Access certification campaigns allow key stakeholders to periodically review users’ access to resources. Okta can then modify resource access, based on stakeholder reviews. Manage campaign tasks with the following campaign APIs.
See Identity Governance for more information on access certification campaigns and Identity Governance.
OAuth 2.0 scope:
- okta.governance.accessCertifications.manage
Admin roles:
- ACCESS_CERTIFICATIONS_ADMIN
Creates a campaign that governs access to resources.
Specify the following for a campaign:
resourceSettings: Which resources are subject to reviewprincipalScopeSettings: Which users with access to the resources are subject to reviewscheduleSettings: The schedule of the campaignreviewerSettings: Who needs to review accessremediationSettings: What needs to be done after access is reviewednotificationSettings: Configure automatic notifications to a campaign creator or reviewer
Notes:
- You can certify access to service accounts that are managed in Okta Privileged Access if you're also subscribed to Okta Privileged Access. See Certify service accounts in the product documentation.
- You can certify AI agent access to resource connections if you're also subscribed to Okta for AI Agents. See Create identity campaigns to certify resource connections. This is a self-service Early Access feature. Enable the Resource Access Certifications for AI Agents feature in your org. See Enable self-service features.
Specifies the characteristics of a single campaign
Name of the campaign. Maintain some uniqueness when naming the campaign as it helps to identify and filter for campaigns when needed.
Identifies the campaign as a resource (RESOURCE) or an identity (USER) campaign
Default:"RESOURCE"
| Enum Value | Description |
|---|---|
| RESOURCE | Certify access to resources in a campaign |
| USER | Certify access for an identity (user or AI agent) in a campaign |
Scheduler specific settings.
A campaign can be a ONE_OFF or a RECURRING campaign.
You can't provide both in the campaign definition.
An array of Okta specific resource id for which access is being reviewed.
Reviewer settings for the access certification campaign
Settings for email notifications to be sent to the reviewers at different stages of a campaign. All properties are optional.
Specifies the action to be taken after a reviewer makes a decision to APPROVE or REVOKE the access, or if the campaign was CLOSED and there was no response from the reviewer
Indicates the minimum required SKU to manage the campaign
Enum:"BASIC""PREMIUM"
POST
- Campaign using groups with users as scope |tooltip| This flow creates a resource campaign for all users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used.
- Campaign using group with user expression scope |tooltip| This flow creates a resource campaign for a subset of users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used. An Okta Expression is used to select the subset of users in a group.
- Campaign defined for applications with users as scope |tooltip| This flow creates a resource campaign that includes users assigned to a specific application without entitlements. This flow specifies a specific user as the reviewer.
- Campaign with reviewer scope expression |tooltip| The set of properties to pass when creating a campaign with reviewer settings and reviewer scope expression.
- Campaign with reviewer notification at campaign end |tooltip| The set of properties to pass when creating a campaign with notification settings to notify reviewer at campaign end.
- Campaign with reviewer notification at campaign assignment |tooltip| The set of properties to pass when creating a campaign with notification settings to notify reviewer at campaign assignment.
- Campaign with reviewer reminders before campaign end |tooltip| The set of properties to pass when creating a campaign with notification settings to send reminders to reviewers before campaign end.
- Campaign with remediation to remove users from group on revoke |tooltip| The set of properties to pass when creating a campaign with remediation settings to remove the users from group when review decision is revoked by assigned reviewer.
- Campaign with remediation to remove users from group when no decision by reviewer |tooltip| The set of properties to pass when creating a campaign with remediation settings to remove the users from group when no action has beend taken by assigned reviewer.
- Recurring campaign that repeats every 5th day of the month |tooltip| A recurring campaign that repeats indefinitely every month on the 5th day.
- Recurring campaign that repeats every 3 months on Thursday of 2nd week |tooltip| A recurring campaign that repeats every 3 months on Thursday of 2nd week and ends after a certain date.
- Campaign with reviewer group owner |tooltip| Applicable when `resourceSettings.type = GROUP`. One can specify multiple resource Ids. Each resource (which is a group), could have owners assigned. When a campaign is created to review such groups, the reviews would be created for each member of the group. The owners of each of those groups, become reviewer(s) for those reviewers.
- Campaign with reviewer group |tooltip| Applicable when `reviewerSettings.type = GROUP`. The group specified via `reviewerGroupId` could have multiple members. Each member of the group will become reviewer(s) of the reviews.
- Multi level campaign with reviewerType USER at both levels |tooltip| Applicable when `reviewerSettings.type = MULTI_LEVEL`. Both the reviewer levels has `reviewerType = USER`. A reviewer at each level will make a decision before the final decision is made on reviews. In this example, the `transitionPolicy` is `APPROVED`. That means only `APPROVED` decisions at first level will go to second level. A `REVOKED` decision for any of the reviews in first level is updated as the final decision. Such reviews do not move to second level.
- Multi level campaign with reviewerType GROUP at both levels |tooltip| Applicable when `reviewerSettings.type = MULTI_LEVEL`. Both the reviewer levels has `reviewerType = GROUP` with distinct reviewer groups. A reviewer at each level will make a decision before the final decision is made on reviews.
- Multi level campaign with level 1 reviewerType RESOURCE_OWNER and level 2 reviewerType USER |tooltip| Applicable when `reviewerSettings.type = MULTI_LEVEL`. Reviewer at level1 has `reviewerType = RESOURCE_OWNER` and level2 has `reviewerType = USER`. A reviewer at each level will make a decision before the final decision is made on reviews.
- User centric campaign with specific users and both apps and groups as resources |tooltip| Applicable when `campaignType = USER`. specifies a set of user Ids to review. Selects both apps and groups to be reviewed. In this example, only the `userIds` is selected for review but all apps and groups associated with those users are reviewed.
- User centric campaign with excluded resources |tooltip| Applicable when `campaignType = USER`. specifies a set of user Ids to review. Selects both apps and groups to be reviewed. Selects a list of excluded groups and apps. In this example, only the `groupIds` is selected for review but all apps and groups associated with those users are reviewed.
- Campaign on application with entitlements and bundles |tooltip| Applicable when the application has ramp entitlements such as Salesforce or Google.
- Campaign on Okta Admin Console |tooltip| The set of properties to pass when creating a resource-centric campaign on the Okta Admin Console. Also, allows you to specify only active users in the campaign.
- Campaign defined for applications with predefined inactive users scope |tooltip| The set of properties to pass to create a campaign on users who have been inactive for the past 90 days in a set of applications.
- Multi App Entitlement Campaign |tooltip| The set of properties received when creating a resource-centric multi app entitlement campaign
- Campaign defined for applications with group remediation settings |tooltip| The set of properties to pass when creating a campaign with an application resource(s) that includes group assignment of users to the application who can be automatically remediated.
- SOD campaign with multi-level user and group reviewers |tooltip| App separation of duties (SOD) campaign | Multi-level user and group reviewers | Entitlements
- SOD campaign to show all users with a manager reviewer |tooltip| App separation of duties (SOD) campaign | Manager reviewer | User expression | Entitlements | Show all users, including any SOD conflicts
- SOD campaign to show only conflicts with a realm expression and a manager reviewer |tooltip| App separation of duties (SOD) campaign | Manager reviewer | User expression for realm | Entitlements | Show only conflicts
- SOD campaign to show only conflicts with entitlements and a group reviewer |tooltip| App separation of duties (SOD) campaign | Group reviewer | Entitlements | Show only conflicts
- SOD campaign to show only conflicts with entitlements, user expression, and a group reviewer |tooltip| App separation of duties (SOD) campaign | Group reviewer | User expression | Entitlements | Show only conflicts
- Governance campaign with targeted apps through governance label values
- Governance campaign that targets groups through governance label values
- Campaign on an app with entitlements and bundles that are targeted through governance labels
- Campaign on apps with entitlements and bundles that are all targeted through governance labels
- Campaign certifying Okta service accounts
- Campaign certifying SaaS app service accounts
- Campaign certifying collections
- Campaign certifying collections using governance label values
- User centric campaign that includes collection resources |tooltip| Applicable when `campaignType = USER`. Apps, groups, and collections are selected for review. In this example, only users who are in the `principalScopeSettings.groupIds` are selected for review. All access to apps, groups, and collections associated with those users is assessed.
- Campaign with justification requirement |tooltip| This flow creates a resource campaign with a justification requirement set to REQUIRED_FOR_ALL, requiring reviewers to provide justification for both approve and revoke decisions.
- Campaign certifying AI agents' connected resources |tooltip| Set `campaignType = USER` for identity campaigns that certify AI agents' connected resources. This campaign only certifies AI agents that are in the `principalScopeSettings.aiAgentIds` list.
curl -i -X POST \
https://okta-subdomain.pixtulate.com/governance/api/v1/campaigns \
-H 'Content-Type: application/json' \
-d '{
"campaignType": "RESOURCE",
"description": "Group Campaign | User Reviewer Expression",
"name": "Group Campaign | User Reviewer Expression",
"status": "ACTIVE",
"scheduleSettings": {
"startDate": "2024-10-04T13:43:40.000Z",
"timeZone": "America/New_York",
"durationInDays": 30,
"type": "ONE_OFF"
},
"resourceSettings": {
"targetTypes": [
"GROUP"
],
"targetResources": [
{
"resourceType": "GROUP",
"resourceId": "00gg2gzn7m1Aw2zAs1d7"
}
]
},
"principalScopeSettings": {
"type": "USERS"
},
"reviewerSettings": {
"selfReviewDisabled": true,
"justificationRequired": true,
"reviewerScopeExpression": "user.profile.reviewerId",
"type": "REVIEWER_EXPRESSION",
"fallBackReviewerId": "00u3tm6uw9Cx4Sn8H1d7",
"reviewerId": "00u3tm6uw9Cx4Sn8H1d7",
"bulkDecisionDisabled": true
},
"notificationSettings": {
"notifyReviewPeriodEnd": true,
"notifyReviewerWhenOverdue": false,
"notifyReviewerDuringMidpointOfReview": true,
"remindersReviewerBeforeCampaignCloseInSecs": [
86400
],
"notifyReviewerWhenReviewAssigned": true,
"notifyReviewerAtCampaignEnd": true
},
"remediationSettings": {
"accessRevoked": "DENY",
"accessApproved": "NO_ACTION",
"noResponse": "NO_ACTION"
},
"reportingSettings": {
"createReportingPackageEnabled": true
}
}'A successful campaign create response
The id of the Okta user who created the resource
The ISO 8601 formatted date and time when the resource was created
The ISO 8601 formatted date and time when the object was last updated
The id of the Okta user who last updated the object
Name of the campaign. Maintain some uniqueness when naming the campaign as it helps to identify and filter for campaigns when needed.
Identifies the campaign as a resource (RESOURCE) or an identity (USER) campaign
Default:"RESOURCE"
| Enum Value | Description |
|---|---|
| RESOURCE | Certify access to resources in a campaign |
| USER | Certify access for an identity (user or AI agent) in a campaign |
Scheduler specific settings.
A campaign can be a ONE_OFF or a RECURRING campaign.
You can't provide both in the campaign definition.
An array of Okta specific resource id for which access is being reviewed.
Reviewer settings for the access certification campaign
Settings for email notifications to be sent to the reviewers at different stages of a campaign. All properties are optional.
Specifies the action to be taken after a reviewer makes a decision to APPROVE or REVOKE the access, or if the campaign was CLOSED and there was no response from the reviewer
ID of the recurring campaign if this campaign was created as part of a recurring schedule.
Reporting properties for processing post-completed campaigns
Response
- Campaign with a group with users as scope |tooltip| The response from a flow that creates a resource campaign for all users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used.
- Campaign with a group with user expression scope |tooltip| The response for a flow that creates a resource campaign for a subset of users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used. An Okta Expression is used to select the subset of users in a group.
- Campaign with an app with users as scope |tooltip| The response for a flow that creates a resource campaign including users assigned to a specific application without entitlements. This flow specifies a specific user as the reviewer.
- Campaign with reviewer ID |tooltip| The set of properties to pass when creating a campaign with reviewer settings and reviewer Id.
- Campaign with reviewer scope expression |tooltip| The set of properties to pass when creating a campaign with reviewer settings and reviewer scope expression.
- Campaign with reviewer notification at campaign end |tooltip| The set of properties to pass when creating a campaign with notification settings to notify reviewer at campaign end.
- Campaign with reviewer notification at campaign assignment |tooltip| The set of properties to pass when creating a campaign with notification settings to notify reviewer at campaign assignment.
- Campaign with reviewer reminders before campaign end |tooltip| The set of properties to pass when creating a campaign with notification settings to send reminders to reviewers before campaign end.
- Campaign with remediation to remove users from group on revoke |tooltip| The set of properties to pass when creating a campaign with remediation settings to remove the users from group when review decision is revoked by assigned reviewer.
- Campaign with remediation to remove users from group when no decision by reviewer |tooltip| The set of properties to pass when creating a campaign with remediation settings to remove the users from group when no action has been taken by assigned reviewer.
- Recurring campaign repeating indefinitely on 30th day of every month |tooltip| A recurring campaign that repeats indefinitely every month on the 30th day.
- Recurring campaign that repeats every 3 months on Thursday of 2nd week |tooltip| A recurring campaign that repeats every 3 months on Thursday of 2nd week and ends after a certain date.
- Campaign with group owners |tooltip| Applicable when `resourceSettings.type = GROUP`. Once can specify multiple resource Ids. Each resource (which is a group), could have owners assigned. When a campaign is created to review such groups, the reviews would be created for each member of the group. The owners of each of those groups, become reviewer(s) for those reviewers.
- Campaign with reviewer group |tooltip| Applicable when `reviewerSettings.type = GROUP`. The group specified via `reviewerGroupId` could have multiple members. Each member of the group will become reviewer(s) of the reviews.
- Campaign of multi level type with reviewerType USER at both levels |tooltip| Applicable when reviewerSettings.type = MULTI_LEVEL. Both the reviewer levels has reviewerType = USER A reviewer at each level will make a decision before the final decision is made on reviews.
- Campaign of multi level type with reviewerType GROUP at both levels |tooltip| Applicable when reviewerSettings.type = MULTI_LEVEL. Both the reviewer levels has reviewerType = GROUP A reviewer at each level will make a decision before the final decision is made on reviews.
- Campaign of multi level type with reviewerType RESOURCE_OWNER at level1 and USER at level2 |tooltip| Applicable when reviewerSettings.type = MULTI_LEVEL. Reviewer level1 has reviewerType = RESOURCE_OWNER and level2 has reviewerType = USER A reviewer at each level will make a decision before the final decision is made on reviews.
- Campaign with user centric and apps and groups as resources |tooltip| The set of properties to pass when creating a user centric campaign with apps and groups as resources for a list of users.
- Campaign user centric with excluded users |tooltip| The set of properties to pass when creating a user centric campaign with excluded resources (apps and groups).
- Campaign on application with entitlements and bundles |tooltip| The set of properties to pass when creating a user centric campaign with excluded resources (apps and groups).
- Campaign on Okta Admin Console |tooltip| The set of properties received when creating a resource-centric campaign on the Okta Admin Console.
- Campaign with a app and predefined inactive users scope |tooltip| The set of properties to pass when creating a campaign with resource as a application(s) and principal scope settings as predefined inactive users for past 90 days.
- Multi App Entitlement Campaign |tooltip| The set of properties received when creating a resource-centric multi app entitlement campaign
- Campaign with an app and group remediation settings |tooltip| The set of properties received when creating a campaign with an application resource(s) that includes group assignment of users to the application who can be automatically remediated.
- SOD campaign with multi-level user and group reviewers |tooltip| App separation of duties (SOD) campaign | Multi-level user and group reviewers | Entitlements
- SOD campaign to show all users with a manager reviewer |tooltip| App separation of duties (SOD) campaign | Manager reviewer | User expression | Entitlements | Show all users, including any SOD conflicts
- SOD campaign to show only conflicts with a realm expression and a manager reviewer |tooltip| App separation of duties (SOD) campaign | Manager reviewer | User expression for realm | Entitlements | Show only conflicts
- SOD campaign to show only conflicts with entitlements and a group reviewer |tooltip| App separation of duties (SOD) campaign | Group reviewer | Entitlements | Show only conflicts
- SOD campaign to show only conflicts with entitlements, user expression, and a group reviewer |tooltip| App separation of duties (SOD) campaign | Group reviewer | User expression | Entitlements | Show only conflicts
- Governance campaign with targeted apps through governance label values
- Governance campaign that targets groups through governance label values
- Campaign on an app with entitlements and bundles that are targeted through governance labels
- Campaign on apps with entitlements and bundles that are all targeted through governance labels
- Campaign certifying Okta service accounts
- Campaign certifying SaaS app service accounts
- Campaign certifying collections
- Campaign certifying collections using governance label values
- User centric campaign that includes collection resources |tooltip| Applicable when `campaignType = USER`. Specifies a set of group Ids to review. Apps, groups, and collections are selected for review. In this example, only users who are in the `principalScopeSettings.groupIds` are selected for review. All access to apps, groups, and collections associated with those users is assessed.
- Campaign with justification requirement |tooltip| The response from a flow that creates a resource campaign with a justification requirement set to REQUIRED_FOR_ALL.
- Campaign certifying AI agents' connected resources |tooltip| This campaign only certifies AI agents that are in the `principalScopeSettings.aiAgentIds` list.
The response from a flow that creates a resource campaign for all users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used.
{ "_links": { "launchCampaign": { … }, "endCampaign": { … }, "reviews": { … }, "self": { … } }, "id": "icindtwi8SY3MVP1M1d6", "createdBy": "00u4oll01llSoXHEw1d7", "created": "2024-10-04T13:43:35Z", "lastUpdated": "2024-10-04T13:43:35Z", "lastUpdatedBy": "00u4oll01llSoXHEw1d7", "name": "Group Campaign | User Reviewer Expression", "description": "Group Campaign | User Reviewer Expression", "campaignType": "RESOURCE", "scheduleSettings": { "type": "ONE_OFF", "startDate": "2024-10-04T09:43:40-04:00", "durationInDays": 30, "timeZone": "America/New_York", "endDate": "2024-11-03T08:43:40-05:00" }, "resourceSettings": { "targetTypes": [ … ], "targetResources": [ … ] }, "principalScopeSettings": { "type": "USERS", "excludedUserIds": [], "userIds": [], "groupIds": [], "includeOnlyActiveUsers": false }, "reviewerSettings": { "type": "REVIEWER_EXPRESSION", "reviewerScopeExpression": "user.profile.reviewerId", "fallBackReviewerId": "00u3tm6uw9Cx4Sn8H1d7", "selfReviewDisabled": true, "justificationRequired": true, "bulkDecisionDisabled": false }, "notificationSettings": { "notifyReviewerWhenReviewAssigned": true, "notifyReviewerAtCampaignEnd": true, "remindersReviewerBeforeCampaignCloseInSecs": [ … ], "notifyReviewerWhenOverdue": false, "notifyReviewerDuringMidpointOfReview": true, "notifyReviewPeriodEnd": true }, "remediationSettings": { "accessApproved": "NO_ACTION", "accessRevoked": "DENY", "noResponse": "NO_ACTION" }, "status": "SCHEDULED" }