Skip to content
Okta Identity Governance
/
/Risk Rules

Risk Rules

Risk rules allow you to define criteria for granted principal access that are a risk to your org.

Risk rules are used to support separation of duties (SOD) in Access Certifcations and Access Requests. See Separation of duties product documentation.

Operations

Create a risk rule

Request

Beta
OAuth 2.0 scope:
  • okta.governance.riskRule.manage
Admin roles:
  • APP_ADMIN

Creates a risk rule

Bodyapplication/jsonrequired
namestring, [ 1 .. 255 ] charactersrequired

Name of the resource risk rule

descriptionstring, [ 1 .. 1000 ] characters

Description of the risk rule

notesstring, [ 1 .. 1000 ] characters

Additional information about the risk rule

typestringrequired

Risk rule type

Value:"SEPARATION_OF_DUTIES"
resourcesArray of objects, <= 1 items(rule-conflict-resource)required

Resources that the risk rule applies to

conflictCriteriaobject(conflict-criteria-creatable)required

Conflict criteria for the risk rule

POST
/governance/api/v1/risk-rules
curl -i -X POST \
  https://okta-subdomain.pixtulate.com/governance/api/v1/risk-rules \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Process and Approve Payment",
    "description": "Process and Approve Payment",
    "type": "SEPARATION_OF_DUTIES",
    "resources": [
      {
        "resourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ"
      }
    ],
    "conflictCriteria": {
      "and": [
        {
          "name": "list1",
          "attribute": "principal.effective_grants",
          "operation": "CONTAINS_ONE",
          "value": {
            "type": "ENTITLEMENTS",
            "value": [
              {
                "id": "espo3v6xlwdtEX2il1d6",
                "values": [
                  {
                    "id": "ento3v6xmkviXCltm1d6"
                  }
                ]
              }
            ]
          }
        },
        {
          "name": "list2",
          "attribute": "principal.effective_grants",
          "operation": "CONTAINS_ALL",
          "value": {
            "type": "ENTITLEMENTS",
            "value": [
              {
                "id": "espxf36xlwdtEX2il23e",
                "values": [
                  {
                    "id": "ento3v6xk6nOq7lm51d6"
                  }
                ]
              }
            ]
          }
        }
      ]
    }
  }'

Responses

Risk rule success response

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
idstring, non-emptyrequired

Unique identifier for the object

descriptionstring, [ 1 .. 1000 ] characters

Description for the risk rule

typestringrequired

Risk rule type

Value:"SEPARATION_OF_DUTIES"
conflictCriteriaobject(conflict-criteria)required

Conflict criteria for the risk rule

createdBystring, (okta-user-id), [ 1 .. 20 ] characters(created-by)read-onlyrequired

The id of the Okta user who created the resource

createdstring, (date-time)(created)read-onlyrequired

The ISO 8601 formatted date and time when the resource was created

lastUpdatedstring, (date-time)(last-updated)read-onlyrequired

The ISO 8601 formatted date and time when the object was last updated

lastUpdatedBystring, (okta-user-id), [ 1 .. 20 ] characters(last-updated-by)read-onlyrequired

The id of the Okta user who last updated the object

namestring, [ 1 .. 255 ] charactersrequired

Name of the resource risk rule

notesstring, [ 1 .. 1000 ] characters

Additional information about the risk rule

resourcesArray of objects, <= 1 items(rule-conflict-resource)required

Resources that the risk rule applies to

statusstringrequired

Status of the risk rule

Enum:"ACTIVE""INVALID"
Response
{
  "id": "rulb0oNGTSWTBKOLGLNR",
  "name": "Process and Approve Payment",
  "description": "Process and Approve Payment",
  "type": "SEPARATION_OF_DUTIES",
  "status": "ACTIVE",
  "resources": [
    { … }
  ],
  "lastUpdated": "2022-05-24T14:15:22Z",
  "createdBy": "00ub0oNGTSWTBKOLGLNR",
  "created": "2022-05-24T14:15:22Z",
  "lastUpdatedBy": "00ub0oNGTSWTBKOLGLNR",
  "conflictCriteria": {
    "and": [ … ]
  },
  "_links": {
    "self": { … }
  }
}