Okta Identity Governance
/- Management APIs
- Access Requests - V2
- Update the resource request settings
Retrieve the resource request settings
Retrieve the org request settings
Update the org request settings
Update the resource reque...
OAuth 2.0 scope:
- okta.accessRequests.condition.manage
Admin roles:
- ACCESS_REQUESTS_ADMIN
Updates the resource request settings
Unique identifier for the resource in Okta instance ID format or ORN format
Specifies if and for whom a requester may request the resource for.
PATCH
- For adding request on behalf of settings to a resource |tooltip| Request on behalf of settings where any requester can request
- For updating request on behalf of settings to a resource |tooltip| Request on behalf of settings where any requester with direct reports can request for those direct reports
- For disabling request on behalf of settings for a resource |tooltip| Disable request on behalf of
- For updating risk settings to allow request submission with no overrides
- For updating risk settings to restrict request submission
- For updating risk settings to allow request submission
- For updating risk settings to allow request submission with access duration settings
- For updating risk settings to allow request submission and remove access duration settings
- For updating both request on behalf of settings and risk settings to a resource
curl -i -X PATCH \
'https://okta-subdomain.pixtulate.com/governance/api/v2/resources/{resourceId}/request-settings' \
-H 'Content-Type: application/json' \
-d '{
"requestOnBehalfOfSettings": {
"allowed": true
}
}'A successful request settings patch response
Access scope settings that are eligible to be added to a request condition for the specified resource
Request scope settings that are eligible to be added to a request condition for the specified resource
Admin specified access duration settings added to a request condition or risk settings for the specified resource
Specifies if and for whom a requester may request the resource for.
Risk settings that are eligible for the specified resource
Risk settings that are valid for an access request when a risk has been detected for the resource and requesting user
Response
- When governance enabled resource has entitlement bundle and value access scopes |tooltip| When resource: - Has entitlement management enabled - Has at least one entitlement value - Has at least one entitlement bundle
- When governance enabled resource only supported default access scope |tooltip| When resource: - Has entitlement management enabled - AND hasn't defined any entitlement values - AND hasn't defined any entitlement bundles
- When governance enabled resource has default and entitlement value access scope |tooltip| When resource: - Has governance engine enabled - AND has at least one entitlement defined - AND has not defined any entitlement bundles
- When resource supports default and group access scope |tooltip| When resource: - Does not have governance engine enabled - AND has at least one group assignment or push group.
- When resource only supports default access scope |tooltip| When resource: - Does not have governance engine with at least one entitlement or bundle - AND does not have a group that assigns to the resource - AND does not have a group that pushes to the resource.
- When resource requester settings restricted to groups |tooltip| Some special resources, like `Okta Admin Console` application, may have their `requesterSettings` restricted to only groups.
- When resource is not supported |tooltip| When a resource does not have any support for access requests. This can occur when the organization is not enabled for any access requests features.
- When resource has groups and everyone requester settings |tooltip| When resource has groups and everyone requester settings
- When resource supports admin fixed access duration as well as requester specified access duration |tooltip| When resource supports admin fixed access duration as well as requester specified access duration
- When the resource supports request on behalf of for every requester |tooltip| When resource supports any requesters requesting on behalf of any other requester
- When the resource supports requesting on behalf of direct reports |tooltip| When the resource supports requesting on behalf of direct reports
- When risk settings is not supported at the resource level
- When risk settings is supported at the resource level |tooltip| When risk settings is supported at the resource level. Request submission is restricted by default, when no risk settings have been updated.
- When resource has one risk settings allowing request submission with no overrides
- When resource has one risk settings allowing request submission with overrides
- When resource has one risk settings restricting request submission
- When resource risk settings has an error
When resource:
- Has entitlement management enabled
- Has at least one entitlement value
- Has at least one entitlement bundle
{ "validAccessScopeSettings": [ { … }, { … } ], "validRequesterSettings": [ { … }, { … } ], "validAccessDurationSettings": { "required": true, "maximumDays": 365, "maximumHours": 72, "maximumWeeks": 52, "supportedTypes": [ … ] }, "validRiskSettings": { "supportedTypes": [] }, "validRequestOnBehalfOfSettings": [ { … }, { … } ] }