Skip to content
Okta Identity Governance
/
Management APIs
/
/
Retrieve a grant

Retrieve a grant

Request

Beta
OAuth 2.0 scope:
  • okta.governance.entitlements.read
Admin roles:
  • APP_ADMIN

Retrieves the full detail of a specific grant

Path
grantIdstringrequired

Unique identifier for the grant

Query
includeArray of strings

The include parameter adds additional properties to the response.

Items Enum ValueDescription
full_entitlements

Include complete entitlements in the response

metadata

Include metadata such as collection generating the grant in the response

Examples:
Include complete entitlements in the response
include=full_entitlements
Include metadata such as collection generating the grant in the response
include=metadata
GET
/governance/api/v1/grants/{grantId}
curl -i -X GET \
  'https://okta-subdomain.pixtulate.com/governance/api/v1/grants/{grantId}?include=full_entitlements'

Responses

Get grant

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
One of:

Grant response

idstring, non-emptyrequired

Unique identifier for the object

createdBystring, (okta-user-id), [ 1 .. 20 ] characters(created-by)read-onlyrequired

The id of the Okta user who created the resource

createdstring, (date-time)(created)read-onlyrequired

The ISO 8601 formatted date and time when the resource was created

lastUpdatedstring, (date-time)(last-updated)read-onlyrequired

The ISO 8601 formatted date and time when the object was last updated

lastUpdatedBystring, (okta-user-id), [ 1 .. 20 ] characters(last-updated-by)read-onlyrequired

The id of the Okta user who last updated the object

grantTypestring(grant-type)required

Type of grant. Reconciliation creates an IMPORT grant to record an entitlement that the app reported, but that Okta wasn't already governing.

Enum:"CUSTOM""ENTITLEMENT-BUNDLE""POLICY""ENTITLEMENT""IMPORT"
entitlementBundleIdstring, (entitlement-bundle-id), = 20 characters(entitlement-bundle-id)enb[0-9a-zA-Z]+

The entitlement bundle id

targetPrincipalOrnstring, (okta-user-orn)(user-orn)required

The Okta user in ORN format

Example:"orn:okta:directory:00o8rk36Bp5eZKOrw0g4:users:00u1ktfFMZ5HNoj7k0g4"
targetPrincipalobject(target-principal-full)required

Representation of a principal

actionstring(grant-action)required

The action to be taken for a grant

Default:"ALLOW"
Enum:"ALLOW""DENY"
actorstring(grant-actor)required

The flow that triggered the grant request

Default:"API"
Enum ValueDescription
API

The grant request was triggered from the API.

ACCESS_REQUEST

The grant request was triggered from an access request.

NONE

The grant request wasn't triggered from the API, an access request, or the Admin Console.

ADMIN

The grant request was triggered from the Admin Console.

targetResourceOrnstring, (okta-resource-orn)(resource-orn)required

The Okta resource in ORN format

See the ORN format for supported resources.

targetobject(target-resource)required

Representation of a resource

entitlementsArray of objects(entitlements-creatable)

Collection of entitlements and associated value identifiers

scheduleSettingsobject(schedule-settings-writeable)

Scheduler specific settings applicable to a grant.

statusstring(grant-status)required

The state of the particular grant setting

Enum:"ACTIVE""SCHEDULED""INACTIVE""EXPIRED"
metadataobject(grant-metadata)

Grant metadata properties

Response
{
  "id": "0ggb0oNGTSWTBKOLGLNR",
  "created": "2022-05-24T14:15:22Z",
  "createdBy": "00ub0oNGTSWTBKOLGLNR",
  "lastUpdated": "2022-05-24T14:15:22Z",
  "lastUpdatedBy": "00ub0oNGTSWTBKOLGLNR",
  "grantType": "ENTITLEMENT-BUNDLE",
  "entitlementBundleId": "enbfxqCAJWWGELFTYCCC",
  "action": "ALLOW",
  "actor": "ACCESS_REQUEST",
  "targetResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
  "target": {
    "externalId": "0oafxqCAJWWGELFTYASJ",
    "type": "APPLICATION"
  },
  "targetPrincipalOrn": "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00ub0oNGTSWTBKOLGLNR",
  "targetPrincipal": {
    "externalId": "00ub0oNGTSWTBKOLGLNR",
    "type": "OKTA_USER"
  },
  "status": "ACTIVE",
  "_links": {
    "entitlementBundle": { … },
    "self": { … }
  }
}