The Request Types API allows you to manage request types, similar to the operations performed in the Okta Access Requests app. Use this API to define request types that include:
- Fields to complete
- Approvals and tasks required
- Actions performed in Okta
See Access Request Types in the product documentation.
Notes:
- Each org has a limit of 500 active request types.
- Operations to create or delete apps or groups in Okta could take up to 24 hours before they can be referenced by the Access Requests - V1 APIs. To trigger these changes immediately, open Okta Access Requests as an administrator, go to Settings > Configuration and click Sync Now on the relevant Okta resource list.
Creates a request type that governs the requests allowed in your org.
Specify the following to create a request type:
- What resource access can be requested
- Who can request access
- What question(s) requesters must answer (optional)
- Who can approve access
- What question(s) approvers must answer (optional)
- How long access should be granted for (optional)
Notes:
- You can have a maximum of 100 combined items across
approvalSettings.approvals,approvalSettings.approvals.approverFields, andrequestSettings.requesterFieldsobjects for each request type. This translates to a maximum of 100 combined questions, tasks, or actions for each request type.- The limit on the JSON response payload of a request type is 100,000 characters.
The writable attributes of a request type
A user-defined unique key that's set during the create operation and can't be updated afterwards
Human readable description
Whether the request type starts with a status of DRAFT or ACTIVE. Starting as ACTIVE is preferable to avoid a publish operation when no manual inspection of the request type is necessary before publication.
The ID of the team that administers this request type.
{ "type": "GROUPS", "targetResources": [ "00g1emaKYZTWRYYRRTSK" ] }
{ "type": "EVERYONE", "requesterFields": [ { … } ] }
{ "type": "SERIAL", "approvals": [ { … } ] }
How long the requester retains access after their request is approved and fulfilled.
Specified in ISO 8601 duration format.
Only single time unit ISO 8601 duration formats (D, H, M) are supported for units (days, hours, minutes).
| Unit | Example |
|---|---|
| D, days | P40D |
| H, hours | PT65H |
| M, minutes | PT90M |
Note: Mixes of units, as well as month/year/week designations, aren't supported. For example,
P40DT65H,P40M,P1W, andP1Yaren't supported.
- For access to group, has minimal required properties |tooltip| The minimal set of properties to pass when creating a Request Type. Allows anyone to request access to the Admin Group. No questions are required, and there is only one approval required by the requesting user's manager.
- For access to app, includes defaults |tooltip| When request type is for access to app and includes defaults
- For access to group, requires manager's approval |tooltip| Creating a request type to enable requests for access to a group
- For access to app, manager's approval required |tooltip| Creating a request type to enable requests for access to an application
- Approver fields with select input |tooltip| Creating a Request Type where anyone may request access. The requester's manager needs to approve and select an option.
- Manager approver field specifies text defaults explicitly |tooltip| Creating a request type where anyone may request access. The requester's manager needs to approve and must provide value for text field.
- Manager approver has required date-time field |tooltip| Creating a request type where anyone may request access. The requester's manager needs to approve and must provide value for date-time field.
- Multi-step approvals, one of each type |tooltip| Payload for creating a request type with many approvals. Anyone can request access to the group. No questions need to be answered. First their manager's approval is required. Second a member of a group's approval is required. And finally a specific user's approval is required.
- Optional requester field |tooltip| When a requester field is optional. **Note** approverFields always required if present.
- Requester must be member of a group |tooltip| Creating a request type where only members of a group may request access to the application.
- An active request type with time bound access |tooltip| A request type created with active status where all requests will only grant access for a limited duration of time.
- A request type that requires no approval |tooltip| Create a request type that allows anyone to request access to Grammarly. No questions are required, and no approvals are required.
- A request type requiring an approval that has a description |tooltip| Create a request type that allows anyone to request access to Tableau. No questions are required, and no approvals are required.
- A request type requiring resource owner approval |tooltip| Create a request type that requires approval from the owner of the resource
curl -i -X POST \
https://okta-subdomain.pixtulate.com/governance/api/v1/request-types \
-H 'Content-Type: application/json' \
-d '{
"name": "salesforce-01",
"description": "How users can request access to Admin Group",
"ownerId": "61eb0f06c462d20007f051ac",
"resourceSettings": {
"type": "GROUPS",
"targetResources": [
{
"resourceId": "00g1emaKYZTWRYYRRTSK"
}
]
},
"approvalSettings": {
"type": "SERIAL",
"approvals": [
{
"approverType": "MANAGER"
}
]
}
}'A successful request type create response
A user-defined unique key that's set during the create operation and can't be updated afterwards
Human readable description
The id of the Okta user who created the resource
The ISO 8601 formatted date and time when the resource was created
The ISO 8601 formatted date and time when the object was last updated
The id of the Okta user who last updated the object
Links to related resources
{ "createRequest": { "href": "https://my-org.okta-at.pixtulate.com/next/new?q=Request%20access%20to%20Salesforce&request_type=0oa1gjh63g214q0Hq0g4", "type": "text/html" }, "requests": { "href": "https://okta-myorg.pixtulate.com/governance/api/v1/requests?filter=requestTypeId%20eq%20%2261eb2db568c7c300079fefd0%22", "type": "application/json" }, "self": { "href": "https://okta-myorg.pixtulate.com/governance/api/v1/requests/61eb2db568c7c300079fefd0", "type": "application/json" } }
The ID of the team that administers this request type.
{ "type": "GROUPS", "targetResources": [ "00g1emaKYZTWRYYRRTSK" ] }
{ "type": "EVERYONE", "requesterFields": [ { … } ] }
{ "type": "SERIAL", "approvals": [ { … } ] }
How long the requester retains access after their request is approved and fulfilled.
Specified in ISO 8601 duration format.
Only single time unit ISO 8601 duration formats (D, H, M) are supported for units (days, hours, minutes).
| Unit | Example |
|---|---|
| D, days | P40D |
| H, hours | PT65H |
| M, minutes | PT90M |
Note: Mixes of units, as well as month/year/week designations, aren't supported. For example,
P40DT65H,P40M,P1W, andP1Yaren't supported.
A request type has a status lifecycle described in our request type lifecycle documentation.
A request type may start with a status of DRAFT or ACTIVE, based on the status property in the Add request body.
The publish, unpublish, and delete operations all affect a request type's status.
Additionally, if any operation detects invalid settings, such as an approver who is no longer in the organization, the request type automatically transitions to disabled.
- When request type is for groups, has minimal required properties |tooltip| The minimal set of properties to pass when creating a Request Type. Allows anyone to request access to the Admin Group. No questions are required, and there is only one approval required by the requesting user's manager.
- For access to app, includes defaults |tooltip| Creating a request type and anyone may request it and not using default.
- For access to group, manager's approval required |tooltip| Creating a request type to enable requests for access to a group
- For access to app, manager's approval required |tooltip| Creating a request type to enable requests for access to an application
- Manager approver has required select field |tooltip| Creating a request type where anyone may request access. The requester's manager needs to approve and select an option.
- Manager approver field specifies text defaults explicitly |tooltip| Full representation of approver text field
- Manager approver has required date-time field |tooltip| Payload for creating request type where the requester's manager needs to approve and answer a question using a DATE-TIME field.
- Multi-step approvals, one of each type |tooltip| Payload for creating request type where there are many approval steps, where each step demonstrates a different way to specify who may approve.
- Optional requester field |tooltip| When a requester field is optional. **Note** approverFields always required if present.
- Requester must be member of a group |tooltip| Creating a request type where only members of a group may request access to the application.
- An active request type with time bound access |tooltip| A request type created with active status where all requests will only grant access for a limited duration of time.
- A request type that requires no approval |tooltip| Create a request type that allows anyone to request access to Grammarly. No questions are required, and no approvals are required.
- A request type requiring an approval that has a description |tooltip| Create a request type that allows anyone to request access to Tableau. No questions are required, and no approvals are required.
- A request type requiring resource owner approval |tooltip| Create a request type that requires approval from the owner of the resource
{ "id": "08ab2db568c7c300079fefd0", "name": "low-privilege-group-01-request-type-02", "description": "How users can request access to low privilege Group 01", "created": "2022-05-24T14:15:22Z", "createdBy": "00ub0oNGTSWTBKOLGLNR", "lastUpdated": "2022-05-24T14:15:22Z", "lastUpdatedBy": "00ub0oNGTSWTBKOLGLNR", "status": "DRAFT", "lastUpdateSource": "API", "ownerId": "61eb0f06c462d20007f051ac", "resourceSettings": { "type": "GROUPS", "targetResources": [ … ] }, "requestSettings": { "type": "EVERYONE", "requesterFields": [] }, "approvalSettings": { "type": "SERIAL", "approvals": [ … ] }, "accessDuration": null, "_links": { "createRequest": { … }, "requests": { … }, "self": { … } } }