openapi: 3.2.0 info: description: "Operator Access Control enables you to control the time duration and the actions an Oracle operator can perform on your Exadata Cloud@Customer infrastructure.\nUsing logging service, you can view a near real-time audit report of all actions performed by an Oracle operator. \n" title: Operator Access Control Operator Control API version: '20200630' x-provenance: method: harvested first_party: true publisher: Oracle source: https://docs.oracle.com/en-us/iaas/api/specs/9cf6d46a3ebf1062eb0a9b386e1727a9f1b39525782fc49580c4ba13b79c72fa.yaml harvested: '2026-08-04' note: Published by Oracle as the contract for the Operator Access Control API OCI service and stored verbatim; API Evangelist added only this provenance block. x-evidence: - url: https://docs.oracle.com/en-us/iaas/api/specs/index.json what: Oracle's own index of every OCI service specification - url: https://docs.oracle.com/en-us/iaas/api/specs/9cf6d46a3ebf1062eb0a9b386e1727a9f1b39525782fc49580c4ba13b79c72fa.yaml what: the harvested document for Operator Access Control API servers: - url: http://127.0.0.1/20200630 - url: https://127.0.0.1/20200630 tags: - name: operatorControl paths: /operatorControls: get: description: 'Lists the operator controls in the compartment. ' operationId: ListOperatorControls parameters: - $ref: '#/components/parameters/CompartmentIdQueryParam' - $ref: '#/components/parameters/OperatorControlLifecycleStateQueryParam' - $ref: '#/components/parameters/OperatorControlQueryParam' - $ref: '#/components/parameters/PaginationLimitQueryParam' - $ref: '#/components/parameters/PaginationTokenQueryParam' - $ref: '#/components/parameters/SortOrderQueryParam' - $ref: '#/components/parameters/SortByQueryParam' - $ref: '#/components/parameters/RequestIdHeader' responses: 200: description: Returns OperatorControlCollection object. headers: opc-next-page: description: 'For pagination of a list of items. When paging through a list, if this header appears in the response, then a partial list might have been returned. Include this value as the `page` parameter for the subsequent GET request to get the next batch of items. ' schema: type: string opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string content: application/json: schema: $ref: '#/components/schemas/OperatorControlCollection' 400: $ref: '#/components/responses/400' 401: $ref: '#/components/responses/401' 404: $ref: '#/components/responses/404' 429: $ref: '#/components/responses/429' 500: $ref: '#/components/responses/500' default: $ref: '#/components/responses/default' summary: Lists the operator controls in the compartment. tags: - operatorControl x-related-resource: '#/definitions/OperatorControl' post: description: 'Creates an Operator Control. ' operationId: CreateOperatorControl parameters: - $ref: '#/components/parameters/RetryTokenHeader' - $ref: '#/components/parameters/RequestIdHeader' responses: 200: description: Creates and Returns the operator control object. headers: etag: description: 'For optimistic concurrency control. See `if-match`. ' schema: type: string opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string content: application/json: schema: $ref: '#/components/schemas/OperatorControl' 400: $ref: '#/components/responses/400' 401: $ref: '#/components/responses/401' 404: $ref: '#/components/responses/404' 409: $ref: '#/components/responses/409' 429: $ref: '#/components/responses/429' 500: $ref: '#/components/responses/500' default: $ref: '#/components/responses/default' summary: Creates a new Operator Control tags: - operatorControl x-related-resource: '#/definitions/OperatorControl' requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateOperatorControlDetails' description: Details for the new Operator Control. required: true /operatorControls/{operatorControlId}: delete: description: "Deletes an Operator Control. You cannot delete an Operator Control if it is assigned to govern any target resource currently or in the future.\nIn that case, first, delete all of the current and future assignments before deleting the Operator Control. An Operator Control that was previously assigned to a target \nresource is marked as DELETED following a successful deletion. However, it is not completely deleted from the system. This is to ensure auditing information for the accesses \ndone under the Operator Control is preserved for future needs. The system purges the deleted Operator Control only when all of the audit data associated with the \nOperator Control are also deleted. Therefore, you cannot reuse the name of the deleted Operator Control until the system purges the Operator Control.\n" operationId: DeleteOperatorControl parameters: - $ref: '#/components/parameters/OperatorControlIdentifierPathParam' - $ref: '#/components/parameters/DeleteOperatorDescQueryParam' - $ref: '#/components/parameters/IfMatchHeader' - $ref: '#/components/parameters/RequestIdHeader' responses: 204: description: Successfully deleted the Operator Control object. headers: opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string 400: $ref: '#/components/responses/400' 401: $ref: '#/components/responses/401' 404: $ref: '#/components/responses/404' 412: $ref: '#/components/responses/412' 429: $ref: '#/components/responses/429' 500: $ref: '#/components/responses/500' default: $ref: '#/components/responses/default' summary: Deletes an operator control. tags: - operatorControl x-related-resource: '#/definitions/OperatorControl' get: description: Gets the Operator Control associated with the specified Operator Control ID. operationId: GetOperatorControl parameters: - $ref: '#/components/parameters/OperatorControlIdentifierPathParam' - $ref: '#/components/parameters/RequestIdHeader' responses: 200: description: Returns the OperatorControl object headers: etag: description: 'For optimistic concurrency control. See `if-match`. ' schema: type: string opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string content: application/json: schema: $ref: '#/components/schemas/OperatorControl' 400: $ref: '#/components/responses/400' 401: $ref: '#/components/responses/401' 404: $ref: '#/components/responses/404' 429: $ref: '#/components/responses/429' 500: $ref: '#/components/responses/500' default: $ref: '#/components/responses/default' summary: Gets the Operator Control associated with the specified Operator Control ID. tags: - operatorControl x-related-resource: '#/definitions/OperatorControl' put: description: 'Modifies the existing OperatorControl for a given operator control id except the operator control id. ' operationId: UpdateOperatorControl parameters: - $ref: '#/components/parameters/OperatorControlIdentifierPathParam' - $ref: '#/components/parameters/IfMatchHeader' - $ref: '#/components/parameters/RequestIdHeader' responses: 200: description: Updates and returns the OperatorControl object with the updated details headers: etag: description: 'For optimistic concurrency control. See `if-match`. ' schema: type: string opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string content: application/json: schema: $ref: '#/components/schemas/OperatorControl' 400: $ref: '#/components/responses/400' 401: $ref: '#/components/responses/401' 404: $ref: '#/components/responses/404' 409: $ref: '#/components/responses/409' 412: $ref: '#/components/responses/412' 429: $ref: '#/components/responses/429' 500: $ref: '#/components/responses/500' default: $ref: '#/components/responses/default' summary: Modifies the existing OperatorControl for a given operator control id tags: - operatorControl x-related-resource: '#/definitions/OperatorControl' requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateOperatorControlDetails' description: Details for the new OperatorControl. required: true /operatorControls/{operatorControlId}/actions/changeCompartment: post: description: 'Moves the Operator Control resource into a different compartment. When provided, ''If-Match'' is checked against ''ETag'' values of the resource. ' operationId: ChangeOperatorControlCompartment parameters: - $ref: '#/components/parameters/OperatorControlIdentifierPathParam' - $ref: '#/components/parameters/RetryTokenHeader' - $ref: '#/components/parameters/IfMatchHeader' - $ref: '#/components/parameters/RequestIdHeader' responses: 204: description: The Operator Control resource has been successfully moved to the new compartment. headers: opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string 400: $ref: '#/components/responses/400' 401: $ref: '#/components/responses/401' 404: $ref: '#/components/responses/404' 409: $ref: '#/components/responses/409' 412: $ref: '#/components/responses/412' 429: $ref: '#/components/responses/429' 500: $ref: '#/components/responses/500' default: $ref: '#/components/responses/default' summary: Moves the Operator Control resource into a different compartment. When provided, 'If-Match' is checked against 'ETag' values of the resource. tags: - operatorControl x-related-resource: '#/definitions/OperatorControl' requestBody: content: application/json: schema: $ref: '#/components/schemas/ChangeOperatorControlCompartmentDetails' description: Moves the Operator Control resource into a different compartment. required: true components: parameters: PaginationTokenQueryParam: description: The page token representing the page at which to start retrieving results. This is usually retrieved from a previous list call. in: query name: page schema: type: string maxLength: 1024 minLength: 1 SortByQueryParam: description: 'The field to sort by. Only one sort order may be provided. Default order for timeCreated is descending. Default order for displayName is ascending. If no value is specified timeCreated is default. ' in: query name: sortBy schema: type: string enum: - timeCreated - displayName default: timeCreated CompartmentIdQueryParam: description: The ID of the compartment in which to list resources. in: query name: compartmentId required: true schema: type: string IfMatchHeader: description: 'For optimistic concurrency control. In the PUT or DELETE call for a resource, set the `if-match` parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource''s current etag value. ' in: header name: if-match required: false schema: type: string PaginationLimitQueryParam: description: The maximum number of items to return. in: query name: limit schema: type: integer default: 10 maximum: 1000 minimum: 1 OperatorControlIdentifierPathParam: description: unique OperatorControl identifier in: path name: operatorControlId required: true schema: type: string SortOrderQueryParam: description: The sort order to use, either 'asc' or 'desc'. in: query name: sortOrder x-obmcs-top-level-enum: '#/definitions/SortOrders' schema: type: string enum: - ASC - DESC default: DESC DeleteOperatorDescQueryParam: description: reason for deletion of OperatorControl. in: query name: description x-default-description: 'null' schema: type: string maxLength: 250 minLength: 0 OperatorControlLifecycleStateQueryParam: description: A filter to return only resources whose lifecycleState matches the given OperatorControl lifecycleState. in: query name: lifecycleState required: false x-default-description: 'null' x-obmcs-top-level-enum: '#/definitions/OperatorControlLifecycleStates' schema: type: string enum: - CREATED - ASSIGNED - UNASSIGNED - DELETED RetryTokenHeader: description: 'A token that uniquely identifies a request so it can be retried in case of a timeout or server error without risk of executing that same action again. Retry tokens expire after 24 hours, but can be invalidated before then due to conflicting operations. For example, if a resource has been deleted and purged from the system, then a retry of the original creation request might be rejected. ' in: header name: opc-retry-token required: false schema: type: string maxLength: 64 minLength: 1 RequestIdHeader: description: The client request ID for tracing. in: header name: opc-request-id schema: type: string OperatorControlQueryParam: description: A filter to return OperatorControl that match the entire display name given. in: query name: displayName x-default-description: 'null' schema: type: string maxLength: 255 minLength: 1 schemas: Error: description: Error Information. properties: code: description: A short error code that defines the error, meant for programmatic parsing. type: string message: description: A human-readable error string. type: string required: - code - message ChangeOperatorControlCompartmentDetails: description: Details of the new compartment to contain the operator control. properties: compartmentId: description: The OCID of the new compartment to contain the operator contol. maxLength: 255 minLength: 1 type: string OperatorControlCollection: description: Results of Operator Control search, which contains summary of the operator control. properties: items: description: contains OperatorControlSummary items: $ref: '#/components/schemas/OperatorControlSummary' type: array required: - items type: object OperatorControlSummary: description: Summary of the OperatorControl. properties: compartmentId: description: The OCID of the compartment that contains the operator control. type: string definedTags: additionalProperties: additionalProperties: description: 'The value of the tag. Only string, integer and boolean types are supported. ' type: object description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace. ' type: object description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace. ' type: object freeformTags: additionalProperties: type: string description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. ' type: object id: description: The OCID of the operator control. type: string isFullyPreApproved: description: Whether all operator actions are pre-approved. If yes, an access request associated with a resource governed by the operator control will be automatically approved by the system. type: boolean lifecycleState: description: The current lifecycle state of the operator control. enum: - CREATED - ASSIGNED - UNASSIGNED - DELETED type: string x-obmcs-top-level-enum: '#/definitions/OperatorControlLifecycleStates' operatorControlName: description: Name of the operator control. type: string timeOfCreation: description: 'Time when the operator control was created, expressed in [RFC 3339] (https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z'' ' format: date-time type: string timeOfDeletion: description: 'Time when the operator control was deleted, expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z'' ' format: date-time type: string timeOfModification: description: 'Time when the operator control was last modified, expressed in [RFC 3339] (https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z'' ' format: date-time type: string required: - id - operatorControlName type: object UpdateOperatorControlDetails: description: Information about the new operator control. properties: approverGroupsList: description: List of user groups who can approve an access request associated with a target resource under the governance of this operator control. items: type: string type: array approversList: description: List of users who can approve an access request associated with a target resource under the governance of this operator control. items: type: string type: array definedTags: additionalProperties: additionalProperties: description: 'The value of the tag. Only string, integer and boolean types are supported. ' type: object description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace. ' type: object description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace. ' type: object description: description: Description of the operator control. type: string emailIdList: description: 'List of emailId. ' items: type: string type: array freeformTags: additionalProperties: type: string description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. ' type: object isFullyPreApproved: description: "Whether all the operator actions have been pre-approved. If yes, all access requests associated with a resource governed by this operator control \nwill be auto-approved.\n" type: boolean notificationTopicId: description: The OCID of the OCI Notification topic to publish messages related to this operator control. maxLength: 255 minLength: 1 type: string operatorControlName: description: Name of the operator control. maxLength: 255 minLength: 1 type: string preApprovedOpActionList: description: "List of pre-approved operator actions. Access requests associated with a resource governed by this operator control will be\nautomatically approved if the access request only contain operator actions in the pre-approved list. \n" items: type: string type: array systemMessage: description: System message that would be displayed to the operator users on accessing the target resource under the governance of this operator control. type: string required: - operatorControlName - isFullyPreApproved - approverGroupsList type: object OperatorControl: description: 'Operator Access Control enables you to grant, audit, or revoke the access Oracle has to your Exadata Cloud@Customer infrastructure, and obtain audit reports of all actions taken by a human operator, in a near real-time manner. ' properties: approvalRequiredOpActionList: description: "List of operator actions that need explicit approval. Any operator action not in the pre-approved list will require explicit\napproval. Access requests associated with a resource governed by this operator control will be\nrequire explicit approval if the access request contains any operator action in this list. \n" items: type: string type: array approverGroupsList: description: List of user groups who can approve an access request associated with a target resource under the governance of this operator control. items: type: string type: array approversList: description: List of users who can approve an access request associated with a target resource under the governance of this operator control. items: type: string type: array compartmentId: description: The OCID of the compartment that contains the operator control. maxLength: 255 minLength: 1 type: string definedTags: additionalProperties: additionalProperties: description: 'The value of the tag. Only string, integer and boolean types are supported. ' type: object description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace. ' type: object description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace. ' type: object description: description: Description of operator control. type: string emailIdList: description: 'List of emailId. ' items: type: string type: array freeformTags: additionalProperties: type: string description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. ' type: object id: description: The OCID of the operator control. type: string isDefaultOperatorControl: description: 'Whether the operator control is a default Operator Control. ' type: boolean isFullyPreApproved: description: "Whether all the operator actions have been pre-approved. If yes, all access requests associated with a resource governed by this operator control \nwill be auto-approved.\n" type: boolean lastModifiedInfo: description: Description associated with the latest modification of the operator control. type: string lifecycleState: description: The current lifecycle state of the operator control. enum: - CREATED - ASSIGNED - UNASSIGNED - DELETED type: string x-obmcs-top-level-enum: '#/definitions/OperatorControlLifecycleStates' notificationTopicId: description: The OCID of the OCI Notification topic to publish messages related to this operator control. maxLength: 255 minLength: 1 type: string operatorControlName: description: Name of the operator control. The name must be unique. maxLength: 255 minLength: 1 type: string preApprovedOpActionList: description: "List of pre-approved operator actions. Access requests associated with a resource governed by this operator control will be\nautomatically approved if the access request only contain operator actions in the pre-approved list. \n" items: type: string type: array systemMessage: description: System message that would be displayed to the operator users on accessing the target resource under the governance of this operator control. type: string timeOfCreation: description: 'Time when the operator control was created expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z'' ' format: date-time type: string timeOfDeletion: description: 'Time when deleted expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339)timestamp format. Example: ''2020-05-22T21:10:29.600Z''. Note a deleted operator control still stays in the system, so that you can still audit operator actions associated with access requests raised on target resources governed by the deleted operator control. ' format: date-time type: string timeOfModification: description: 'Time when the operator control was last modified expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z'' ' format: date-time type: string required: - id - operatorControlName - compartmentId type: object CreateOperatorControlDetails: description: 'While creating the operator control, specify how operator actions are approved and the users who have the privilege of approving the operator actions associated with the Operator Control. You must specify which operator actions must be pre-approved. The rest of the operator actions associated with the Operator Control will require an explicit approval from the users selected either through the approver groups or individually. You must name your Operator Control appropriately so it reflects the resources that will be governed by the Operator Control. Neither the Operator Controls nor their assignments to resources are visible to the Oracle operators. ' properties: approverGroupsList: description: List of user groups who can approve an access request associated with a resource governed by this operator control. items: type: string type: array approversList: description: List of users who can approve an access request associated with a resource governed by this operator control. items: type: string type: array compartmentId: description: The OCID of the compartment that contains this operator control. maxLength: 255 minLength: 1 type: string definedTags: additionalProperties: additionalProperties: description: 'The value of the tag. Only string, integer and boolean types are supported. ' type: object description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace. ' type: object description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace. ' type: object description: description: Description of the operator control. type: string emailIdList: description: 'List of emailId. ' items: type: string type: array freeformTags: additionalProperties: type: string description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. ' type: object isFullyPreApproved: description: "Whether all the operator actions have been pre-approved. If yes, all access requests associated with a resource governed by this operator control \nwill be auto-approved. \n" type: boolean notificationTopicId: description: The OCID of the OCI Notification topic to publish messages related to this operator control. maxLength: 255 minLength: 1 type: string operatorControlName: description: Name of the operator control. maxLength: 255 minLength: 1 type: string preApprovedOpActionList: description: 'List of pre-approved operator actions. Access requests associated with a resource governed by this operator control will be auto-approved if the access request only contain operator actions in the pre-approved list. ' items: type: string type: array systemMessage: description: This is the message that will be displayed to the operator users while accessing the system. type: string required: - operatorControlName - compartmentId - isFullyPreApproved - resourceType - approverGroupsList type: object responses: default: description: Unknown Error headers: opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' schema: type: string content: application/json: schema: $ref: '#/components/schemas/Error' x-anchors: x-headers: etag: description: 'For optimistic concurrency control. See `if-match`. ' type: string opc-next-page: description: 'For pagination of a list of items. When paging through a list, if this header appears in the response, then a partial list might have been returned. Include this value as the `page` parameter for the subsequent GET request to get the next batch of items. ' type: string opc-request-id: description: 'Unique Oracle-assigned identifier for the request. If you need to contact Oracle about a particular request, please provide the request ID. ' type: string opc-work-request-id: description: 'Unique Oracle-assigned identifier for the asynchronous request. You can use this to query status of the asynchronous operation. ' type: string retry-after: description: A decimal number representing the number of seconds the client should wait before polling this endpoint again. format: float type: number x-properties: definedTags: additionalProperties: additionalProperties: description: 'The value of the tag. Only string, integer and boolean types are supported. ' type: object description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace. ' type: object description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace. ' type: object freeformTags: additionalProperties: type: string description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. ' type: object x-obmcs-client-retries-enabled: true x-oracle-package: com.oracle.bmc.opctl