Create a grant

Okta Identity Governance

Management APIs

Create a grant

Request

Beta

OAuth 2.0 scope:

okta.governance.entitlements.manage

Admin roles:

APP_ADMIN

Creates a grant request with a specific grant type (grantType)

Bodyapplication/jsonrequired

The grant request parameters depend on the selected grantType

targetPrincipalobject(target-principal)required

A representation of a principal

scheduleSettingsobject(schedule-settings-writeable)

Scheduler specific settings applicable to a grant.

actionstring(grant-action)

The action to be taken for a grant

Default:"ALLOW"

Enum:"ALLOW""DENY"

actorstring(grant-actor)

The flow that triggered the grant request

Default:"API"

Enum Value	Description
API	The grant request was triggered from the API.
ACCESS_REQUEST	The grant request was triggered from an access request.
NONE	The grant request wasn't triggered from the API, an access request, or the Admin Console.
ADMIN	The grant request was triggered from the Admin Console.

grantTypestringrequired

Additive grant type for entitlement bundle.

Default:"ENTITLEMENT-BUNDLE"

Value:"ENTITLEMENT-BUNDLE"

Discriminator

entitlementBundleIdstring, (entitlement-bundle-id), = 20 characters(entitlement-bundle-id)enb[0-9a-zA-Z]+required

The entitlement bundle id

POST

/governance/api/v1/grants

curl -i -X POST \
  https://okta-subdomain.pixtulate.com/governance/api/v1/grants \
  -H 'Content-Type: application/json' \
  -d '{
    "grantType": "ENTITLEMENT-BUNDLE",
    "entitlementBundleId": "enbfxqCAJWWGELFTYCCC",
    "actor": "ACCESS_REQUEST",
    "targetPrincipal": {
      "externalId": "00ufxqCAJWWGELFTYCCC",
      "type": "OKTA_USER"
    }
  }'

Responses

A successful grant creation operation

Headers

X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60

X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60

X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200

Bodyapplication/json

idstring, non-emptyrequired

Unique identifier for the object

createdBystring, (okta-user-id), [ 1 .. 20 ] characters(created-by)read-onlyrequired

The id of the Okta user who created the resource

createdstring, (date-time)(created)read-onlyrequired

The ISO 8601 formatted date and time when the resource was created

lastUpdatedstring, (date-time)(last-updated)read-onlyrequired

The ISO 8601 formatted date and time when the object was last updated

lastUpdatedBystring, (okta-user-id), [ 1 .. 20 ] characters(last-updated-by)read-onlyrequired

The id of the Okta user who last updated the object

_linksobject(resource-grant-links)required

Links to related resources

grantTypestring(grant-type)required

Type of grant. Reconciliation creates an IMPORT grant to record an entitlement that the app reported, but that Okta wasn't already governing.

Enum:"CUSTOM""ENTITLEMENT-BUNDLE""POLICY""ENTITLEMENT""IMPORT"

entitlementBundleIdstring, (entitlement-bundle-id), = 20 characters(entitlement-bundle-id)enb[0-9a-zA-Z]+

The entitlement bundle id

targetPrincipalOrnstring, (okta-user-orn)(user-orn)required

The Okta user in ORN format

Example:"orn:okta:directory:00o8rk36Bp5eZKOrw0g4:users:00u1ktfFMZ5HNoj7k0g4"

targetPrincipalobject(target-principal-full)required

Representation of a principal

actionstring(grant-action)required

The action to be taken for a grant

Default:"ALLOW"

Enum:"ALLOW""DENY"

actorstring(grant-actor)required

The flow that triggered the grant request

Default:"API"

Enum Value	Description
API	The grant request was triggered from the API.
ACCESS_REQUEST	The grant request was triggered from an access request.
NONE	The grant request wasn't triggered from the API, an access request, or the Admin Console.
ADMIN	The grant request was triggered from the Admin Console.

targetResourceOrnstring, (okta-resource-orn)(resource-orn)required

The Okta resource in ORN format

See the ORN format for supported resources.

targetobject(target-resource)required

Representation of a resource

entitlementsArray of objects(entitlements-creatable)

Collection of entitlements and associated value identifiers

scheduleSettingsobject(schedule-settings-writeable)

Scheduler specific settings applicable to a grant.

statusstring(grant-status)required

The state of the particular grant setting

Enum:"ACTIVE""SCHEDULED""INACTIVE""EXPIRED"

metadataobject(grant-metadata)

Grant metadata properties

Response

{
  "id": "0ggb0oNGTSWTBKOLGLNR",
  "created": "2022-05-24T14:15:22Z",
  "createdBy": "00ub0oNGTSWTBKOLGLNR",
  "lastUpdated": "2022-05-24T14:15:22Z",
  "lastUpdatedBy": "00ub0oNGTSWTBKOLGLNR",
  "grantType": "ENTITLEMENT-BUNDLE",
  "entitlementBundleId": "enbfxqCAJWWGELFTYCCC",
  "action": "ALLOW",
  "actor": "ACCESS_REQUEST",
  "targetResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
  "target": {
    "externalId": "0oafxqCAJWWGELFTYASJ",
    "type": "APPLICATION"
  },
  "targetPrincipalOrn": "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00ub0oNGTSWTBKOLGLNR",
  "targetPrincipal": {
    "externalId": "00ub0oNGTSWTBKOLGLNR",
    "type": "OKTA_USER"
  },
  "status": "ACTIVE",
  "_links": {
    "entitlementBundle": { … },
    "self": { … }
  }
}