Skip to content
Okta Identity Governance
/
Management APIs
/
/
List all resources with o...

List all resources with owners

Request

OAuth 2.0 scope:
  • okta.governance.resourceOwner.read
Admin roles:
  • SUPER_ADMIN
Permissions:
  • okta.apps.read
  • okta.users.read
  • okta.groups.read

Lists all resources with assigned owners for an app (the parent resource) or for standalone AI agents.

For this request, you must specify the filter query parameter with either a parentResourceOrn (for apps, groups, entitlements, and bundles), a resource.orn filter expression (for collections resource type), or resource.type eq "ai-agents" (for AI agents, optionally combined with parentResourceOrn to scope to a specific AI agent or principal.orn to filter by owner). This method returns all the resources, such as entitlements, entitlement bundles, or AI agents, that have owners assigned.

Query
filterstring, (scim-filter)(scim-filter)required

A filter expression that returns entries based on the following properties and supported operators:

  • parentResourceOrn: supports eq
  • resource.orn: supports eq
  • resource.type: supports eq
  • resource.profile.name: supports sw and co (both parentResourceOrn and resource.type filters are required for resource.profile.name filtering)
  • principal.orn: supports eq (must be combined with resource.type eq "ai-agents")

Note: Query parameter percent encoding is required. See Special characters.

Note: The principal referenced by principal.orn must already exist as a registered resource owner in the system. If the principal has never been assigned as an owner, the API returns a 400 error rather than an empty result set.

Examples:
Filter by parentResourceOrn
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ"
Filter by resource orn, which can be an app or a bundle
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.orn eq "orn:okta:governance:00o11edP
Filter by resource orn, which is a collection
filter=resource.orn eq "orn:okta:governance:00o11edPwGqbUrsDm0g4:collections:colvmzzTr4xO45Ujn0g4"
Filter by resource type, which can be an app or a bundle
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles"
Filter by the resource name for a specified resource type, starting with the provided prefix
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles" AND re
Filter by the resource name for a specified resource type that contains the provided substring
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles" AND re
Filter by resource type ai-agents (standalone, without parentResourceOrn)
filter=resource.type eq "ai-agents"
Filter by principal orn combined with resource type
filter=resource.type eq "ai-agents" AND principal.orn eq "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00u1tgwssMI9jYizU0g5"
Filter by principal orn combined with an AI agent parent resource orn
filter=resource.type eq "ai-agents" AND parentResourceOrn eq "orn:okta:directory:00o11edPwGqbUrsDm0g4:workload-principals:ai-agents:wp1234567890" AND
limitinteger, [ 1 .. 200 ]

The maximum number of records returned in a response

Default:20
afterstring

Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the standard link headers. See pagination.

Example:after=00u68w6vzKLultXS97g6
includeArray of strings

Adds additional properties in the response

Items ValueDescription
parent_resource_owner

If the parent resource has an owner assigned, then the parent resource is included in the data array response.

Examples:
Include parent resource owners in the response
include=parent_resource_owner
GET
/governance/api/v1/resource-owners
curl -i -X GET \
  'https://okta-subdomain.pixtulate.com/governance/api/v1/resource-owners?filter=parentResourceOrn%20eq%20%22orn%3Aokta%3Aidp%3A00o11edPwGqbUrsDm0g4%3Aapps%3Asalesforce%3A0oafxqCAJWWGELFTYASJ%22&limit=20&after=00u68w6vzKLultXS97g6&include=parent_resource_owner'

Responses

Resource owners list success response

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
dataArray of objects(resource-owner)

Resource owner details.

metadataobject(list-metadata)

Metadata for the list response

Response
{
  "data": [
    { … },
    { … },
    { … }
  ],
  "_links": {
    "self": { … }
  },
  "metadata": {
    "total": 10
  }
}