description: Token from previous response to fetch the next page. When provided, takes priority over page and per_page parameters. required: false schema: type: string - name: ids in: query description: Comma-separated list of grant IDs to filter by. When provided, returns only grants matching these IDs. required: false schema: type: string - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_postapi_v1_iga_grants_list_Response_200' requestBody: content: application/json: schema: type: array items: $ref: '#/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems' /api/v1/iga/grants/{grant_id}: put: operationId: putapi-v-1-iga-grants-grant-id summary: Update a grant description: 'Update an identity grant''s metadata. Use this to change the associated policy, update the grantor, or adjust grant timestamps. **Updatable fields:** - `status` — transition the grant to a new status - `policy_id` or `policy_key` — reassign the grant to a different access policy - `granted_by` — update the grantor identifier - `granted_at` — correct the grant timestamp To revoke a grant, use the dedicated `POST /iga/grants/{grant_id}/revoke` endpoint instead — it handles deprovisioning workflows. ' tags: - accessManagement parameters: - name: grant_id in: path description: '' required: true schema: type: string - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_putapi_v1_iga_grants__grant_id_Response_200' requestBody: description: Request body for updating a grant via the public API content: application/json: schema: type: object properties: status: $ref: '#/components/schemas/ApiV1IgaGrantsGrantIdPutRequestBodyContentApplicationJsonSchemaStatus' policy_id: type: integer format: int64 description: Change the policy associated with the grant policy_key: type: string description: Change the policy by key (alternative to policy_id) granted_by: type: integer format: int64 description: User ID who authorized this grant granted_at: type: string format: date-time description: When the grant was authorized /api/v1/iga/grants/{grant_id}/revoke: post: operationId: postapi-v-1-iga-grants-grant-id-revoke summary: Revoke a grant description: 'Revoke an identity grant. Supports two modes depending on whether you want the identity provider to be notified: **Immediate revocation (default):** With `skip_deprovisioning=true` (the default), the grant is marked as `REVOKED` immediately in Atomicwork. No action is taken in the identity provider — use this when you''ve already removed access externally or when the grant is informational only. **Full deprovisioning:** With `skip_deprovisioning=false`, Atomicwork triggers the full deprovisioning workflow. Depending on the entitlement''s provisioning config, this may: - Remove the user from an Azure AD or Okta group - Remove a JumpCloud or Google Workspace assignment - Create a manual service request for IT to action The response includes a `revocation_status` object with `status` (IN_PROGRESS, COMPLETED, or FAILED) and a `schedule_id` you can use to track the deprovisioning execution. **Optional fields:** - `reason` — free-text reason for the revocation (recorded in grant history) ' tags: - accessManagement parameters: - name: grant_id in: path description: The grant ID to revoke required: true schema: type: integer format: int64 - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_postapi_v1_iga_grants__grant_id__revoke_Response_200' requestBody: description: Request body for revoking a grant via the public API content: application/json: schema: type: object properties: reason: type: string description: Optional reason for revoking the grant skip_deprovisioning: type: boolean default: true description: 'When true (default), marks the grant as REVOKED immediately without triggering IDP deprovisioning. When false, triggers the full deprovisioning workflow (Azure AD/Okta group removal or service request creation). ' /api/v1/iga/grants/{grant_id}/history: get: operationId: getapi-v-1-iga-grants-grant-id-history summary: Get grant history description: 'Retrieve the complete audit trail for a specific grant. Returns a paginated timeline of all lifecycle events — creation, extensions, revocations, and expirations — with timestamps and actors. Each history entry includes: - `event_type` — one of `GRANTED`, `EXTENDED`, `REVOKED`, or `EXPIRED` - `event_at` — when the event occurred (ISO 8601) - `event_by` — who or what triggered the event **Pagination:** Supports `page`, `per_page`, and `sort_order` (CREATED_AT_ASC or CREATED_AT_DESC). Default sort is newest first. ' tags: - accessManagement parameters: - name: grant_id in: path description: The unique identifier of the grant required: true schema: type: integer format: int64 - name: page in: query description: '' required: false schema: type: integer default: 1 - name: per_page in: query description: '' required: false schema: type: integer default: 25 - name: sort_order in: query description: Sort order for grant history results required: false schema: $ref: '#/components/schemas/ApiV1IgaGrantsGrantIdHistoryGetParametersSortOrder' - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_getapi_v1_iga_grants__grant_id__history_Response_200' /api/v1/iga/apps: get: operationId: getapi-v-1-iga-apps summary: List available apps description: 'List the identity resource apps connected to your workspace. This is the starting point for grant discovery — each app represents a connected identity provider (Okta, Azure AD, JumpCloud, Google Workspace, etc.) and contains entitlements that can be granted to users. **Typical flow:** Call this endpoint first to get `app_id` values, then call `GET /iga/entitlements?app_id={id}` to browse the entitlements (groups, roles, licenses) available in each app. **Pagination:** Supports `page` and `per_page` (default 25). Use `search_key` to filter apps by name. ' tags: - accessManagement parameters: - name: search_key in: query description: Filter apps by name (partial match). required: false schema: type: string - name: page in: query description: Page number (1-indexed). Default 1. required: false schema: type: integer default: 1 - name: per_page in: query description: Results per page (default 25). required: false schema: type: integer default: 25 - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_getapi_v1_iga_apps_Response_200' /api/v1/iga/entitlements: get: operationId: getapi-v-1-iga-entitlements summary: List available entitlements description: 'List the entitlements (groups, roles, licenses, repos) available for granting. Each entitlement belongs to an app and represents a specific access right that can be assigned to a user. **Filter by app:** Pass `app_id` (from `GET /iga/apps`) to list only entitlements under a specific identity provider app. **Filter by type:** Use the `type` parameter to narrow by entitlement category: - `GROUP` — identity provider group membership (e.g. Azure AD security group, Okta group) - `ROLE` — application role assignment **Filter by status:** Use `status` to filter by publication state: - `PUBLISHED` — available for granting - `DRAFT` — not yet available **Pagination:** Supports `page`, `per_page` (default 25), and `search_key` for name search. ' tags: - accessManagement parameters: - name: search_key in: query description: Filter entitlements by name (partial match). required: false schema: type: string - name: app_id in: query description: Filter entitlements under a specific app (from GET /iga/apps). required: false schema: type: integer format: int64 - name: type in: query description: 'Filter by entitlement category: GROUP (IDP group membership), ROLE (application role).' required: false schema: $ref: '#/components/schemas/ApiV1IgaEntitlementsGetParametersType' - name: status in: query description: 'Filter by publication state: PUBLISHED (available for granting), DRAFT (not yet available).' required: false schema: $ref: '#/components/schemas/ApiV1IgaEntitlementsGetParametersStatus' - name: page in: query description: Page number (1-indexed). Default 1. required: false schema: type: integer default: 1 - name: per_page in: query description: Results per page (default 25). required: false schema: type: integer default: 25 - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_getapi_v1_iga_entitlements_Response_200' post: operationId: postapi-v-1-iga-entitlements summary: Create an entitlement description: 'Create a new identity entitlement. Requires app_id and type. The entitlement can then be associated with policies and granted to users. ' tags: - accessManagement parameters: - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_postapi_v1_iga_entitlements_Response_200' requestBody: description: Request body for creating an entitlement via the public API content: application/json: schema: type: object properties: name: type: string description: Name of the entitlement description: type: string description: Description of the entitlement app_id: type: integer format: int64 description: ID of the identity resource app this entitlement belongs to status: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaStatus' description: Status of the entitlement. Defaults to PUBLISHED if not specified. provisioning_config: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfig' deprovisioning_config: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig' required: - name - app_id /api/v1/iga/policies: post: operationId: postapi-v-1-iga-policies summary: Create a policy description: 'Create a new identity policy. Requires name, type, and status. Policies define access rules and can be associated with entitlements. ' tags: - accessManagement parameters: - name: X-Api-Key in: header required: true schema: type: string - name: X-Workspace-Id in: header required: false schema: type: string responses: '200': description: Successful response content: application/json: schema: $ref: '#/components/schemas/Access Management_postapi_v1_iga_policies_Response_200' requestBody: description: Request body for creating an identity policy via the public API content: application/json: schema: type: object properties: name: type: string description: Name of the policy description: type: string description: Description of the policy type: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaType' condition: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition' approvals: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals' lifecycle: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle' status: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaStatus' is_active: type: boolean description: Whether the policy is active entitlements: type: array items: type: integer format: int64 description: List of entitlement IDs to associate with this policy app_id: type: integer format: int64 description: ID of the identity resource app this policy belongs to is_business_justification_required: type: boolean description: Whether business justification is required for requests under this policy required: - name - type - status - app_id components: schemas: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle: oneOf: - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle0' - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle1' title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsDuration: type: object properties: id: type: string description: 'Unique identifier in format: {value}_{unit}' value: type: integer description: The numeric value of the duration unit: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsDurationUnit' description: Time unit for duration specifications required: - value - unit description: Represents a duration with a value and time unit. Includes ID field for AI-agent friendly selection. title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsDuration ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigType: type: string enum: - OKTA_GROUP_PROVISIONING - AZURE_GROUP_PROVISIONING - INTUNE_GROUP_PROVISIONING - JUMPCLOUD_GROUP_PROVISIONING - GOOGLE_WORKSPACE_GROUP_PROVISIONING - MANUAL_PROVISIONING description: Type of provisioning configuration title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigType ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaStatus: type: string enum: - DRAFT - PUBLISHED - ARCHIVED - UNPUBLISHED title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaStatus Access Management_postapi_v1_iga_grants_Response_200: type: object properties: {} description: Empty response body title: Access Management_postapi_v1_iga_grants_Response_200 ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItems: type: object properties: duration: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsDuration' description: Represents a duration with a value and time unit. Includes ID field for AI-agent friendly selection. notification_settings: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettings' description: Notification settings for time-based access policies. Can be used globally or per-duration. required: - duration description: Represents an access duration option with optional per-duration notification settings title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItems ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals1: type: object properties: type: type: string steps: type: array items: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems' required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals1 ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition0: type: object properties: type: type: string values: type: array items: type: integer format: int64 required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition0 ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValueIcon: type: object properties: name: type: string description: Icon name type: type: string description: Icon type url: type: - string - 'null' description: Icon URL (for OKTA/AZURE) title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValueIcon Access Management_getapi_v1_iga_entitlements_Response_200: type: object properties: {} description: Empty response body title: Access Management_getapi_v1_iga_entitlements_Response_200 Access Management_postapi_v1_iga_entitlements_Response_200: type: object properties: {} description: Empty response body title: Access Management_postapi_v1_iga_entitlements_Response_200 ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValueIcon: type: object properties: name: type: string description: Icon name type: type: string description: Icon type url: type: - string - 'null' description: Icon URL (for OKTA/AZURE) title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValueIcon ApiV1IgaGrantsListPostParametersSortOrder: type: string enum: - CREATED_AT_ASC - CREATED_AT_DESC - UPDATED_AT_ASC - UPDATED_AT_DESC - NAME_ASC - NAME_DESC - PUBLISHED_DESC - UNPUBLISHED_DESC - EXPIRES_AT_ASC - EXPIRES_AT_DESC - GRANTED_AT_ASC - GRANTED_AT_DESC title: ApiV1IgaGrantsListPostParametersSortOrder ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator: type: string enum: - EQUALS - NOT_EQUALS - CONTAINS - NOT_CONTAINS - IN - NOT_IN - GREATER_THAN - LESS_THAN - GREATER_THAN_EQUALS - LESS_THAN_EQUALS - IS_BETWEEN - IS_NULL - IS_NOT_NULL - STARTS_WITH - ENDS_WITH - TEXT_CONTAINS - TEXT_DOES_NOT_CONTAINS - IS_ANY_OF - IS_NOT_ANY_OF - IS_EXACTLY - IS_ON_OR_BEFORE - IS_ON_OR_AFTER - IS_WITHIN title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems0: type: object properties: type: type: string criteria: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0Criteria' approvers_data: type: array items: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItems' required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems0 ? ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItemsUnit : type: string enum: - HOURS - DAYS - WEEKS - MONTHS description: Time unit for duration specifications title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItemsUnit ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfig: type: object properties: provider: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigProvider' description: Provisioning provider type: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigType' description: Type of provisioning configuration value: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValue' required: - provider - type - value title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfig ApiV1IgaEntitlementsGetParametersType: type: string enum: - GROUP - ROLE title: ApiV1IgaEntitlementsGetParametersType ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettings: type: object properties: enable_expiry_notifications: type: boolean default: false description: Whether expiry notifications are enabled notification_timings: type: array items: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettingsNotificationTimingsItems' default: [] description: List of notification timings specifying when to send notifications before expiry description: Notification settings for time-based access policies. Can be used globally or per-duration. title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettings ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue: type: object properties: {} title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigProvider: type: string enum: - OKTA - AZURE_AD - MS_INTUNE - JUMPCLOUD - GOOGLE_WORKSPACE - TUEBORA - MANUAL description: Provisioning provider title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigProvider ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle1: type: object properties: type: type: string allowed_access_durations: type: array items: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItems' description: List of allowed access duration options. Each can have its own notification settings. global_notification_settings: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettings' description: Notification settings for time-based access policies. Can be used globally or per-duration. allow_user_to_extend: type: boolean default: false description: Whether users can request an extension to their access required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle1 ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsDurationUnit: type: string enum: - HOURS - DAYS - WEEKS - MONTHS description: Time unit for duration specifications title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsDurationUnit ? ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettingsNotificationTimingsItems : type: object properties: id: type: string description: 'Unique identifier in format: {value}_{unit}' value: type: integer description: The numeric value of the duration unit: description: Any type required: - value - unit description: Represents a duration with a value and time unit. Includes ID field for AI-agent friendly selection. title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettingsNotificationTimingsItems ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaStatus: type: string enum: - UNPUBLISHED - PUBLISHED description: Status of the entitlement. Defaults to PUBLISHED if not specified. title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaStatus ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems: oneOf: - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems0' - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems1' title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItemsCardinality: type: string enum: - SINGLE - MULTI description: "Indicates whether the approver row resolves to a single user (SINGLE) or multiple\nusers (MULTI). Populated server-side on approval-policy GET responses; null on writes.\n\nRules:\n- EXPRESSION: SINGLE/MULTI per the placeholder template (ApprovalPlaceholder catalog).\n Null on unknown templates.\n- AGENT_GROUP: always MULTI — the resolver fans the group out to every member at\n evaluation time, so the FE picker should render the multi-user badge and auto-toggle\n the criteria selector.\n- Other types (EXACT, STANDARD_BASED, OPTION_BASED): null.\n" title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItemsCardinality ? ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItems : type: object properties: id: type: string description: 'Unique identifier in format: {value}_{unit}' value: type: integer description: The numeric value of the duration unit: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItemsUnit' description: Time unit for duration specifications required: - value - unit description: Represents a duration with a value and time unit. Includes ID field for AI-agent friendly selection. title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItems Access Management_postapi_v1_iga_policies_Response_200: type: object properties: {} description: Empty response body title: Access Management_postapi_v1_iga_policies_Response_200 ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaType: type: string enum: - BIRTH_RIGHT - SELF_SERVICE title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaType Access Management_putapi_v1_iga_grants__grant_id_Response_200: type: object properties: {} description: Empty response body title: Access Management_putapi_v1_iga_grants__grant_id_Response_200 ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition: oneOf: - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition0' title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition ApiV1IgaGrantsGrantIdPutRequestBodyContentApplicationJsonSchemaStatus: type: string enum: - GRANTED - EXPIRED - EXTENDED - REVOKED title: ApiV1IgaGrantsGrantIdPutRequestBodyContentApplicationJsonSchemaStatus Access Management_postapi_v1_iga_grants__grant_id__revoke_Response_200: type: object properties: {} description: Empty response body title: Access Management_postapi_v1_iga_grants__grant_id__revoke_Response_200 ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValue: type: object properties: label: type: string description: Group label/name (for OKTA/AZURE) or Workspace name (for MANUAL) icon: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValueIcon' value: type: string description: Group ID (for OKTA/AZURE) or Workspace ID (for MANUAL) title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValue ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigType: type: string enum: - OKTA_GROUP_DEPROVISIONING - AZURE_GROUP_DEPROVISIONING - INTUNE_GROUP_DEPROVISIONING - JUMPCLOUD_GROUP_DEPROVISIONING - GOOGLE_WORKSPACE_GROUP_DEPROVISIONING - MANUAL_DEPROVISIONING description: Type of deprovisioning configuration title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigType ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals0: type: object properties: type: type: string required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals0 ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValue: type: object properties: value: type: string description: Group ID (for OKTA/AZURE) or Workspace ID (for MANUAL) label: type: string description: Group label/name (for OKTA/AZURE) or Workspace name (for MANUAL) icon: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValueIcon' title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValue Access Management_postapi_v1_iga_grants_list_Response_200: type: object properties: {} description: Empty response body title: Access Management_postapi_v1_iga_grants_list_Response_200 ApiV1IgaGrantsGrantIdHistoryGetParametersSortOrder: type: string enum: - CREATED_AT_ASC - CREATED_AT_DESC - UPDATED_AT_ASC - UPDATED_AT_DESC description: Sort order for grant history title: ApiV1IgaGrantsGrantIdHistoryGetParametersSortOrder ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig: type: object properties: provider: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigProvider' description: Deprovisioning provider type: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigType' description: Type of deprovisioning configuration value: $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValue' required: - provider - type - value title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals: oneOf: - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals0' - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals1' title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItems: type: object properties: type: type: string value: type: string label: type: string metadata: description: Any type cardinality: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItemsCardinality' description: "Indicates whether the approver row resolves to a single user (SINGLE) or multiple\nusers (MULTI). Populated server-side on approval-policy GET responses; null on writes.\n\nRules:\n- EXPRESSION: SINGLE/MULTI per the placeholder template (ApprovalPlaceholder catalog).\n Null on unknown templates.\n- AGENT_GROUP: always MULTI — the resolver fans the group out to every member at\n evaluation time, so the FE picker should render the multi-user badge and auto-toggle\n the criteria selector.\n- Other types (EXACT, STANDARD_BASED, OPTION_BASED): null.\n" title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItems ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigProvider: type: string enum: - OKTA - AZURE_AD - MS_INTUNE - JUMPCLOUD - GOOGLE_WORKSPACE - TUEBORA - MANUAL description: Deprovisioning provider title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigProvider ApiV1IgaEntitlementsGetParametersStatus: type: string enum: - DRAFT - PUBLISHED title: ApiV1IgaEntitlementsGetParametersStatus ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems1: type: object properties: type: type: string policy_id: type: integer format: int64 required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems1 ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettings: type: object properties: enable_expiry_notifications: type: boolean default: false description: Whether expiry notifications are enabled notification_timings: type: array items: $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItems' default: [] description: List of notification timings specifying when to send notifications before expiry description: Notification settings for time-based access policies. Can be used globally or per-duration. title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettings ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems: type: object properties: value: $ref: '#/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue' nested_filter: description: Any type title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle0: type: object properties: type: type: string required: - type title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle0 Access Management_getapi_v1_iga_apps_Response_200: type: object properties: {} description: Empty response body title: Access Management_getapi_v1_iga_apps_Response_200 Access Management_getapi_v1_iga_grants__grant_id__history_Response_200: type: object properties: {} description: Empty response body title: Access Management_getapi_v1_iga_grants__grant_id__history_Response_200 ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems: type: object properties: attribute: type: string operator: $ref: '#/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator' values: type: array items: $ref: '#/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems' title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0Criteria: type: string enum: - FIRST_DECISION - EVERYONE title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0Criteria securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-Api-Key