Skip to content
Okta Identity Governance
/
/Principal Entitlements

Principal Entitlements

Principal Entitlements represent the effective entitlements for a user and resource after evaluating all grants.

See Entitlement Management for more information.

Operations

Retrieve the principal's effective entitlements for a resource

Request

OAuth 2.0 scope:
  • okta.governance.entitlements.read
Admin roles:
  • APP_ADMIN

Retrieves the principal's effective entitlements for a specific resource

Query
filterstring, (scim-filter)(scim-filter)required

Apply various filters by using supported principal entitlements filtering properties.

Note: Query parameter percent encoding is required. See Percent-encoding

Examples:
Filter by user and application
filter=parent.externalId eq "0oafxqCAJWWGELFTYASJ" AND parent.type eq "APPLICATION" AND targetPrincipal.externalId eq "00ub0oNGTSWTBKOLGLNR" AND targe
Filter by user and application ORNs
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:oidc:0oafxqCAJWWGELFTYASJ" AND targetPrincipalOrn eq "orn:okta:directory:00o11edPw
GET
/governance/api/v1/principal-entitlements
curl -i -X GET \
  'https://okta-subdomain.pixtulate.com/governance/api/v1/principal-entitlements?filter=parent.externalId%20eq%20%220oafxqCAJWWGELFTYASJ%22%20AND%20parent.type%20eq%20%22APPLICATION%22%20AND%20targetPrincipal.externalId%20eq%20%2200ub0oNGTSWTBKOLGLNR%22%20AND%20targetPrincipal.type%20eq%20%22OKTA_USER%22'

Responses

List of all principal entitlements for a specific resource.

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
dataArray of objects(principal-entitlement)

Principal entitlements list

Response
When a user has been granted some License and Role entitlement's to Salesforce
{
  "data": [
    { … },
    { … }
  ]
}