openapi.yaml

openapi: 3.1.0
info:
  contact:
    email: hello@opal.dev
    name: Opal Team
    url: https://www.opal.dev/
  description: The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically.
  title: Opal API
  version: "1.0"
servers:
  - description: Production
    url: https://api.opal.dev/v1
paths:
  /apps:
    get:
      description: Returns a list of `App` objects.
      operationId: getApps
      parameters:
        - description: A list of app types to filter by.
          example:
            - OKTA_DIRECTORY
            - GIT_HUB
          explode: false
          in: query
          name: app_type_filter
          required: false
          schema:
            items:
              $ref: "#/components/schemas/AppTypeEnum"
            type: array
          style: form
        - description: An owner ID to filter by.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: owner_filter
          required: false
          schema:
            format: uuid
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AppsList"
          description: A list of apps for your organization.
      security:
        - BearerAuth: []
      tags:
        - apps
  /apps/{app_id}:
    get:
      description: Returns an `App` object.
      operationId: getApp
      parameters:
        - description: The ID of the app.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: app_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/App"
          description: The requested `App`.
      security:
        - BearerAuth: []
      tags:
        - apps
  /bundles:
    get:
      description: Returns a list of `Bundle` objects.
      operationId: getBundles
      parameters:
        - description: The maximum number of bundles to return from the beginning of the list. Default is 200, max is 1000.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
        - description: A cursor indicating where to start fetching items after a specific point.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: A filter for the bundle name.
          example: Engineering
          explode: true
          in: query
          name: contains
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: A list of bundles for your organization.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedBundleList"
      security:
        - BearerAuth: []
      tags:
        - bundles
    post:
      description: Creates a bundle.
      operationId: createBundle
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateBundleInfo"
      responses:
        "201":
          description: The bundle successfully created.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Bundle"
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}:
    get:
      description: Returns a `Bundle` object.
      operationId: getBundle
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Bundle"
          description: The requested `Bundle`.
      security:
        - BearerAuth: []
      tags:
        - bundles
    delete:
      description: Deletes a bundle.
      operationId: deleteBundle
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The bundle was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - bundles
    put:
      description: Updates a bundle.
      operationId: updateBundle
      parameters:
        - description: The ID of the bundle to be updated.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Bundle"
      responses:
        "200":
          description: The bundle was successfully updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Bundle"
        "204":
          description: No changes detected (no-op)
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/resources:
    get:
      description: Returns a list of `Resource` objects in a given bundle.
      operationId: getBundleResources
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The maximum number of resources to return from the beginning of the list. Default is 200, max is 1000.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
        - description: A cursor indicating where to start fetching items after a specific point.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedBundleResourceList"
          description: A list of resources for the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
    post:
      description: Adds a resource to a bundle.
      operationId: addBundleResource
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              properties:
                resource_id:
                  description: The ID of the resource to add.
                  example: 72e75a6f-7183-48c5-94ff-6013f213314b
                  format: uuid
                  type: string
                access_level_remote_id:
                  description: The remote ID of the access level to grant to this user. Required if the resource being added requires an access level. If omitted, the default access level remote ID value (empty string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
                access_level_name:
                  description: The name of the access level to grant to this user. If omitted, the default access level name value (empty string) is used.
                  example: AdministratorAccess
                  type: string
              required:
                - resource_id
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BundleResource"
          description: Resource was successfully added to the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/resources/{resource_id}:
    delete:
      description: Removes a resource from a bundle.
      operationId: removeBundleResource
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
        - description: The ID of the resource to remove.
          example: 72e75a6f-7183-48c5-94ff-6013f213314b
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
        - description: The remote ID of the access level to grant. If omitted, the default access level remote ID value (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: Resource was successfully removed from the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/groups:
    get:
      description: Returns a list of `Group` objects in a given bundle.
      operationId: getBundleGroups
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The maximum number of groups to return from the beginning of the list. Default is 200, max is 1000.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
        - description: A cursor indicating where to start fetching items after a specific point.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedBundleGroupList"
          description: A list of groups for the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
    post:
      description: Adds a group to a bundle.
      operationId: addBundleGroup
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                group_id:
                  description: The ID of the group to add.
                  example: 72e75a6f-7183-48c5-94ff-6013f213314b
                  format: uuid
                  type: string
              required:
                - group_id
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BundleGroup"
          description: Group was successfully added to the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/groups/{group_id}:
    delete:
      description: Removes a group from a bundle.
      operationId: removeBundleGroup
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
        - description: The ID of the group to remove.
          example: 72e75a6f-7183-48c5-94ff-6013f213314b
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
      responses:
        "200":
          description: Group was successfully removed from the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/visibility:
    get:
      description: Gets the visibility of the bundle.
      operationId: getBundleVisibility
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility details of a bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
    put:
      description: Sets the visibility of the bundle.
      operationId: setBundleVisibility
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              description: The visibility details of the bundle. Setting to LIMITED visibility with no visibility groups will make bundle only visible to admins and users with access.
              $ref: "#/components/schemas/VisibilityInfo"
      responses:
        "200":
          description: The visibility details of the bundle were successfully set.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /configuration-templates:
    get:
      description: Returns a list of `ConfigurationTemplate` objects.
      operationId: getConfigurationTemplates
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedConfigurationTemplateList"
          description: One page worth of configuration templates for your organization.
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
    post:
      description: Creates a configuration template.
      operationId: createConfigurationTemplate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateConfigurationTemplateInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConfigurationTemplate"
          description: The configuration template just created.
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
    put:
      description: Update a configuration template.
      operationId: updateConfigurationTemplate
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConfigurationTemplate"
          description: The configuration template just updated.
      requestBody:
        description: Configuration template to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateConfigurationTemplateInfo"
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
  /configuration-templates/{configuration_template_id}:
    delete:
      description: Deletes a configuration template.
      operationId: deleteConfigurationTemplate
      parameters:
        - description: The ID of the configuration template.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: configuration_template_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The configuration template was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
  /events:
    get:
      description: Returns a list of `Event` objects.
      operationId: events
      parameters:
        - description: A start date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-01
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: start_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: An end date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-12
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: end_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: An actor filter for the events. Supply the ID of the actor.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: actor_filter
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: An object filter for the events. Supply the ID of the object.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: object_filter
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: An event type filter for the events.
          example: USER_MFA_RESET
          explode: true
          in: query
          name: event_type_filter
          required: false
          schema:
            type: string
          style: form
        - description: An API filter for the events. Supply the name and preview of the API token.
          example: fullaccess:**************************M_g==
          explode: true
          in: query
          name: api_token_filter
          required: false
          schema:
            type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedEventList"
          description: One page worth of events with the appropriate filters applied.
      security:
        - BearerAuth: []
      tags:
        - events
  /groups:
    get:
      description: Returns a list of groups for your organization.
      operationId: getGroups
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: The group type to filter by.
          example: OPAL_GROUP
          explode: true
          in: query
          name: group_type_filter
          required: false
          schema:
            $ref: "#/components/schemas/GroupTypeEnum"
          style: form
        - description: The group ids to filter by.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
            - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: query
          name: group_ids
          required: false
          schema:
            items:
              example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
              format: uuid
              type: string
            type: array
          style: form
        - description: Group name.
          example: example-name
          explode: true
          in: query
          name: group_name
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedGroupsList"
          description: One page worth groups associated with your organization.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Bulk updates a list of groups.
      operationId: updateGroups
      requestBody:
        description: Groups to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateGroupInfoList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UpdateGroupInfoList"
          description: The resulting updated group infos.
      security:
        - BearerAuth: []
      tags:
        - groups
    post:
      description: Creates an Opal group or [imports a remote group](https://docs.opal.dev/reference/end-system-objects).
      operationId: createGroup
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateGroupInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Group"
          description: The group just created.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}:
    get:
      description: Returns a `Group` object.
      operationId: getGroup
      parameters:
        - description: The ID of the group.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Group"
          description: The requested `Group`.
      security:
        - BearerAuth: []
      tags:
        - groups
    delete:
      description: Deletes a group.
      operationId: delete_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The group was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/message-channels:
    get:
      description: Gets the list of audit and reviewer message channels attached to a group.
      operationId: get_group_message_channels
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannelList"
          description: The audit and reviewer message channels attached to the group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the list of audit message channels attached to a group.
      operationId: set_group_message_channels
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MessageChannelIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated audit message channel IDs for the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/on-call-schedules:
    get:
      description: Gets the list of on call schedules attached to a group.
      operationId: get_group_on_call_schedules
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallScheduleList"
          description: The on call schedules attached to the group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the list of on call schedules attached to a group.
      operationId: set_group_on_call_schedules
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OnCallScheduleIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: bb0197c0-5ea5-45d9-b3b7-b6c439be6435
                  format: uuid
                  type: string
                type: array
          description: The updated on call schedule IDs for the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/resources:
    get:
      description: Gets the list of resources that the group gives access to.
      operationId: get_group_resources
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupResourceList"
          description: The resources that the group gives access to.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the list of resources that the group gives access to.
      operationId: set_group_resources
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateGroupResourcesInfo"
      responses:
        "200":
          description: The group resource were successfully set.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/containing-groups:
    get:
      description: Gets the list of groups that the group gives access to.
      operationId: get_group_containing_groups
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupContainingGroupList"
          description: The resources that the group gives access to.
      security:
        - BearerAuth: []
      tags:
        - groups
    post:
      description: Creates a new containing group.
      operationId: add_group_containing_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GroupContainingGroup"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupContainingGroup"
          description: The created `GroupContainingGroup` object.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/containing-groups/{containing_group_id}:
    get:
      description: Gets a specific containing group for a group.
      operationId: get_group_containing_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the containing group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: containing_group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupContainingGroup"
          description: The created `GroupContainingGroup` object.
      security:
        - BearerAuth: []
      tags:
        - groups
    delete:
      description: Removes a containing group from a group.
      operationId: remove_group_containing_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the containing group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: containing_group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "204":
          description: The containing group was successfully removed from the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/resources/{resource_id}:
    post:
      description: Adds a resource to a group.
      operationId: add_group_resource
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The remote ID of the access level to grant to this user. If omitted, the default access level remote ID value (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
                duration_minutes: 60
              properties:
                access_level_remote_id:
                  description: The remote ID of the access level to grant to this user. If omitted, the default access level remote ID value (empty string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
                duration_minutes:
                  description: The duration for which the resource can be accessed (in minutes). Use 0 to set to indefinite.
                  example: 60
                  type: integer
                  maximum: 525960 # One year
                  minimum: 0
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupResource"
          description: The created `GroupResource` object.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/visibility:
    get:
      description: Gets the visibility of this group.
      operationId: get_group_visibility
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the visibility of this group.
      operationId: set_group_visibility
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/VisibilityInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/reviewers:
    get:
      deprecated: true
      description: Gets the list of owner IDs of the reviewers for a group.
      operationId: get_group_reviewers
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The IDs of owners that are reviewers for this group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      deprecated: true
      description: Sets the list of reviewers for a group.
      operationId: set_group_reviewers
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated IDs of owners that are reviewers for this group
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/reviewer-stages:
    get:
      deprecated: true
      description: Gets the list of reviewer stages for a group.
      operationId: get_group_reviewer_stages
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The reviewer stages for this group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      deprecated: true
      description: Sets the list of reviewer stages for a group.
      operationId: set_group_reviewer_stages
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerStageList"
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The updated reviewer stages for this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/tags:
    get:
      description: Returns all tags applied to the group.
      operationId: get_group_tags
      parameters:
        - description: The ID of the group whose tags to return.
          name: group_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TagsList"
          description: The tags applied to the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/users:
    get:
      description: Gets the list of users for this group.
      operationId: get_group_users
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupUserList"
          description: List of users with access to this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/users/{user_id}:
    post:
      description: Adds a user to this group.
      operationId: add_group_user
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to add.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The duration for which the group can be accessed (in minutes). Use 0 to set to indefinite.
          example: 60
          explode: true
          in: query
          name: duration_minutes
          required: false
          schema:
            type: integer
            maximum: 525960 # One year
          style: form
          deprecated: true
        - description: The remote ID of the access level to grant to this user. If omitted, the default access level remote ID value (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description: The duration for which the group can be accessed (in minutes). Use 0 to set to indefinite.
                  example: 60
                  type: integer
                access_level_remote_id:
                  description: The remote ID of the access level to grant to this user. If omitted, the default access level remote ID value (empty string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
              required:
                - duration_minutes
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupUser"
          description: The GroupUser that was created.
      security:
        - BearerAuth: []
      tags:
        - groups
    delete:
      description: Removes a user's access from this group.
      operationId: delete_group_user
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of a user to remove from this group.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: This user's access was successfully removed from this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /group-bindings:
    get:
      description: Returns a list of `GroupBinding` objects.
      operationId: getGroupBindings
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedGroupBindingsList"
          description: One page worth of group bindings for your organization.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
    post:
      description: Creates a group binding.
      operationId: createGroupBinding
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateGroupBindingInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupBinding"
          description: The group binding just created.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
    put:
      description: Bulk updates a list of group bindings.
      operationId: updateGroupBindings
      requestBody:
        description: Group bindings to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateGroupBindingInfoList"
      responses:
        "200":
          description: The group bindings were successfully updated.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
  /group-bindings/{group_binding_id}:
    get:
      description: Returns a `GroupBinding` object.
      operationId: getGroupBinding
      parameters:
        - description: The ID of the group binding.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: group_binding_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupBinding"
          description: The requested `GroupBinding`.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
    delete:
      description: Deletes a group binding.
      operationId: deleteGroupBinding
      parameters:
        - description: The ID of the group binding.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_binding_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The group binding was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
  /idp-group-mappings/{app_resource_id}:
    get:
      description: Returns the configured set of available `IdpGroupMapping` objects for an Okta app.
      operationId: getIdpGroupMappings
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IdpGroupMappingList"
          description: The configured set of available `IdpGroupMapping` objects for an Okta app.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
    put:
      description: Updates the list of available `IdpGroupMapping` objects for an Okta app.
      operationId: updateIdpGroupMappings
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                mappings:
                  type: array
                  items:
                    properties:
                      group_id:
                        type: string
                        format: uuid
                      alias:
                        type: string
                      hidden_from_end_user:
                        type: boolean
                    type: object
              required:
                - mappings
              type: object
      responses:
        "200":
          description: The updated set of available `IdpGroupMapping` objects for an Okta app.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
  /idp-group-mappings/{app_resource_id}/{group_id}/:
    delete:
      description: Deletes an `IdpGroupMapping` object.
      operationId: delete_idp_group_mappings
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The IDP group mapping was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
  /owners:
    get:
      description: Returns a list of `Owner` objects.
      operationId: get_owners
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: Owner name to filter by.
          example: 200
          explode: true
          in: query
          name: name
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedOwnersList"
          description: One page worth of owners in your organization.
      security:
        - BearerAuth: []
      tags:
        - owners
    post:
      description: Creates an owner.
      operationId: createOwner
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateOwnerInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Owner"
          description: The owner just created.
      security:
        - BearerAuth: []
      tags:
        - owners
    put:
      description: Bulk updates a list of owners.
      operationId: updateOwners
      requestBody:
        description: Owners to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateOwnerInfoList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UpdateOwnerInfoList"
          description: The resulting updated owner infos.
      security:
        - BearerAuth: []
      tags:
        - owners
  /owners/{owner_id}:
    get:
      description: Returns an `Owner` object.
      operationId: getOwner
      parameters:
        - description: The ID of the owner.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Owner"
          description: The owner object associated with the passed-in ID.
      security:
        - BearerAuth: []
      tags:
        - owners
    delete:
      description: Deletes an owner.
      operationId: delete_owner
      parameters:
        - description: The ID of the owner.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The owner was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - owners
  /owners/name/{owner_name}:
    get:
      description: Returns an `Owner` object. Does not support owners with `/` in their name, use /owners?name=... instead.
      operationId: getOwnerFromName
      parameters:
        - description: The name of the owner.
          example: MyOwner
          explode: true
          in: path
          name: owner_name
          required: true
          schema:
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Owner"
          description: The owner object associated with the passed-in name.
      security:
        - BearerAuth: []
      tags:
        - owners
  /owners/{owner_id}/users:
    get:
      description: Gets the list of users for this owner, in escalation priority order if applicable.
      operationId: get_owner_users
      parameters:
        - description: The ID of the owner.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserList"
          description: The users for this owner.
      security:
        - BearerAuth: []
      tags:
        - owners
    put:
      description: Sets the list of users for this owner. If escalation is enabled, the order of this list is the escalation priority order of the users. If the owner has a source group, adding or removing users from this list won't be possible.
      operationId: set_owner_users
      parameters:
        - description: The ID of the owner.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UserIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserList"
          description: The updated users for the owner.
      security:
        - BearerAuth: []
      tags:
        - owners
  /requests:
    get:
      description: Returns a list of requests for your organization that is visible by the admin.
      operationId: getRequests
      parameters:
        - description: A start date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-01
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: start_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: An end date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-12
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: end_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: Boolean toggle for if it should only show pending requests.
          explode: true
          in: query
          name: show_pending_only
          required: false
          schema:
            type: boolean
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestList"
          description: The list of requests.
      security:
        - BearerAuth: []
      tags:
        - requests
    post:
      description: "Create an access request"
      operationId: "createRequest"
      requestBody:
        description: Resources to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateRequestInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  id:
                    format: uuid
                    type: string
                    example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          description: The resulting request.
      security:
        - BearerAuth: []
      tags:
        - requests

  /resources:
    get:
      description: Returns a list of resources for your organization.
      operationId: getResources
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: The resource type to filter by.
          example: AWS_IAM_ROLE
          explode: true
          in: query
          name: resource_type_filter
          required: false
          schema:
            $ref: "#/components/schemas/ResourceTypeEnum"
          style: form
        - description: The resource ids to filter by.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
            - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: query
          name: resource_ids
          required: false
          schema:
            items:
              example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
              format: uuid
              type: string
            type: array
          style: form
        - description: Resource name.
          example: example-name
          explode: true
          in: query
          name: resource_name
          required: false
          schema:
            type: string
          style: form
        - description: The parent resource id to filter by.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: query
          name: parent_resource_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedResourcesList"
          description: One page worth resources associated with your organization.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Bulk updates a list of resources.
      operationId: updateResources
      requestBody:
        description: Resources to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateResourceInfoList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UpdateResourceInfoList"
          description: The resulting updated resource infos.
      security:
        - BearerAuth: []
      tags:
        - resources
    post:
      description: Creates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resources.
      operationId: createResource
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateResourceInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Resource"
          description: The resource just created.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}:
    get:
      description: Retrieves a resource.
      operationId: get_resource
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The requested resource.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Resource"
      security:
        - BearerAuth: []
      tags:
        - resources
    delete:
      description: Deletes a resource.
      operationId: delete_resource
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The resource was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/message-channels:
    get:
      description: Gets the list of audit message channels attached to a resource.
      operationId: get_resource_message_channels
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannelList"
          description: The audit message channels attached to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the list of audit message channels attached to a resource.
      operationId: set_resource_message_channels
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MessageChannelIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated audit message channel IDs for the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/visibility:
    get:
      description: Gets the visibility of this resource.
      operationId: get_resource_visibility
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the visibility of this resource.
      operationId: set_resource_visibility
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/VisibilityInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/reviewers:
    get:
      description: Gets the list of owner IDs of the reviewers for a resource.
      operationId: get_resource_reviewers
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The IDs of owners that are reviewers for this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the list of reviewers for a resource.
      operationId: set_resource_reviewers
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated IDs of owners that are reviewers for this resource
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/reviewer-stages:
    get:
      description: Gets the list reviewer stages for a resource.
      operationId: get_resource_reviewer_stages
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The reviewer stages for this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the list of reviewer stages for a resource.
      operationId: set_resource_reviewer_stages
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerStageList"
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The updated reviewer stages for this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /non-human-identities:
    get:
      description: Returns a list of non-human identities for your organization.
      operationId: get_nhis
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedResourcesList"
          description: One page worth non-human identities in your organization.
      security:
        - BearerAuth: []
      tags:
        - non-human-identities
  /resources/{resource_id}/non-human-identities:
    get:
      description: Gets the list of non-human identities with access to this resource.
      operationId: get_resource_nhis
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: Limit the number of results returned.
          example: 200
          explode: true
          in: query
          name: limit
          required: false
          schema:
            type: integer
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessList"
          description: List of non-human identities with access to this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/users:
    get:
      description: Gets the list of users for this resource.
      operationId: get_resource_users
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: Limit the number of results returned.
          example: 200
          explode: true
          in: query
          name: limit
          required: false
          schema:
            type: integer
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceAccessUserList"
          description: List of users with access to this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/non-human-identities/{non_human_identity_id}:
    post:
      description: Gives a non-human identity access to this resource.
      operationId: add_resource_nhi
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The resource ID of the non-human identity to add.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: non_human_identity_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                duration_minutes: 60
                access_level_remote_id: roles/cloudsql.instanceUser
              properties:
                duration_minutes:
                  description: The duration for which the resource can be accessed (in minutes). Use 0 to set to indefinite.
                  example: 60
                  type: integer
                  maximum: 525960 # One year
                access_level_remote_id:
                  description: The remote ID of the access level to grant. If omitted, the default access level remote ID value (empty string) is used.
                  example: roles/cloudsql.instanceUser
                  type: string
              required:
                - duration_minutes
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceNHI"
          description: Details about the access that the non-human identity was granted to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    delete:
      description: Removes a non-human identity's direct access from this resource.
      operationId: delete_resource_nhi
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The resource ID of the non-human identity to remove from this resource.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: non_human_identity_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The remote ID of the access level for which this non-human identity has direct access. If omitted, the default access level remote ID value (empty string) is assumed.
          example: roles/cloudsql.instanceUser
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: This non-human identity's access was successfully removed from this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/users/{user_id}:
    post:
      description: Adds a user to this resource.
      operationId: add_resource_user
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to add.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The duration for which the resource can be accessed (in minutes). Use 0 to set to indefinite.
          example: 60
          explode: true
          in: query
          name: duration_minutes
          required: false
          schema:
            type: integer
            maximum: 525960 # One year
          style: form
          deprecated: true
        - description: The remote ID of the access level to grant to this user. If omitted, the default access level remote ID value (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description: The duration for which the resource can be accessed (in minutes). Use 0 to set to indefinite.
                  example: 60
                  type: integer
                  maximum: 525960 # One year
                access_level_remote_id:
                  description: The remote ID of the access level to grant to this user. If omitted, the default access level remote ID value (empty string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
              required:
                - duration_minutes
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceUser"
          description: The ResourceUser that was created.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Updates a user's access level or duration on this resource.
      operationId: update_resource_user
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user whose access is being updated.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description: The updated duration for which the resource can be accessed (in minutes). Use 0 for indefinite.
                  type: integer
                  maximum: 525960 # One year
                  example: 120
                access_level_remote_id:
                  description: The updated remote ID of the access level granted to this user.
                  type: string
                  example: arn:aws:iam::590304332660:role/ReadOnlyAccess
              required:
                - duration_minutes
      responses:
        "200":
          description: The ResourceUser was successfully updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceUser"
      security:
        - BearerAuth: []
      tags:
        - resources
    delete:
      description: Removes a user's direct access from this resource.
      operationId: delete_resource_user
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of a user to remove from this resource.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The remote ID of the access level for which this user has direct access. If omitted, the default access level remote ID value (empty string) is assumed.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: This user's access was successfully removed from this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resource-user-access-status/{resource_id}/{user_id}:
    get:
      deprecated: true
      description: Get user's access status to a resource.
      operationId: resource_user_access_status_retrieve
      parameters:
        - description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The remote ID of the access level that you wish to query for the resource. If omitted, the default access level remote ID value (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceUserAccessStatus"
          description: The access status reflecting the user's access to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/tags:
    get:
      description: Returns all tags applied to the resource.
      operationId: get_resource_tags
      parameters:
        - description: The ID of the resource whose tags to return.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TagsList"
          description: The tags applied to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /sessions:
    get:
      description: Returns a list of `Session` objects.
      operationId: sessions
      parameters:
        - description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: true
          in: query
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: form
        - description: The ID of the user you wish to query sessions for.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: query
          name: user_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SessionsList"
          description: The sessions associated with a resource.
      security:
        - BearerAuth: []
      tags:
        - sessions
  /user:
    get:
      description: Returns a `User` object.
      operationId: user
      parameters:
        - description: The user ID of the user.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: query
          name: user_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: The email of the user. If both user ID and email are provided, user ID will take precedence. If neither are provided, an error will occur.
          example: johndoe@domain.org
          explode: true
          in: query
          name: email
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The user object associated with the passed-in email or ID.
      security:
        - BearerAuth: []
      tags:
        - users
  /users:
    get:
      description: Returns a list of users for your organization.
      operationId: getUsers
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedUsersList"
          description: One page worth users in your organization.
      security:
        - BearerAuth: []
      tags:
        - users
  /users/{user_id}/tags:
    get:
      description: Returns all tags applied to the user.
      operationId: get_user_tags
      parameters:
        - description: The ID of the user whose tags to return.
          name: user_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TagsList"
          description: The tags applied to the user.
      security:
        - BearerAuth: []
      tags:
        - users
  /access-rules:
    post:
      description: Creates a new access rule config for the given group_id.
      operationId: create_access_rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateAccessRuleInfo"
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRule"
          description: The created access rule config for the group.
      security:
          - BearerAuth: []
      tags:
          - access-rules
  /access-rules/{access_rule_id}:
    get:
      description: Returns a list of access rule config given the group_id of the access rule.
      operationId: get_access_rule
      parameters:
        - description: The access rule ID (group ID) of the access rule.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: access_rule_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRule"
          description: The access rules for the group.
      security:
        - BearerAuth: []
      tags:
        - access-rules
    put:
      description: Updates the access rule config for the given group_id.
      operationId: update_access_rule
      parameters:
        - description: The access rule ID (group ID) of the access rule.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: access_rule_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateAccessRuleInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRule"
          description: The updated access rule config for the group.
      security:
        - BearerAuth: []
      tags:
        - access-rules
  /tag/{tag_id}:
    get:
      description: UNSTABLE. May be removed at any time. Gets a tag with the given id.
      operationId: get_tag_by_ID
      parameters:
        - description: The tag ID
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: tag_id
          required: true
          schema:
            type: string
            format: uuid
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Tag"
          description: The tag requested.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: UNSTABLE. May be removed at any time. Deletes a tag with the given id.
      operationId: delete_tag_by_ID
      parameters:
        - description: The tag ID
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: tag_id
          required: true
          schema:
            type: string
            format: uuid
          style: simple
      responses:
        "200":
          description: Tag was deleted.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tag:
    get:
      description: Gets a tag with the given key and value.
      operationId: get_tag
      parameters:
        - description: The key of the tag to get.
          example: api-scope
          explode: false
          in: query
          name: tag_key
          required: true
          schema:
            type: string
          style: form
        - description: The value of the tag to get.
          example: production
          explode: false
          in: query
          name: tag_value
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Tag"
          description: The tag requested.
      security:
        - BearerAuth: []
      tags:
        - tags
    post:
      description: Creates a tag with the given key and value.
      operationId: create_tag
      parameters:
        - description: The key of the tag to create.
          example: api-scope
          explode: false
          in: query
          name: tag_key
          required: false
          schema:
            type: string
          style: form
          deprecated: true
        - description: The value of the tag to create.
          example: production
          explode: false
          in: query
          name: tag_value
          required: false
          schema:
            type: string
          style: form
          deprecated: true
        - description: The ID of the owner that manages the tag.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: query
          name: admin_owner_id
          schema:
            format: uuid
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateTagInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Tag"
          description: The tag that was created.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags:
    get:
      description: Returns a list of tags created by your organization.
      operationId: getTags
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedTagsList"
          description: A list of tags created by your organization.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags/{tag_id}/users/{user_id}:
    post:
      description: Applies a tag to a user.
      operationId: add_user_tag
      parameters:
        - description: The ID of the tag to apply.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to apply the tag to.
          name: user_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag applied to user successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: Removes a tag from a user.
      operationId: remove_user_tag
      parameters:
        - description: The ID of the tag to remove.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to remove the tag from.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag removed from user successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags/{tag_id}/groups/{group_id}:
    post:
      description: Applies a tag to a group.
      operationId: add_group_tag
      parameters:
        - description: The ID of the tag to apply.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group to apply the tag to.
          name: group_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag applied to group successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: Removes a tag from a group.
      operationId: remove_group_tag
      parameters:
        - description: The ID of the tag to remove.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group to remove the tag from.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag removed from group successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags/{tag_id}/resources/{resource_id}:
    post:
      description: Applies a tag to a resource.
      operationId: add_resource_tag
      parameters:
        - description: The ID of the tag to apply.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the resource to apply the tag to.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag applied to resource successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: Removes a tag from a resource.
      operationId: remove_resource_tag
      parameters:
        - description: The ID of the tag to remove.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the resource to remove the tag from.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag removed from resource successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
  /message-channels:
    get:
      description: Returns a list of `MessageChannel` objects.
      operationId: get_message_channels
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannelList"
          description: A list of message channels for your organization.
      security:
        - BearerAuth: []
      tags:
        - message-channels
    post:
      description: Creates a `MessageChannel` objects.
      operationId: create_message_channel
      requestBody:
        description: The `MessageChannel` object to be created.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateMessageChannelInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannel"
          description: The message channel that was created.
      security:
        - BearerAuth: []
      tags:
        - message-channels
  /message-channels/{message_channel_id}:
    get:
      description: Gets a `MessageChannel` object.
      operationId: get_message_channel
      parameters:
        - description: The ID of the message_channel.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: message_channel_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannel"
          description: The requested message channel.
      security:
        - BearerAuth: []
      tags:
        - message-channels
  /on-call-schedules:
    get:
      description: Returns a list of `OnCallSchedule` objects.
      operationId: get_on_call_schedules
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallScheduleList"
          description: A list of on call schedules for your organization.
      security:
        - BearerAuth: []
      tags:
        - on-call-schedules
    post:
      description: Creates a `OnCallSchedule` objects.
      operationId: create_on_call_schedule
      requestBody:
        description: The `OnCallSchedule` object to be created.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateOnCallScheduleInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallSchedule"
          description: The on call schedule that was created.
      security:
        - BearerAuth: []
      tags:
        - on-call-schedules
  /on-call-schedules/{on_call_schedule_id}:
    get:
      description: Gets a `OnCallSchedule` object.
      operationId: get_on_call_schedule
      parameters:
        - description: The ID of the on_call_schedule.
          example: 9546209c-42c2-4801-96d7-9ec42df0f59c
          explode: false
          in: path
          name: on_call_schedule_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallSchedule"
          description: The requested on call schedule.
      security:
        - BearerAuth: []
      tags:
        - on-call-schedules
  /uars:
    get:
      description: Returns a list of `UAR` objects.
      operationId: getUARs
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedUARsList"
          description: A list of UARs for your organization.
      security:
        - BearerAuth: []
      tags:
        - uars
  /uar:
    post:
      description: Starts a User Access Review.
      operationId: create_uar
      requestBody:
        description: The settings of the UAR.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateUARInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UAR"
          description: The UAR that was started.
      security:
        - BearerAuth: []
      tags:
        - uars
  /uar/{uar_id}:
    get:
      description: Retrieves a specific UAR.
      operationId: get_uar
      parameters:
        - description: The ID of the UAR.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: uar_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UAR"
          description: The UAR that was requested.
      security:
        - BearerAuth: []
      tags:
        - uars
  /sync_errors:
    get:
      description: Returns a list of recent sync errors that have occurred since the last successful sync.
      operationId: getSyncErrors
      parameters:
        - description: The ID of the app to list sync errors for.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: false
          in: query
          name: app_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: The ID of the resource to list sync errors for.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: query
          name: resource_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: The ID of the group to list sync errors for.
          example: 9546209c-42c2-4801-96d7-9ec42df0f59c
          explode: false
          in: query
          name: group_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/SyncErrorList"
                type: array
          description: A list of sync errors.
      security:
        - BearerAuth: []
      tags:
        - apps
components:
  schemas:
    UARScope:
      description: If set, the access review will only contain resources and groups that match at least one of the filters in scope.
      example:
        filter_operator: ANY
        users:
          - userd283-ca87-4a8a-bdbb-df212eca5353
        include_group_bindings: True
        tags:
          - key: uar_scope
            value: high_priority
        names:
          - demo
          - api
        admins:
          - f454d283-ca87-4a8a-bdbb-df212eca5353
          - 8763d283-ca87-4a8a-bdbb-df212ecab139
        resource_types:
          - GCP_CLOUD_SQL_POSTGRES_INSTANCE
        group_types:
          - AWS_SSO_GROUP
        apps:
          - pas2d283-ca87-4a8a-bdbb-df212eca5353
          - apss2d283-ca87-4a8a-bdbb-df212eca5353
        entities:
          - f454d283-as87-4a8a-bdbb-df212eca5353
          - f454d283-as87-4a8a-bdbb-df212eca5329
      properties:
        group_visibility:
          description: Specifies what users can see during an Access Review
          type: string
          enum: [STRICT, VIEW_VISIBLE_AND_ASSIGNED, VIEW_ALL]
        users:
          description: The access review will only include the following users. If any users are selected, any entity filters will be applied to only the entities that the selected users have access to.
          items:
            example: userd283-ca87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        filter_operator:
          description: Specifies whether entities must match all (AND) or any (OR) of the filters.
          type: string
          enum: [ANY, ALL]
        entities:
          description: This access review will include resources and groups with ids in the given strings.
          items:
            example: f454d283-as87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        apps:
          description: This access review will include items in the specified applications
          items:
            example: pas2d283-ca87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        admins:
          description: This access review will include resources and groups who are owned by one of the owners corresponding to the given IDs.
          items:
            example: f454d283-ca87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        group_types:
          description: This access review will include items of the specified group types
          type: array
          items:
            $ref: "#/components/schemas/GroupTypeEnum"
        resource_types:
          description: This access review will include items of the specified resource types
          type: array
          items:
            $ref: "#/components/schemas/ResourceTypeEnum"
        include_group_bindings:
          type: boolean
          example: False
        tags:
          description: This access review will include resources and groups who are tagged with one of the given tags.
          items:
            $ref: "#/components/schemas/TagFilter"
          type: array
        names:
          description: This access review will include resources and groups whose name contains one of the given strings.
          items:
            example: demo
            type: string
          type: array
      type: object
    PaginatedUARsList:
      description: A list of UARs.
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - uar_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: Monthly UAR (July)
            send_reviewer_assignment_notification: False
            deadline: 2022-07-14T06:59:59Z
            time_zone: America/Los_Angeles
            self_review_allowed: False
            uar_scope:
              tags:
                - key: uar_scope
                  value: high_priority
              names:
                - demo
                - api
              admins:
                - f454d283-ca87-4a8a-bdbb-df212eca5353
                - 8763d283-ca87-4a8a-bdbb-df212ecab139
          - uar_id: 39a4d283-ca87-4a8a-bdbb-df212eca5fdb
            name: Monthly UAR (August)
            send_reviewer_assignment_notification: True
            deadline: 2022-08-14T06:59:59Z
            time_zone: America/Los_Angeles
            self_review_allowed: False
            uar_scope:
              tags:
                - key: uar_scope
                  value: high_priority
              names:
                - demo
                - api
              admins:
                - f454d283-ca87-4a8a-bdbb-df212eca5353
                - 8763d283-ca87-4a8a-bdbb-df212ecab139
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/UAR"
          type: array
      required:
        - results
      type: object
    UAR:
      description: A user access review.
      example:
        uar_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: Monthly UAR (July)
        send_reviewer_assignment_notification: False
        deadline: 2022-07-14T06:59:59Z
        time_zone: America/Los_Angeles
        self_review_allowed: False
        uar_scope:
          tags:
            - key: uar_scope
              value: high_priority
          names:
            - demo
            - api
          admins:
            - f454d283-ca87-4a8a-bdbb-df212eca5353
            - 8763d283-ca87-4a8a-bdbb-df212ecab139
      properties:
        uar_id:
          description: The ID of the UAR.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the UAR.
          example: Monthly UAR (July)
          type: string
        reviewer_assignment_policy:
          $ref: "#/components/schemas/UARReviewerAssignmentPolicyEnum"
        send_reviewer_assignment_notification:
          description: A bool representing whether to send a notification to reviewers when they're assigned a new review. Default is False.
          example: False
          type: boolean
        deadline:
          description: The last day for reviewers to complete their access reviews.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        time_zone:
          description: The time zone name (as defined by the IANA Time Zone database) used in the access review deadline and exported audit report. Default is America/Los_Angeles.
          example: America/Los_Angeles
          type: string
        self_review_allowed:
          description: A bool representing whether to present a warning when a user is the only reviewer for themself. Default is False.
          example: False
          type: boolean
        uar_scope:
          $ref: "#/components/schemas/UARScope"
      required:
        - uar_id
        - name
        - deadline
        - reviewer_assignment_policy
        - send_reviewer_assignment_notification
        - time_zone
        - self_review_allowed
      type: object
    CreateUARInfo:
      description: Information needed to start a user access review.
      example:
        name: Monthly UAR (July)
        send_reviewer_assignment_notification: False
        deadline: 2022-07-14T06:59:59Z
        time_zone: America/Los_Angeles
        self_review_allowed: False
        reminder_schedule: [7, 3, 1, 0]
        reminder_include_manager: True
        uar_scope:
          group_visibility: STRICT
          tags:
            - key: uar_scope
              value: high_priority
          names:
            - demo
            - api
          admins:
            - f454d283-ca87-4a8a-bdbb-df212eca5353
            - 8763d283-ca87-4a8a-bdbb-df212ecab139
      properties:
        name:
          description: The name of the UAR.
          example: Monthly UAR (July)
          type: string
        reviewer_assignment_policy:
          $ref: "#/components/schemas/UARReviewerAssignmentPolicyEnum"
        send_reviewer_assignment_notification:
          description: A bool representing whether to send a notification to reviewers when they're assigned a new review. Default is False.
          example: False
          type: boolean
        deadline:
          description: The last day for reviewers to complete their access reviews.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        time_zone:
          description: The time zone name (as defined by the IANA Time Zone database) used in the access review deadline and exported audit report. Default is America/Los_Angeles.
          example: America/Los_Angeles
          type: string
        self_review_allowed:
          description: A bool representing whether to present a warning when a user is the only reviewer for themself. Default is False.
          example: False
          type: boolean
        reminder_schedule:
          items:
            type: integer
          type: array
        reminder_include_manager:
          type: boolean
          example: False
        uar_scope:
          $ref: "#/components/schemas/UARScope"
      required:
        - name
        - deadline
        - reviewer_assignment_policy
        - send_reviewer_assignment_notification
        - time_zone
        - self_review_allowed
      type: object
    UARReviewerAssignmentPolicyEnum:
      description: A policy for auto-assigning reviewers. If auto-assignment is on, specific assignments can still be manually adjusted after the access review is started. Default is Manually.
      enum:
        - MANUALLY
        - BY_OWNING_TEAM_ADMIN
        - BY_MANAGER
      example: MANUALLY
      type: string
    TagFilter:
      description: A tag filter defined by the tags key and value.
      example:
        key: uar_scope
        value: high_priority
      properties:
        key:
          description: The key of the tag.
          example: uar_scope
          type: string
        value:
          description: The value of the tag.
          example: high_priority
          type: string
      required:
        - key
      type: object
    AppsList:
      description: A list of apps.
      example:
        - app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
          name: Okta Org
          description: Okta directory for the engineering team.
          admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
          app_type: OKTA_DIRECTORY
        - app_id: 5247d283-ca87-4a8a-bdbb-df212eca1243
          name: Prod AWS Account
          description: Our production engineering account for AWS.
          admin_owner_id: aab485d-0651-43e2-a748-d69d6584123af
          app_type: AWS
      properties:
        apps:
          items:
            $ref: "#/components/schemas/App"
          type: array
      required:
        - apps
      type: object
    App:
      description: |-
        # App Object
        ### Description
        The `App` object is used to represent an app to an application.

        ### Usage Example
        List from the `GET Apps` endpoint.
      example:
        app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: Okta Org
        description: Okta directory for the engineering team.
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        app_type: OKTA_DIRECTORY
      properties:
        app_id:
          description: The ID of the app.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the app.
          example: Okta Org
          type: string
        description:
          description: A description of the app.
          example: Okta directory for the engineering team.
          type: string
        admin_owner_id:
          description: The ID of the owner of the app.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        app_type:
          $ref: "#/components/schemas/AppTypeEnum"
        validations:
          description: Validation checks of an apps' configuration and permissions.
          items:
            $ref: "#/components/schemas/AppValidation"
          type: array
      required:
        - app_id
        - name
        - description
        - admin_owner_id
        - app_type
      type: object
    AppTypeEnum:
      description: The type of an app.
      enum:
        - ACTIVE_DIRECTORY
        - AZURE_AD
        - AWS
        - AWS_SSO
        - CUSTOM
        - DUO
        - GCP
        - GIT_HUB
        - GIT_LAB
        - GOOGLE_GROUPS
        - GOOGLE_WORKSPACE
        - LDAP
        - MARIADB
        - MONGO
        - MONGO_ATLAS
        - MYSQL
        - OKTA_DIRECTORY
        - OPAL
        - PAGERDUTY
        - SALESFORCE
        - TAILSCALE
        - TELEPORT
        - WORKDAY
      example: OKTA_DIRECTORY
      type: string
    EntityTypeEnum:
      description: The type of an entity.
      enum:
        - GROUP
        - RESOURCE
        - USER
      example: GROUP
      type: string
    Event:
      description: |-
        # Event Object
        ### Description
        The `Event` object is used to represent an event.

        ### Usage Example
        Fetch from the `LIST Events` endpoint.
      example:
        event_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        actor_user_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        created_at: 2022-01-23T04:56:07Z
        event_type: USERS_CREATED
      properties:
        event_id:
          description: The ID of the event.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        actor_user_id:
          description: The ID of the actor user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        actor_name:
          description: The name of the actor user.
          example: John Smith
          format: string
        actor_email:
          description: The email of the actor user.
          example: john@acmecorp.com
          type: string
        event_type:
          description: The event type.
          example: USERS_CREATED
          type: string
        created_at:
          description: The day and time the event was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        actor_ip_address:
          description: The IP address of the event actor.
          example: 255.255.255.0
          type: string
        api_token_name:
          description: The name of the API token used to create the event.
          example: My API Token
          type: string
        api_token_preview:
          description: The preview of the API token used to create the event.
          example: "**************************M_g=="
          type: string
        sub_events:
          items:
            $ref: "#/components/schemas/SubEvent"
          type: array
      required:
        - event_id
        - actor_user_id
        - actor_name
        - event_type
        - created_at
      type: object
    AppValidation:
      description: |-
        # App validation object
        ### Description
        The `AppValidation` object is used to represent a validation check of an apps' configuration and permissions.

        ### Usage Example
        List from the `GET Apps` endpoint.
      example:
        key: "iam:GetRole"
        name: "Opal's service account is missing the 'iam:GetRole' permission."
        usage_reason: "Opal uses the 'iam:GetRole' permissions to view access to resources."
        details: "403 Google API Error. Service account is not authorized to access role assignments."
        severity: HIGH
        status: FAILED
        updated_at: 2021-01-06T20:00:00Z
      properties:
        key:
          description: The key of the app validation. These are not unique IDs between runs.
          example: "iam:GetUser"
          type: string
        name:
          description: The human-readable description of whether the validation has the permissions.
          example: "Opal's service account is missing the 'iam:GetUser' description."
        usage_reason:
          description: The reason for needing the validation.
          example: Opal uses the 'iam:GetUser' permission to import users.
          type: string
        details:
          description: Extra details regarding the validation. Could be an error message or restrictions on permissions.
          example: 403 Google API Error. Service account is not authorized to access role assignments.
          type: string
        severity:
          $ref: "#/components/schemas/AppValidationSeverityEnum"
        status:
          $ref: "#/components/schemas/AppValidationStatusEnum"
        updated_at:
          description: The date and time the app validation was last run.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
      required:
        - key
        - name
        - status
        - severity
        - updated_at
    AppValidationSeverityEnum:
      description: The severity of an app validation.
      enum:
        - CRITICAL
        - HIGH
        - MEDIUM
        - LOW
      example: CRITICAL
      type: string
    AppValidationStatusEnum:
      description: The status of an app validation.
      enum:
        - SUCCESS
        - FAILED
      example: FAILED
      type: string
    SubEvent:
      description: |-
        # Sub event Object
        ### Description
        The `SubEvent` object is used to represent a subevent.

        ### Usage Example
        Fetch from the `LIST Events` endpoint.
      example:
        sub_event_type: USERS_CREATED
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        user_name: John Smith
        resource_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_name: Figma
      properties:
        sub_event_type:
          description: The subevent type.
          example: USERS_CREATED
          type: string
      required:
        - sub_event_type
      type: object
      additionalProperties: true
    PaginatedEventList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - event_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            actor_user_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            created_at: 2022-01-23T04:56:07Z
            event_type: USERS_CREATED
          - event_id: 7646aa9a-e2ee-4eb5-8c62-91f29038a373
            actor_user_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            created_at: 2022-02-03T12:33:02Z
            event_type: USER_TEAM_UPDATED
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Event"
          type: array
      type: object
    ResourceAccessUserList:
      example:
        results:
          - full_name: Jake Barnes
            user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-01-23T04:56:07Z
            email: jake@company.dev
            has_direct_access: true
            num_access_paths: 2
          - full_name: Brett Ashley
            user_id: 7646aa9a-e2ee-4eb5-8c62-91f29038a373
            resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-02-03T12:33:02Z
            email: brett@company.dev
            has_direct_access: true
            num_access_paths: 3
      properties:
        results:
          items:
            $ref: "#/components/schemas/ResourceAccessUser"
          type: array
      type: object
    ResourceAccessLevel:
      description: |-
        # Access Level Object
        ### Description
        The `AccessLevel` object is used to represent the level of access that a principal has. The "default" access
        level is a `AccessLevel` object whose fields are all empty strings.

        ### Usage Example
        View the `AccessLevel` of a resource/user or resource/group pair to see the level of access granted to the resource.
      example:
        access_level_name: AdminRole
        access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
      properties:
        access_level_name:
          description: The human-readable name of the access level.
          example: AdminRole
          type: string
        access_level_remote_id:
          description: The machine-readable identifier of the access level.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          type: string
      required:
        - access_level_name
        - access_level_remote_id
      type: object
    ResourceUserAccessStatus:
      description: |-
        # AccessStatus Object
        ### Description
        The `AccessStatus` object is used to represent the user's access to the resource.

        ### Usage Example
        View the `AccessStatus` for a resource/user pair to determine if the user has access to the resource.
      example:
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        status: AUTHORIZED
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        status:
          $ref: "#/components/schemas/ResourceUserAccessStatusEnum"
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - resource_id
        - status
        - user_id
      type: object
    ResourceUserAccessStatusEnum:
      description: The status of the user's access to the resource.
      enum:
        - AUTHORIZED
        - REQUESTED
        - UNAUTHORIZED
      example: AUTHORIZED
      type: string
    ResourceUser:
      description: |-
        # Resource User Object
        ### Description
        The `ResourceUser` object is used to represent a user with direct access to a resource.
      example:
        full_name: Jake Barnes
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        email: jake@company.dev
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        email:
          description: The user's email.
          example: jake@company.dev
          type: string
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - email
        - full_name
        - resource_id
        - user_id
        - access_level
      type: object
    ResourceAccessUser:
      description: |-
        # Resource Access User Object
        ### Description
        The `ResourceAccessUser` object is used to represent a user with access to a resource, either directly or indirectly through group(s).

        ### Usage Example
        Fetch from the `LIST ResourceUsers` endpoint.
      example:
        full_name: Jake Barnes
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        email: jake@company.dev
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        email:
          description: The user's email.
          example: jake@company.dev
          type: string
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        has_direct_access:
          description: The user has direct access to this resources (vs. indirectly, like through a group).
          example: true
          type: boolean
        num_access_paths:
          description: The number of ways in which the user has access through this resource (directly and indirectly).
          example: 3
          format: int32
          type: integer
        propagation_status:
          $ref: "#/components/schemas/PropagationStatus"
      required:
        - email
        - full_name
        - resource_id
        - user_id
        - access_level
        - has_direct_access
        - num_access_paths
      type: object
    AccessList:
      example:
        results:
          - principal_id: 74908af0-9383-4feb-b7ea-8b305d737338
            principal_type: RESOURCE
            entity_id: db04925a-635d-4764-870e-500b9b035c8e
            entity_type: RESOURCE
            expiration_date: 2022-01-23T04:56:07Z
            has_direct_access: true
            num_access_paths: 3
          - principal_id: d940df34-726a-4403-864e-16cb2a0d6793
            principal_type: RESOURCE
            entity_id: c26cd16c-a3fa-4b82-96b1-32177f8b8f59
            entity_type: RESOURCE
            expiration_date: 2022-01-23T04:56:07Z
            has_direct_access: true
            num_access_paths: 3
      properties:
        results:
          items:
            $ref: "#/components/schemas/Access"
          type: array
      type: object
    Access:
      description: |-
        # Access Object
        ### Description
        The `Access` object is used to represent a principal's access to an entity, either directly or inherited.

        ### Usage Example
        Fetch from the `LIST ResourceNonHumanIdentities` endpoint.
      example:
        principal_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        principal_type: RESOURCE
        entity_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        entity_type: RESOURCE
        expiration_date: 2022-01-23T04:56:07Z
        has_direct_access: true
        num_access_paths: 3
      properties:
        principal_id:
          description: The ID of the principal with access.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        principal_type:
          $ref: "#/components/schemas/EntityTypeEnum"
        entity_id:
          description: The ID of the entity being accessed.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        entity_type:
          $ref: "#/components/schemas/EntityTypeEnum"
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        expiration_date:
          description: The day and time the principal's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        has_direct_access:
          description: The principal has direct access to this entity (vs. inherited access).
          example: true
          type: boolean
        num_access_paths:
          description: The number of ways in which the principal has access to this entity (directly and inherited).
          example: 3
          format: int32
          type: integer
      required:
        - principal_id
        - principal_type
        - entity_id
        - entity_type
        - has_direct_access
        - num_access_paths
      type: object
    ResourceNHI:
      description: |-
        # Resource Non-Human Identity Direct Access Object
        ### Description
        This object is used to represent a non-human identity with direct access to a resource.
      example:
        non_human_identity_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        non_human_identity_id:
          description: The resource ID of the non-human identity.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        expiration_date:
          description: The day and time the non-human identity's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - resource_id
        - non_human_identity_id
      type: object
    SessionsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - connection_id: h0z968412-2451-4bbd-42h4-057l715d917m
            user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-01-23T04:56:07Z
          - connection_id: 6e6b5597-bd36-4f4c-a629-01e3fa791932
            user_id: b031c922-b84f-4424-9f4f-c49c05871bfe
            resource_id: 77eb1ab7-2c27-4fc4-afdb-137e1265cddd
            expiration_date: 2022-03-12T07:22:18Z
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Session"
          type: array
      type: object
    Session:
      description: |-
        # Session Object
        ### Description
        The `Session` object is used to represent an access session. Some resources can be accessed temporarily via a time-bounded session.

        ### Usage Example
        Fetch from the `LIST Sessions` endpoint.
      example:
        connection_id: h0z968412-2451-4bbd-42h4-057l715d917m
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
      properties:
        connection_id:
          description: The ID of the connection.
          example: h0z968412-2451-4bbd-42h4-057l715d917m
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: false
          type: string
      required:
        - connection_id
        - user_id
        - resource_id
        - access_level
        - expiration_date
      type: object
    PaginatedUsersList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            email: john.doe@company.dev
            full_name: John Doe
            position: Senior Engineer
          - user_id: e8581682-04f7-473a-a419-472f0fb26d46
            email: jane.smith@company.dev
            full_name: Jane Smith
            position: Product Marketing Lead
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/User"
          type: array
      type: object
      required:
        - results
    User:
      description: |-
        # User Object
        ### Description
        The `User` object is used to represent a user.

        ### Usage Example
        Fetch from the `LIST Sessions` endpoint.
      example:
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        email: john.doe@company.dev
        full_name: John Doe
        first_name: John
        last_name: Doe
        position: Engineer
      properties:
        user_id:
          description: The ID of the user.
          example: h0z968412-2451-4bbd-42h4-057l715d917m
          format: uuid
          type: string
        email:
          description: The email of the user.
          example: john.doe@company.dev
          type: string
        full_name:
          description: The full name of the user.
          example: John Doe
          type: string
        first_name:
          description: The first name of the user.
          example: John
          type: string
        last_name:
          description: The last name of the user.
          example: Doe
          type: string
        position:
          description: The user's position.
          example: Senior Engineer
          type: string
        hr_idp_status:
          $ref: "#/components/schemas/UserHrIdpStatusEnum"
      required:
        - user_id
        - email
        - full_name
        - first_name
        - last_name
        - position
      type: object
    UserList:
      description: A list of users.
      properties:
        users:
          items:
            $ref: "#/components/schemas/User"
          type: array
      type: object
      required:
        - users
    UserIDList:
      description: A list of user IDs.
      example:
        user_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        user_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - user_ids
    UserHrIdpStatusEnum:
      description: User status pulled from an HR/IDP provider.
      enum:
        - ACTIVE
        - SUSPENDED
        - DEPROVISIONED
        - DELETED
        - NOT_FOUND
      example: ACTIVE
      type: string
    PaginatedGroupsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
            description: This group represents Active Directory group "Payments Production Admin". We use this AD group to facilitate staging deployments and qualifying new releases.
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            description: Manages the Integrations Team on-call privileged resources. This group is automatically synced with the on-call rotation defined in PagerDuty.
            admin_owner_id: 4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Group"
          type: array
      type: object
      required:
        - results
    GroupResource:
      description: |-
        # GroupResource Object
        ### Description
        The `GroupResource` object is used to represent a relationship between a group and a resource.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        resource_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        access_level_remote_id: "write"
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        resource_id:
          description: The ID of the resource.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
      required:
        - group_id
        - resource_id
        - access_level
      type: object
    GroupContainingGroup:
      description: |-
        # GroupContainingGroup Object
        ### Description
        The `GroupContainingGroup` object is used to represent a relationship between a group and a group.
      example:
        containing_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        containing_group_id:
          description: The groupID of the containing group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
      required:
        - containing_group_id
      type: object
    Group:
      description: |-
        # Group Object
        ### Description
        The `Group` object is used to represent a group.

        ### Usage Example
        Update from the `UPDATE Groups` endpoint.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        remote_id: 037m2jsg218b2wb
        remote_name: Finance Team
        description: This group represents Active Directory group "Payments Production Admin". We use this AD group to facilitate staging deployments and qualifying new releases.
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        app_id:
          description: The ID of the group's app.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        name:
          description: The name of the group.
          example: API Group
          type: string
        description:
          description: A description of the group.
          example: This group represents Active Directory group "Payments Production Admin". We use this AD group to facilitate staging deployments and qualifying new releases.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        group_leader_user_ids:
          description: A list of User IDs for the group leaders of the group
          items:
            type: string
            format: uuid
          type: array
        remote_id:
          description: The ID of the remote.
          example: google-group-group:037m2jsg218b2wb
          type: string
        remote_name:
          description: The name of the remote.
          example: Finance team
          type: string
        group_type:
          $ref: "#/components/schemas/GroupTypeEnum"
        max_duration:
          description: The maximum duration for which the group can be requested (in minutes).
          type: integer
          example: 120
        recommended_duration:
          description: The recommended duration for which the group should be requested (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        require_manager_approval:
          description: A bool representing whether or not access requests to the group require manager approval.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description: A bool representing whether or not access requests to the group require an access ticket.
          example: False
          type: boolean
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this group.
          example: False
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this group.
          example: False
          type: boolean
        auto_approval:
          description: A bool representing whether or not to automatically approve requests to this group.
          example: False
          type: boolean
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        group_binding_id:
          description: The ID of the associated group binding.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        is_requestable:
          description: A bool representing whether or not to allow access requests to this group.
          example: False
          type: boolean
        request_configurations:
          description: A list of request configurations for this group.
          example: []
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
        request_configuration_list:
          description: A list of request configurations for this group. Deprecated in favor of `request_configurations`.
          deprecated: true
          example: []
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
        metadata:
          description: JSON metadata about the remote group. Only set for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details.
          deprecated: true
          example: |-
            { "okta_directory_group": { "group_id": "00g4bs66kwtpe1g12345" } }
          type: string
        remote_info:
          $ref: "#/components/schemas/GroupRemoteInfo"
        custom_request_notification:
          description: Custom request notification sent to the requester when the request is approved.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity:
          description: The risk sensitivity level for the group. When an override is set, this field will match that.
          readOnly: true
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
      required:
        - group_id
      type: object
    GroupUserList:
      example:
        results:
          - full_name: Jake Barnes
            user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-01-23T04:56:07Z
            email: jake@company.dev
          - full_name: Brett Ashley
            user_id: 7646aa9a-e2ee-4eb5-8c62-91f29038a373
            group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-02-03T12:33:02Z
            email: brett@company.dev
      properties:
        results:
          items:
            $ref: "#/components/schemas/GroupUser"
          type: array
      type: object
    GroupAccessLevel:
      description: |-
        # Access Level Object
        ### Description
        The `GroupAccessLevel` object is used to represent the level of access that a user has to a group or a group has to a group. The "default" access
        level is a `GroupAccessLevel` object whose fields are all empty strings.

        ### Usage Example
        View the `GroupAccessLevel` of a group/user or group/group pair to see the level of access granted to the group.
      example:
        access_level_name: Developer
        access_level_remote_id: 20
      properties:
        access_level_name:
          description: The human-readable name of the access level.
          example: Developer
          type: string
        access_level_remote_id:
          description: The machine-readable identifier of the access level.
          example: 20
          type: string
      required:
        - access_level_name
        - access_level_remote_id
      type: object
    GroupUser:
      description: |-
        # Group Access User Object
        ### Description
        The `GroupAccessUser` object is used to represent a user with access to a group.

        ### Usage Example
        Fetch from the `LIST GroupUsers` endpoint.
      example:
        full_name: Jake Barnes
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        email: jake@company.dev
      properties:
        group_id:
          description: The ID of the group.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/GroupAccessLevel"
          nullable: true
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        email:
          description: The user's email.
          example: jake@company.dev
          type: string
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        propagation_status:
          $ref: "#/components/schemas/PropagationStatus"
      required:
        - email
        - full_name
        - group_id
        - user_id
      type: object
    PropagationStatus:
      description: The state of whether the push action was propagated to the remote system. If this is null, the access was synced from the remote system.
      properties:
        status:
          $ref: "#/components/schemas/PropagationStatusEnum"
      required:
        - status
    PropagationStatusEnum:
      description: The status of whether the user has been synced to the group or resource in the remote system.
      enum:
        - SUCCESS
        - ERR_REMOTE_INTERNAL_ERROR
        - ERR_REMOTE_USER_NOT_FOUND
        - ERR_REMOTE_USER_NOT_LINKED
        - ERR_REMOTE_RESOURCE_NOT_FOUND
        - ERR_REMOTE_THROTTLE
        - ERR_NOT_AUTHORIZED_TO_QUERY_RESOURCE
        - ERR_REMOTE_PROVISIONING_VIA_IDP_FAILED
        - ERR_IDP_EMAIL_UPDATE_CONFLICT
        - ERR_TIMEOUT
        - ERR_UNKNOWN
        - ERR_OPAL_INTERNAL_ERROR
        - ERR_ORG_READ_ONLY
        - ERR_OPERATION_UNSUPPORTED
        - PENDING
        - PENDING_MANUAL_PROPAGATION
        - PENDING_TICKET_CREATION
        - ERR_TICKET_CREATION_SKIPPED
        - ERR_DRY_RUN_MODE_ENABLED
        - ERR_HR_IDP_PROVIDER_NOT_LINKED
        - ERR_REMOTE_UNRECOVERABLE_ERROR
      example:
        - SUCCESS
      type: string
    UpdateGroupInfoList:
      example:
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            description: This group represents Active Directory group "Payments Production Admin". We use this AD group to facilitate staging deployments and qualifying new releases.
            name: api-group
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            description: Manages the Integrations Team on-call privileged resources. This group is automatically synced with the on-call rotation defined in PagerDuty.
            name: on-call-integrations
            admin_owner_id: 4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        groups:
          description: A list of groups with information to update.
          items:
            $ref: "#/components/schemas/UpdateGroupInfo"
          type: array
      type: object
      required:
        - groups
    UpdateGroupInfo:
      description: |-
        # UpdateGroupInfo Object
        ### Description
        The `UpdateGroupInfo` object is used as an input to the UpdateGroup API.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        description: This group represents Active Directory group "Payments Production Admin". We use this AD group to facilitate staging deployments and qualifying new releases.
        name: api-group
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the group.
          example: api-group
          type: string
        description:
          description: A description of the group.
          example: This group represents Active Directory group "Payments Production Admin". We use this AD group to facilitate staging deployments and qualifying new releases.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        max_duration:
          description: The maximum duration for which the group can be requested (in minutes). Use -1 to set to indefinite. Deprecated in favor of `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        recommended_duration:
          description: The recommended duration for which the group should be requested (in minutes). Will be the default value in a request. Use -1 to set to indefinite and 0 to unset. Deprecated in favor of `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        require_manager_approval:
          description: A bool representing whether or not access requests to the group require manager approval. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description: A bool representing whether or not access requests to the group require an access ticket. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        folder_id:
          description: The ID of the folder that the group is located in.
          example: e27cb7b0-98e2-4555-9916-9e6d8ca6b079
          format: uuid
          type: string
          deprecated: true
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this group.
          example: False
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this group. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        auto_approval:
          description: A bool representing whether or not to automatically approve requests to this group. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_template_id:
          description: The ID of the associated request template. Deprecated in favor of `request_configurations`.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
          deprecated: true
        is_requestable:
          description: A bool representing whether or not to allow access requests to this group. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        group_leader_user_ids:
          description: A list of User IDs for the group leaders of the group
          items:
            type: string
            format: uuid
          type: array
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: The request configuration list of the configuration template. If not provided, the default request configuration will be used.
        request_configuration_list:
          description: The request configuration list of the configuration template. If not provided, the default request configuration will be used. Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
        custom_request_notification:
          description: Custom request notification sent to the requester when the request is approved.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
      required:
        - group_id
      type: object
    GroupTypeEnum:
      description: The type of the group.
      enum:
        - ACTIVE_DIRECTORY_GROUP
        - AWS_SSO_GROUP
        - DATABRICKS_ACCOUNT_GROUP
        - DUO_GROUP
        - GIT_HUB_TEAM
        - GIT_LAB_GROUP
        - GOOGLE_GROUPS_GROUP
        - GOOGLE_GROUPS_GKE_GROUP
        - LDAP_GROUP
        - OKTA_GROUP
        - OKTA_GROUP_RULE
        - TAILSCALE_GROUP
        - OPAL_GROUP
        - OPAL_ACCESS_RULE
        - AZURE_AD_SECURITY_GROUP
        - AZURE_AD_MICROSOFT_365_GROUP
        - CONNECTOR_GROUP
        - SNOWFLAKE_ROLE
        - WORKDAY_USER_SECURITY_GROUP
      example: OPAL_GROUP
      type: string
    ResourceTypeEnum:
      description: The type of the resource.
      enum:
        - AWS_IAM_ROLE
        - AWS_EC2_INSTANCE
        - AWS_EKS_CLUSTER
        - AWS_RDS_POSTGRES_CLUSTER
        - AWS_RDS_POSTGRES_INSTANCE
        - AWS_RDS_MYSQL_CLUSTER
        - AWS_RDS_MYSQL_INSTANCE
        - AWS_ACCOUNT
        - AWS_SSO_PERMISSION_SET
        - AZURE_MANAGEMENT_GROUP
        - AZURE_RESOURCE_GROUP
        - AZURE_SUBSCRIPTION
        - AZURE_VIRTUAL_MACHINE
        - AZURE_STORAGE_ACCOUNT
        - AZURE_STORAGE_CONTAINER
        - AZURE_SQL_SERVER
        - AZURE_SQL_MANAGED_INSTANCE
        - AZURE_SQL_DATABASE
        - AZURE_SQL_MANAGED_DATABASE
        - AZURE_USER_ASSIGNED_MANAGED_Identity
        - AZURE_ENTRA_ID_ROLE
        - AZURE_ENTERPRISE_APP
        - CUSTOM
        - CUSTOM_CONNECTOR
        - DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL
        - GCP_ORGANIZATION
        - GCP_BUCKET
        - GCP_COMPUTE_INSTANCE
        - GCP_FOLDER
        - GCP_GKE_CLUSTER
        - GCP_PROJECT
        - GCP_CLOUD_SQL_POSTGRES_INSTANCE
        - GCP_CLOUD_SQL_MYSQL_INSTANCE
        - GCP_BIG_QUERY_DATASET
        - GCP_BIG_QUERY_TABLE
        - GCP_SERVICE_ACCOUNT
        - GIT_HUB_REPO
        - GIT_LAB_PROJECT
        - GOOGLE_WORKSPACE_ROLE
        - MONGO_INSTANCE
        - MONGO_ATLAS_INSTANCE
        - OKTA_APP
        - OKTA_ROLE
        - OPAL_ROLE
        - OPAL_SCOPED_ROLE
        - PAGERDUTY_ROLE
        - TAILSCALE_SSH
        - SALESFORCE_PERMISSION_SET
        - SALESFORCE_PROFILE
        - SALESFORCE_ROLE
        - SNOWFLAKE_DATABASE
        - SNOWFLAKE_SCHEMA
        - SNOWFLAKE_TABLE
        - WORKDAY_ROLE
        - MYSQL_INSTANCE
        - MARIADB_INSTANCE
        - POSTGRES_INSTANCE
        - TELEPORT_ROLE
      example: AWS_IAM_ROLE
      type: string
    VisibilityTypeEnum:
      description: The visibility level of the entity.
      enum:
        - GLOBAL
        - LIMITED
      example: GLOBAL
      type: string
    UpdateGroupResourcesInfo:
      example:
        group_resources:
          - resource_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
            access_level_remote_id: ""
          - resource_id: 6f99639b-7928-4043-8184-47cbc6766145
            access_level_remote_id: "write"
      properties:
        resources:
          items:
            $ref: "#/components/schemas/ResourceWithAccessLevel"
          type: array
      type: object
      required:
        - resources
    IdpGroupMapping:
      description: Information about a group mapping.
      example:
        group_id: 6f99639b-7928-4043-8184-47cbc6766145
        alias: "finance-team"
        hidden_from_end_user: False
      properties:
        group_id:
          description: The ID of the group.
          example: 6f99639b-7928-4043-8184-47cbc6766145
          format: uuid
          type: string
        alias:
          description: The alias of the group.
          example: finance-team
          type: string
        hidden_from_end_user:
          description: A bool representing whether or not the group is hidden from the end user.
          example: False
          type: boolean
      required:
        - group_id
        - hidden_from_end_user
      type: object
    IdpGroupMappingList:
      example:
        mappings:
          - group_id: 6f99639b-7928-4043-8184-47cbc6766145
            alias: "finance-team"
            hidden_from_end_user: False
          - group_id: 7870617d-e72a-47f5-a84c-693817ab4567
            alias: "engineering-team"
            hidden_from_end_user: False
      properties:
        mappings:
          items:
            $ref: "#/components/schemas/IdpGroupMapping"
          type: array
      type: object
      required:
        - mappings
    ResourceWithAccessLevel:
      description: Information about a resource and corresponding access level
      example:
        resource_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        access_level_remote_id: "write"
      properties:
        resource_id:
          description: The ID of the resource.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        access_level_remote_id:
          description: The ID of the resource.
          example: write
          type: string
      required:
        - resource_id
      type: object
    GroupWithAccessLevel:
      description: Information about a group and corresponding access level
      example:
        group_id: 7870617d-e72a-47f5-a84c-693817ab4567
        access_level_remote_id: "write"
      properties:
        group_id:
          description: The ID of the group.
          example: 7870617d-e72a-47f5-a84c-693817ab4567
          format: uuid
          type: string
        access_level_remote_id:
          description: The ID of the resource.
          example: write
          type: string
      required:
        - group_id
      type: object
    GroupResourceList:
      example:
        group_resources:
          - group_id: 7870617d-e72a-47f5-a84c-693817ab4567
            resource_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
            access_level_remote_id: ""
          - group_id: 50333e67-73ce-47ab-b049-d8abcd45f7a1
            resource_id: 6f99639b-7928-4043-8184-47cbc6766145
            access_level_remote_id: "write"
      properties:
        group_resources:
          items:
            $ref: "#/components/schemas/GroupResource"
          type: array
      type: object
      required:
        - group_resources
    GroupContainingGroupList:
      example:
        containing_groups:
          - containing_group_id: 7870617d-e72a-47f5-a84c-693817ab4567
          - containing_group_id: 50333e67-73ce-47ab-b049-d8abcd45f7a1
      properties:
        containing_groups:
          items:
            $ref: "#/components/schemas/GroupContainingGroup"
          type: array
      type: object
      required:
        - containing_groups
    MessageChannelList:
      example:
        channels:
          - message_channel_id: 7870617d-e72a-47f5-a84c-693817ab4567
            third_party_provider: SLACK
            remote_id: C03FJR97276
            name: api-team-audit-channel
            is_private: False
          - message_channel_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
            third_party_provider: SLACK
            remote_id: A4FJR97365D
            name: api-team-monitor-channel
            is_private: False
      properties:
        channels:
          items:
            $ref: "#/components/schemas/MessageChannel"
          type: array
      type: object
      required:
        - channels
    OnCallScheduleList:
      example:
        on_call_schedules:
          - on_call_schedule_id: 50d5e9f6-f23f-4d5a-ae91-b2640cf3975e
            third_party_provider: PAGER_DUTY
            remote_id: P7OWH2R
            name: Customer Support On-Call
          - on_call_schedule_id: 4d61592c-ed61-4b13-8f22-2fac1c49f574
            third_party_provider: OPSGENIE
            remote_id: 72a8cb04-9e25-465d-a932-992f72077c61
            name: Opal Backend On-Call
      properties:
        on_call_schedules:
          items:
            $ref: "#/components/schemas/OnCallSchedule"
          type: array
      type: object
      required:
        - on_call_schedules
    VisibilityInfo:
      description: Visibility infomation of an entity.
      example:
        visibility: LIMITED
        visibility_group_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        visibility:
          $ref: "#/components/schemas/VisibilityTypeEnum"
        visibility_group_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - visibility
    MessageChannelIDList:
      description: A list of message channel IDs.
      example:
        message_channel_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        message_channel_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - message_channel_ids
    OnCallScheduleIDList:
      description: A list of on call schedule Opal UUIDs. To get the matching remote IDs, use the /on-call-schedules endpoints.
      example:
        on_call_schedule_ids:
          - 9546209c-42c2-4801-96d7-9ec42df0f59c
          - bb0197c0-5ea5-45d9-b3b7-b6c439be6435
      properties:
        on_call_schedule_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - on_call_schedule_ids
    ReviewerIDList:
      description: A list of reviewer IDs.
      example:
        reviewer_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        reviewer_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - reviewer_ids
    ReviewerStageList:
      properties:
        stages:
          description: A list of reviewer stages.
          items:
            $ref: "#/components/schemas/ReviewerStage"
          type: array
      type: object
      required:
        - stages
    ReviewerStage:
      description: A reviewer stage.
      example:
        owner_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        require_manager_approval:
          description: Whether this reviewer stage should require manager approval.
          example: False
          type: boolean
        require_admin_approval:
          description: Whether this reviewer stage should require admin approval.
          example: False
          type: boolean
        operator:
          description: The operator of the reviewer stage. Admin and manager approval are also treated as reviewers.
          enum:
            - AND
            - OR
          example: AND
          type: string
        owner_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - operator
        - require_manager_approval
        - owner_ids
        - stage
    MessageChannel:
      description: |-
        # MessageChannel Object
        ### Description
        The `MessageChannel` object is used to represent a message channel.

        ### Usage Example
        Update a groups message channel from the `UPDATE Groups` endpoint.
      example:
        message_channel_id: 6670617d-e72a-47f5-a84c-693817ab4860
        third_party_provider: SLACK
        remote_id: C03FJR97276
        name: api-team-audit-channel
        is_private: False
      properties:
        message_channel_id:
          description: The ID of the message channel.
          example: 6670617d-e72a-47f5-a84c-693817ab4860
          format: uuid
          type: string
        third_party_provider:
          $ref: "#/components/schemas/MessageChannelProviderEnum"
        remote_id:
          description: The remote ID of the message channel
          example: C03FJR97276
          type: string
        name:
          description: The name of the message channel.
          example: api-team-audit-channel
          type: string
        is_private:
          description: A bool representing whether or not the message channel is private.
          example: False
          type: boolean
      type: object
      required:
        - message_channel_id
    CreateMessageChannelInfo:
      description: |-
        # CreateMessageChannelInfo Object
        ### Description
        The `CreateMessageChannelInfo` object is used to describe the message channel object to be created.
      example:
        third_party_provider: SLACK
        remote_id: C03FJR97276
      properties:
        third_party_provider:
          $ref: "#/components/schemas/MessageChannelProviderEnum"
        remote_id:
          description: The remote ID of the message channel
          example: C03FJR97276
          type: string
      type: object
      required:
        - third_party_provider
        - remote_id
    MessageChannelProviderEnum:
      description: The third party provider of the message channel.
      enum:
        - SLACK
      example: SLACK
      type: string
    OnCallSchedule:
      description: |-
        # OnCallSchedule Object
        ### Description
        The `OnCallSchedule` object is used to represent an on call schedule.

        ### Usage Example
        Update a groups on call schedule from the `UPDATE Groups` endpoint.
      example:
        on_call_schedule_id: 50d5e9f6-f23f-4d5a-ae91-b2640cf3975e
        third_party_provider: PAGER_DUTY
        remote_id: P7OWH2R
        name: Customer Support On-Call
      properties:
        on_call_schedule_id:
          description: The ID of the on-call schedule.
          example: 50d5e9f6-f23f-4d5a-ae91-b2640cf3975e
          format: uuid
          type: string
        third_party_provider:
          $ref: "#/components/schemas/OnCallScheduleProviderEnum"
        remote_id:
          description: The remote ID of the on call schedule
          example: P7OWH2R
          type: string
        name:
          description: The name of the on call schedule.
          example: Customer Support On-Call
          type: string
      type: object
      required:
        - message_channel_id
    CreateOnCallScheduleInfo:
      description: |-
        # CreateOnCallScheduleInfo Object
        ### Description
        The `CreateOnCallScheduleInfo` object is used to describe the on call schedule object to be created.
      example:
        third_party_provider: PAGER_DUTY
        remote_id: PNZNINN
      properties:
        third_party_provider:
          $ref: "#/components/schemas/OnCallScheduleProviderEnum"
        remote_id:
          description: The remote ID of the on call schedule
          example: PNZNINN
          type: string
      type: object
      required:
        - third_party_provider
        - remote_id
    OnCallScheduleProviderEnum:
      description: The third party provider of the on call schedule.
      enum:
        - OPSGENIE
        - PAGER_DUTY
      example: PAGER_DUTY
      type: string
    TicketingProviderEnum:
      description: The third party ticketing platform provider.
      enum:
        - JIRA
        - LINEAR
        - SERVICE_NOW
      example: LINEAR
      type: string
    GroupRemoteInfo:
      description: Information that defines the remote group. This replaces the deprecated remote_id and metadata fields.
      properties:
        active_directory_group:
          description: Remote info for Active Directory group.
          properties:
            group_id:
              description: The id of the Google group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        github_team:
          description: Remote info for GitHub team.
          properties:
            team_id:
              deprecated: true
              description: The id of the GitHub team.
              example: 898931321
              type: string
            team_slug:
              description: The slug of the GitHub team.
              example: opal-security
              type: string
          type: object
          required:
            - team_slug
        gitlab_group:
          description: Remote info for Gitlab group.
          properties:
            group_id:
              description: The id of the Gitlab group.
              example: 898931321
              type: string
          type: object
          required:
            - group_id
        google_group:
          description: Remote info for Google group.
          properties:
            group_id:
              description: The id of the Google group.
              example: 1y6w882181n7sg
              type: string
          type: object
          required:
            - group_id
        ldap_group:
          description: Remote info for LDAP group.
          properties:
            group_id:
              description: The id of the LDAP group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        okta_group:
          description: Remote info for Okta Directory group.
          properties:
            group_id:
              description: The id of the Okta Directory group.
              example: 00gjs33pe8rtmRrp3rd6
              type: string
          type: object
          required:
            - group_id
        duo_group:
          description: Remote info for Duo Security group.
          properties:
            group_id:
              description: The id of the Duo Security group.
              example: DSRD8W89B9DNDBY4RHAC
              type: string
          type: object
          required:
            - group_id
        azure_ad_security_group:
          description: Remote info for Microsoft Entra ID Security group.
          properties:
            group_id:
              description: The id of the Microsoft Entra ID Security group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        azure_ad_microsoft_365_group:
          description: Remote info for Microsoft Entra ID Microsoft 365 group.
          properties:
            group_id:
              description: The id of the Microsoft Entra ID Microsoft 365 group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        snowflake_role:
          description: Remote info for Snowflake role.
          properties:
            role_id:
              description: The id of the Snowflake role.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - role_id
      type: object
    ResourceRemoteInfo:
      description: Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields.
      properties:
        aws_account:
          description: Remote info for AWS account.
          properties:
            account_id:
              description: The id of the AWS account.
              example: 234234234234
              type: string
          type: object
          required:
            - account_id
        aws_permission_set:
          description: Remote info for AWS Identity Center permission set.
          properties:
            arn:
              description: The ARN of the permission set.
              example: arn:aws:sso:::permissionSet/asdf-32139302d201d32/ps-f03323201211e1b9
              type: string
            account_id:
              description: The ID of an AWS account to which this permission set is provisioned.
              example: 234234234234
              type: string
          type: object
          required:
            - arn
            - account_id
        aws_iam_role:
          description: Remote info for AWS IAM role.
          properties:
            arn:
              description: The ARN of the IAM role.
              example: arn:aws:iam::179308207300:role/MyRole
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - arn
        aws_ec2_instance:
          description: Remote info for AWS EC2 instance.
          properties:
            instance_id:
              description: The instanceId of the EC2 instance.
              example: i-13f1a1e2899f9e93a
              type: string
            region:
              description: The region of the EC2 instance.
              example: us-east-2
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - instance_id
            - region
        aws_rds_instance:
          description: Remote info for AWS RDS instance.
          properties:
            instance_id:
              description: The instanceId of the RDS instance.
              example: demo-mysql-db
              type: string
            region:
              description: The region of the RDS instance.
              example: us-east-2
              type: string
            resource_id:
              description: The resourceId of the RDS instance.
              example: db-AOO8V0XUCNU13XLZXQDQRSN0NQ
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - instance_id
            - region
            - resource_id
        aws_eks_cluster:
          description: Remote info for AWS EKS cluster.
          properties:
            arn:
              description: The ARN of the EKS cluster.
              example: arn:aws:eks:us-east-2:234234234234:cluster/testcluster
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - arn
        gcp_organization:
          description: Remote info for GCP organization.
          properties:
            organization_id:
              description: The id of the organization.
              example: organizations/898931321
              type: string
          type: object
          required:
            - organization_id
        gcp_bucket:
          description: Remote info for GCP bucket.
          properties:
            bucket_id:
              description: The id of the bucket.
              example: example-bucket-898931321
              type: string
          type: object
          required:
            - bucket_id
        gcp_compute_instance:
          description: Remote info for GCP compute instance.
          properties:
            instance_id:
              description: The id of the instance.
              example: example-instance-898931321
              type: string
            project_id:
              description: The id of the project the instance is in.
              example: example-project-898931321
              type: string
            zone:
              description: The zone the instance is in.
              example: us-central1-a
              type: string
          type: object
          required:
            - instance_id
            - project_id
            - zone
        gcp_big_query_dataset:
          description: Remote info for GCP BigQuery Dataset.
          properties:
            project_id:
              description: The id of the project the dataset is in.
              example: example-project-898931321
              type: string
            dataset_id:
              description: The id of the dataset.
              example: example-dataset-898931321
              type: string
          type: object
          required:
            - project_id
            - dataset_id
        gcp_big_query_table:
          description: Remote info for GCP BigQuery Table.
          properties:
            project_id:
              description: The id of the project the table is in.
              example: example-project-898931321
              type: string
            dataset_id:
              description: The id of the dataset the table is in.
              example: example-dataset-898931321
              type: string
            table_id:
              description: The id of the table.
              example: example-table-898931321
              type: string
          type: object
          required:
            - project_id
            - dataset_id
            - table_id
        gcp_folder:
          description: Remote info for GCP folder.
          properties:
            folder_id:
              description: The id of the folder.
              example: folder/898931321
              type: string
          type: object
          required:
            - folder_id
        gcp_gke_cluster:
          description: Remote info for GCP GKE cluster.
          properties:
            cluster_name:
              description: The name of the GKE cluster.
              example: example-cluster-898931321
              type: string
          type: object
          required:
            - cluster_name
        gcp_project:
          description: Remote info for GCP project.
          properties:
            project_id:
              description: The id of the project.
              example: example-project-898931321
              type: string
          type: object
          required:
            - project_id
        gcp_sql_instance:
          description: Remote info for GCP SQL instance.
          properties:
            instance_id:
              description: The id of the SQL instance.
              example: example-sql-898931321
              type: string
            project_id:
              description: The id of the project the instance is in.
              example: example-project-898931321
              type: string
          type: object
          required:
            - instance_id
            - project_id
        gcp_service_account:
          description: Remote info for a GCP service account.
          properties:
            email:
              description: The email of the service account.
              example: production@project.iam.gserviceaccount.com
              type: string
            service_account_id:
              description: The id of the service account.
              example: 103561576023829463298
              type: string
            project_id:
              description: The id of the project the service account is in.
              example: example-project-898931321
              type: string
          type: object
          required:
            - email
            - service_account_id
            - project_id
        github_repo:
          description: Remote info for GitHub repository.
          properties:
            repo_id:
              deprecated: true
              description: The id of the repository.
              example: 898931321
              type: string
            repo_name:
              description: The name of the repository.
              example: Opal Security
              type: string
          type: object
          required:
            - repo_name
        gitlab_project:
          description: Remote info for Gitlab project.
          properties:
            project_id:
              description: The id of the project.
              example: 898931321
              type: string
          type: object
          required:
            - project_id
        okta_app:
          description: Remote info for Okta directory app.
          properties:
            app_id:
              description: The id of the app.
              example: a9dfas0f678asdf67867
              type: string
          type: object
          required:
            - app_id
        okta_standard_role:
          description: Remote info for Okta directory standard role.
          properties:
            role_type:
              description: The type of the standard role.
              example: ORG_ADMIN
              type: string
          type: object
          required:
            - role_type
        okta_custom_role:
          description: Remote info for Okta directory custom role.
          properties:
            role_id:
              description: The id of the custom role.
              example: a9dfas0f678asdf67867
              type: string
          type: object
          required:
            - role_id
        pagerduty_role:
          description: Remote info for Pagerduty role.
          properties:
            role_name:
              description: The name of the role.
              example: owner
              type: string
          type: object
          required:
            - role_name
        salesforce_permission_set:
          description: Remote info for Salesforce permission set.
          properties:
            permission_set_id:
              description: The id of the permission set.
              example: 0PS5Y090202wOV7WAM
              type: string
          type: object
          required:
            - permission_set_id
        salesforce_profile:
          description: Remote info for Salesforce profile.
          properties:
            profile_id:
              description: The id of the permission set.
              example: 0PS5Y090202wOV7WAM
              type: string
            user_license_id:
              description: The id of the user license.
              example: 1005Y030081Qb5XJHS
              type: string
          type: object
          required:
            - profile_id
            - user_license_id
        salesforce_role:
          description: Remote info for Salesforce role.
          properties:
            role_id:
              description: The id of the role.
              example: 0PS5Y090202wOV7WAM
              type: string
          type: object
          required:
            - role_id
        teleport_role:
          description: Remote info for Teleport role.
          properties:
            role_name:
              description: The name role.
              example: admin_role
              type: string
          type: object
          required:
            - role_name
      type: object
    RiskSensitivityEnum:
      type: string
      description: "Indicates the level of potential impact misuse or unauthorized access may incur."
      enum: [UNKNOWN, CRITICAL, HIGH, MEDIUM, LOW, NONE]
    CreateResourceInfo:
      description: |-
        # CreateResourceInfo Object
        ### Description
        The `CreateResourceInfo` object is used to store creation info for a resource.

        ### Usage Example
        Use in the `POST Resources` endpoint.
      example:
        remote_resource_id: API_ACCESS_MANAGEMENT_ADMIN-51d203da-313a-4fd9-8fcf-420ce6312345
        name: Okta Engineering Super Admin
        description: Okta super admin role.
        resource_type: OKTA_ROLE
        metadata: |-
          {
            "okta_directory_role":
              {
                "role_id": "SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345",
                "role_type": "SUPER_ADMIN",
              },
          }
        app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        name:
          description: The name of the remote resource.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the remote resource.
          example: Engineering team Okta role.
          type: string
        resource_type:
          $ref: "#/components/schemas/ResourceTypeEnum"
        app_id:
          description: The ID of the app for the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        remote_info:
          $ref: "#/components/schemas/ResourceRemoteInfo"
        remote_resource_id:
          deprecated: true
          description: Deprecated - use remote_info instead. The ID of the resource on the remote system. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field.
          example: API_ACCESS_MANAGEMENT_ADMIN-51d203da-313a-4fd9-8fcf-420ce6312345
          type: string
        metadata:
          deprecated: true
          description: |-
            Deprecated - use remote_info instead.

            JSON metadata about the remote resource. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field.
            The required format is dependent on resource_type and should have the following schema:
            <style type="text/css">
            code {max-height:300px !important}
            </style>
            ```json
            {
              "$schema": "http://json-schema.org/draft-04/schema#",
              "title": "Resource Metadata",
              "properties": {
                "aws_ec2_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "region": {
                      "type": "string"
                    }
                  },
                  "required": ["instance_id", "region"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS EC2 Instance"
                },
                "aws_eks_cluster": {
                  "properties": {
                    "cluster_name": {
                      "type": "string"
                    },
                    "cluster_region": {
                      "type": "string"
                    },
                    "cluster_arn": {
                      "type": "string"
                    }
                  },
                  "required": ["cluster_name", "cluster_region", "cluster_arn"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS EKS Cluster"
                },
                "aws_rds_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "engine": {
                      "type": "string"
                    },
                    "region": {
                      "type": "string"
                    },
                    "resource_id": {
                      "type": "string"
                    },
                    "database_name": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "instance_id",
                    "engine",
                    "region",
                    "resource_id",
                    "database_name"
                  ],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS RDS Instance"
                },
                "aws_role": {
                  "properties": {
                    "arn": {
                      "type": "string"
                    },
                    "name": {
                      "type": "string"
                    }
                  },
                  "required": ["arn", "name"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS Role"
                },
                "gcp_bucket": {
                  "properties": {
                    "bucket_id": {
                      "type": "string"
                    }
                  },
                  "required": ["bucket_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Bucket"
                },
                "gcp_compute_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "project_id": {
                      "type": "string"
                    },
                    "zone": {
                      "type": "string"
                    }
                  },
                  "required": ["instance_id", "project_id", "zone"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Compute Instance"
                },
                "gcp_folder": {
                  "properties": {
                    "folder_id": {
                      "type": "string"
                    }
                  },
                  "required": ["folder_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Folder"
                },
                "gcp_gke_cluster": {
                  "properties": {
                    "cluster_name": {
                      "type": "string"
                    }
                  },
                  "required": ["cluster_name"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP GKE Cluster"
                },
                "gcp_project": {
                  "properties": {
                    "project_id": {
                      "type": "string"
                    }
                  },
                  "required": ["project_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Project"
                },
                "gcp_sql_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "project_id": {
                      "type": "string"
                    }
                  },
                  "required": ["instance_id", "project_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP SQL Instance"
                },
                "git_hub_repo": {
                  "properties": {
                    "org_name": {
                      "type": "string"
                    },
                    "repo_name": {
                      "type": "string"
                    }
                  },
                  "required": ["org_name", "repo_name"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GitHub Repo"
                },
                "okta_directory_app": {
                  "properties": {
                    "app_id": {
                      "type": "string"
                    },
                    "logo_url": {
                      "type": "string"
                    }
                  },
                  "required": ["app_id", "logo_url"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Okta Directory App"
                },
                "okta_directory_role": {
                  "properties": {
                    "role_type": {
                      "type": "string"
                    },
                    "role_id": {
                      "type": "string"
                    }
                  },
                  "required": ["role_type", "role_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Okta Directory Role"
                },
                "salesforce_profile": {
                  "properties": {
                    "user_license": {
                      "type": "string"
                    }
                  },
                  "required": ["user_license"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Salesforce Profile"
                }
              },
              "additionalProperties": false,
              "minProperties": 1,
              "maxProperties": 1,
              "type": "object"
            }
            ```
          example: |-
            {
              "okta_directory_role":
                {
                  "role_id": "SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345",
                  "role_type": "SUPER_ADMIN",
                },
            }
          type: string
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
      required:
        - name
        - resource_type
        - app_id
      type: object
    CreateBundleInfo:
      description: |-
        # CreateBundleInfo Object
        ### Description
        The `CreateBundleInfo` object is used to store creation info for a bundle.

        ### Usage Example
        Use in the `POST Bundles` endpoint.
      example:
        name: Engineering Team Bundle
        description: Engineering team bundle.
        admin_owner_id: 7870617d-e72a-47f5-a84c-693817ab4567
      properties:
        name:
          type: string
          description: The name of the bundle.
          example: "Test Bundle"
        description:
          type: string
          description: A brief description of the bundle.
          example: "This is a test bundle"
        admin_owner_id:
          type: string
          description: The ID of the bundle's admin owner.
          example: "7c86c85d-0651-43e2-a748-d69d658418e8"
      required:
        - name
        - admin_owner_id
    CreateGroupInfo:
      description: |-
        # CreateGroupInfo Object
        ### Description
        The `CreateGroupInfo` object is used to store creation info for a group.

        ### Usage Example
        Use in the `POST Groups` endpoint.
      example:
        remote_group_id: 00g4fixjd6Bc9w0TT5d7
        name: Engineering Team
        description: Engineering team Okta group.
        group_type: OKTA_GROUP
        metadata: |-
          { "okta_directory_group": { "group_id": "00g4bs66kwtpe1g12345" } }
        app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        name:
          description: The name of the remote group.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the remote group.
          example: Engineering team Okta group.
          type: string
        group_type:
          $ref: "#/components/schemas/GroupTypeEnum"
        app_id:
          description: The ID of the app for the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        remote_info:
          $ref: "#/components/schemas/GroupRemoteInfo"
        remote_group_id:
          deprecated: true
          description: Deprecated - use remote_info instead. The ID of the group on the remote system. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field.
          example: 00g4fixjd6Bc9w012345
          type: string
        metadata:
          deprecated: true
          description: |-
            Deprecated - use remote_info instead.

            JSON metadata about the remote group. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field.
            The required format is dependent on group_type and should have the following schema:
            <style type="text/css">
            code {max-height:300px !important}
            </style>
            ```json
            {
              "$schema": "http://json-schema.org/draft-04/schema#",
              "title": "Group Metadata",
              "properties": {
                "ad_group": {
                  "properties": {
                    "object_guid": {
                      "type": "string"
                    }
                  },
                  "required": ["object_guid"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Active Directory Group"
                },
                "duo_group": {
                  "properties": {
                    "group_id": {
                      "type": "string"
                    }
                  },
                  "required": ["group_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Duo Group"
                },
                "git_hub_team": {
                  "properties": {
                    "org_name": {
                      "type": "string"
                    },
                    "team_slug": {
                      "type": "string"
                    }
                  },
                  "required": ["org_name", "team_slug"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GitHub Team"
                },
                "google_groups_group": {
                  "properties": {
                    "group_id": {
                      "type": "string"
                    }
                  },
                  "required": ["group_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Google Groups Group"
                },
                "ldap_group": {
                  "properties": {
                    "group_uid": {
                      "type": "string"
                    }
                  },
                  "required": ["group_uid"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "LDAP Group"
                },
                "okta_directory_group": {
                  "properties": {
                    "group_id": {
                      "type": "string"
                    }
                  },
                  "required": ["group_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Okta Directory Group"
                }
              },
              "additionalProperties": false,
              "minProperties": 1,
              "maxProperties": 1,
              "type": "object"
            }
            ```
          example: |-
            { "okta_directory_group": { "group_id": "00g4bs66kwtpe1g12345" } }
          type: string
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
      required:
        - name
        - group_type
        - app_id
      type: object
    PaginatedResourcesList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - resource_id: f454d283-ca67-4a8a-bdbb-df212eca5353
            description: This resource represents AWS IAM role "SupportUser".
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            remote_id: arn:aws:iam::490306337630:role/SupportUser
            remote_name: SupportUser
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
            parent_resource_id: f454d283-ca67-4a8a-bdbb-df212eca5345
          - resource_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            description: This resource represents GCP project "app-demo".
            remote_id: app-demo-307223
            remote_name: app-demo
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Resource"
          type: array
      type: object
      required:
        - results
    RequestStatusEnum:
      description: |-
        # Request Status
        ### Description
        The `RequestStatus` enum is used to represent the status of a request.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      enum:
        - PENDING
        - APPROVED
        - DENIED
        - CANCELED
      type: string
    Request:
      description: |-
        # Request Object
        ### Description
        The `Request` object is used to represent a request.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      example:
        id: 7c86c85d-0651-43e2-a748-d69d658418e8
        created_at: 2021-01-06T20:00:00Z
        updated_at: 2021-01-06T20:00:00Z
        requester_id: c86c85d-0651-43e2-a748-d69d658418e8
        target_user_id: r86c85d-0651-43e2-a748-d69d658418e8
        target_group_id: r86c85d-0651-43e2-a748-d69d658418e8
        status: pending
        reason: I need this resource.
        duration_minutes: 1440
        request_comments:
          - id: 7c86c85d-0651-43e2-a748-d69d658418e8
            created_at: 2021-01-06T20:00:00Z
            updated_at: 2021-01-06T20:00:00Z
            request_id: 4c86c85d-0651-43e2-a748-d69d658418e8
            user_id: c86c85d-0651-43e2-a748-d69d658418e8
            comment: This is a comment.
      properties:
        id:
          description: The unique identifier of the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        created_at:
          description: The date and time the request was created.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
        updated_at:
          description: The date and time the request was last updated.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
        requester_id:
          description: The unique identifier of the user who created the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        target_user_id:
          description: The unique identifier of the user who is the target of the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        target_group_id:
          description: The unique identifier of the group who is the target of the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        status:
          description: The status of the request.
          example: pending
          $ref: "#/components/schemas/RequestStatusEnum"
        reason:
          description: The reason for the request.
          example: I need access to the AWS account.
          type: string
        duration_minutes:
          description: The duration of the request in minutes.
          example: 120
          type: integer
        requested_items_list:
          description: The list of targets for the request.
          type: array
          items:
            $ref: "#/components/schemas/RequestedItem"
        custom_fields_responses:
          description: The responses given to the custom fields associated to the request
          type: array
          items:
            $ref: "#/components/schemas/RequestCustomFieldResponse"
      required:
        - id
        - created_at
        - updated_at
        - requester_id
        - status
        - reason
    RequestedItem:
      description: |-
        # Requested Item Object
        ### Description
        The `RequestedItem` object is used to represent a request target item.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      properties:
        resource_id:
          description: The ID of the resource requested.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        group_id:
          description: The ID of the group requested.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        access_level_name:
          description: The name of the access level requested.
          example: admin
          type: string
        access_level_remote_id:
          description: The ID of the access level requested on the remote system.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
        name:
          description: The name of the target.
          example: Engineering Team
          type: string
      example:
        resource_id: null
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        access_level_name: admin
        access_level_remote_id: arn:aws:iam::490306337630:role/SupportUser
        name: Engineering Team
    RequestCustomFieldResponse:
      properties:
        field_name:
          type: string
        field_type:
          example: SHORT_TEXT
          $ref: "#/components/schemas/RequestTemplateCustomFieldTypeEnum"
        field_value:
          oneOf:
            - type: string
              example: "This is a response to a long text or short text or multi choice"
            - type: boolean
              example: true
      required:
        - field_name
        - field_type
        - field_value
    RequestTemplateCustomFieldTypeEnum:
      description: The type of the custom request field.
      enum:
        - SHORT_TEXT
        - LONG_TEXT
        - BOOLEAN
        - MULTI_CHOICE
      type: string
    RequestList:
      description: |-
        # Request List
        ### Description
        The `RequestList` object is used to represent a list of requests.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      example:
        requests:
          - id: 7c86c85d-0651-43e2-a748-d69d658418e8
            organization_id: w86c85d-0651-43e2-a748-d69d658418e8
            created_at: 2021-01-06T20:00:00Z
            updated_at: 2021-01-06T20:00:00Z
            requester_id: c86c85d-0651-43e2-a748-d69d658418e8
            target_user_id: r86c85d-0651-43e2-a748-d69d658418e8
            target_group_id: g86c85d-0651-43e2-a748-d69d658418e8
            status: pending
            reason: I need this resource.
            duration_minutes: 1440
            request_comments:
              - id: 4c86c85d-0651-43e2-a748-d69d658418e8
                created_at: 2021-01-06T20:00:00Z
                updated_at: 2021-01-06T20:00:00Z
                request_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                user_id: c86c85d-0651-43e2-a748-d69d658418e8
                comment: This is a comment.
        cursor: eyJjcmVhdGVkX2F0IjoiMjAyMS0wMS0wNlQyMDo0NzowMFoiLCJ2YWx1ZSI6ImFkbWluIn0=
      properties:
        requests:
          description: The list of requests.
          type: array
          items:
            $ref: "#/components/schemas/Request"
        cursor:
          description: The cursor to use in the next request to get the next page of results.
          type: string
          example: eyJjcmVhdGVkX2F0IjoiMjAyMS0wMS0wNlQyMDo0NzowMFoiLCJ2YWx1ZSI6ImFkbWluIn0=
    Resource:
      description: |-
        # Resource Object
        ### Description
        The `Resource` object is used to represent a resource.

        ### Usage Example
        Update from the `UPDATE Resources` endpoint.
      example:
        resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        description: This resource represents AWS IAM role "SupportUser".
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        remote_id: 318038399
        remote_name: repo-name
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
        parent_resource_id: f454d283-ca67-4a8a-bdbb-df212eca5345
      properties:
        resource_id:
          description: The ID of the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        app_id:
          description: The ID of the app.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        name:
          description: The name of the resource.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the resource.
          example: This resource represents AWS IAM role "SupportUser".
          type: string
        admin_owner_id:
          description: The ID of the owner of the resource.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        remote_resource_id:
          description: The ID of the resource on the remote system.
          example: 318038399
          type: string
        remote_resource_name:
          description: The name of the resource on the remote system.
          example: repo-name
          type: string
        resource_type:
          $ref: "#/components/schemas/ResourceTypeEnum"
        max_duration:
          description: The maximum duration for which the resource can be requested (in minutes).
          type: integer
          example: 120
        recommended_duration:
          description: The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        require_manager_approval:
          description: A bool representing whether or not access requests to the resource require manager approval.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description: A bool representing whether or not access requests to the resource require an access ticket.
          example: False
          type: boolean
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this resource.
          example: False
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this resource.
          example: False
          type: boolean
        require_mfa_to_connect:
          description: A bool representing whether or not to require MFA to connect to this resource.
          example: False
          type: boolean
        auto_approval:
          description: A bool representing whether or not to automatically approve requests to this resource.
          example: False
          type: boolean
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        is_requestable:
          description: A bool representing whether or not to allow access requests to this resource.
          example: False
          type: boolean
        parent_resource_id:
          description: The ID of the parent resource.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4305
          format: uuid
          type: string
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: A list of configurations for requests to this resource.
        request_configuration_list:
          description: A list of configurations for requests to this resource. Deprecated in favor of `request_configurations`.
          deprecated: true
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          type: array
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
        risk_sensitivity:
          description: The risk sensitivity level for the resource. When an override is set, this field will match that.
          readOnly: true
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        metadata:
          description: JSON metadata about the remote resource. Only set for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details.
          deprecated: true
          example: |-
            {
              "okta_directory_role":
                {
                  "role_id": "SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345",
                  "role_type": "SUPER_ADMIN",
                },
            }
          type: string
        remote_info:
          $ref: "#/components/schemas/ResourceRemoteInfo"
      required:
        - resource_id
      type: object
    AwsPermissionSetMetadata:
      description: Metadata for AWS Identity Center permission set.
      properties:
        aws_permission_set:
          type: object
          properties:
            arn:
              description: The ARN of the permission set.
              example: arn:aws:sso:::permissionSet/asdf-32139302d201d32/ps-f03323201211e1b9
              type: string
            account_id:
              description: The ID of an AWS account to which this permission set is provisioned.
              example: 234234234234
              type: string
          required:
            - arn
            - account_id
      type: object
      required:
        - aws_permission_set
    UpdateResourceInfoList:
      example:
        resources:
          - resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: my-mongo-db
            description: This resource represents AWS IAM role "SupportUser".
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
          - resource_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            name: Admin Role
            description: This resource represents GCP project "app-demo".
            admin_owner_id: 4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        resources:
          description: A list of resources with information to update.
          items:
            $ref: "#/components/schemas/UpdateResourceInfo"
          type: array
      type: object
      required:
        - resources
    UpdateResourceInfo:
      description: |-
        # UpdateResourceInfo Object
        ### Description
        The `UpdateResourceInfo` object is used as an input to the UpdateResource API.
      example:
        resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: my-mongo-db
        description: This resource represents AWS IAM role "SupportUser".
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
      properties:
        resource_id:
          description: The ID of the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the resource.
          example: my-mongo-db
          type: string
        description:
          description: A description of the resource.
          example: This resource represents AWS IAM role "SupportUser".
          type: string
        admin_owner_id:
          description: The ID of the owner of the resource.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        max_duration:
          description: The maximum duration for which the resource can be requested (in minutes). Use -1 to set to indefinite. Deprecated in favor of `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        recommended_duration:
          description: The recommended duration for which the resource should be requested (in minutes). Will be the default value in a request. Use -1 to set to indefinite and 0 to unset. Deprecated in favor of `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        require_manager_approval:
          description: A bool representing whether or not access requests to the resource require manager approval.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description: A bool representing whether or not access requests to the resource require an access ticket. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        folder_id:
          description: The ID of the folder that the resource is located in.
          example: e27cb7b0-98e2-4555-9916-9e6d8ca6b079
          format: uuid
          type: string
          deprecated: true
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this resource.
          example: False
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this resource. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        require_mfa_to_connect:
          description: A bool representing whether or not to require MFA to connect to this resource.
          example: False
          type: boolean
        auto_approval:
          description: A bool representing whether or not to automatically approve requests to this resource. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_template_id:
          description: The ID of the associated request template. Deprecated in favor of `request_configurations`.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
          deprecated: true
        is_requestable:
          description: A bool representing whether or not to allow access requests to this resource. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: A list of configurations for requests to this resource. If not provided, the default request configuration will be used.
        request_configuration_list:
          description: A list of configurations for requests to this resource. If not provided, the default request configuration will be used. Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
      required:
        - resource_id
      type: object
    PaginatedTagsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - tag_id: f290a738-5f9f-43c2-ad67-fa31ff0eb946
            created_at: 2022-01-23T04:56:07Z
            updated_at: 2022-02-23T01:34:07Z
            user_creator_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
            admin_owner_id: bfb518b1-3f5b-4e3b-8eb8-3b3fabd4ea2b
            key: database-name
            value: redis_db
          - tag_id: 92f0a738-5f9f-43c2-ad67-fa31ff0eb052
            created_at: 2022-03-23T04:56:07Z
            updated_at: 2022-04-23T01:34:07Z
            user_creator_id: a4d7d928-783e-4599-8ec6-088d635af4ac
            admin_owner_id: gtg418b1-3f5b-4e3b-8eb8-3b3fabd4eaa1
            key: database-type
            value: sql
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Tag"
          type: array
      required:
        - results
      type: object
    TagsList:
      example:
        results:
          - tag_id: f290a738-5f9f-43c2-ad67-fa31ff0eb946
            created_at: 2022-01-23T04:56:07Z
            updated_at: 2022-02-23T01:34:07Z
            user_creator_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
            admin_owner_id: bfb518b1-3f5b-4e3b-8eb8-3b3fabd4ea2b
            key: database-name
            value: redis_db
          - tag_id: 92f0a738-5f9f-43c2-ad67-fa31ff0eb052
            created_at: 2022-03-23T04:56:07Z
            updated_at: 2022-04-23T01:34:07Z
            user_creator_id: a4d7d928-783e-4599-8ec6-088d635af4ac
            admin_owner_id: gtg418b1-3f5b-4e3b-8eb8-3b3fabd4eaa1
            key: database-type
            value: sql
      properties:
        tags:
          items:
            $ref: "#/components/schemas/Tag"
          type: array
      required:
        - tags
      type: object
    Tag:
      description: |-
        # Tag Object
        ### Description
        The `Tag` object is used to represent a tag.

        ### Usage Example
        Get tags from the `GET Tag` endpoint.
      example:
        tag_id: f290a738-5f9f-43c2-ad67-fa31ff0eb946
        created_at: 2022-01-23T04:56:07Z
        updated_at: 2022-02-23T01:34:07Z
        user_creator_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
        key: database-name
        value: redis_db
      properties:
        tag_id:
          description: The ID of the tag.
          example: f290a738-5f9f-43c2-ad67-fa31ff0eb946
          format: uuid
          type: string
        created_at:
          description: The date the tag was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        updated_at:
          description: The date the tag was last updated.
          example: 2022-02-23T01:34:07Z
          format: date-time
          type: string
        user_creator_id:
          description: The ID of the user that created the tag.
          example: d4a7d928-783e-4599-8ec6-088d635a5bcc
          format: uuid
          type: string
        key:
          description: The key of the tag.
          example: database-name
          type: string
        value:
          description: The value of the tag.
          example: redis_db
          type: string
      type: object
      required:
        - tag_id
    CreateTagInfo:
      description: |-
        # CreateTagInfo Object
        ### Description
        The `CreateTagInfo` object is used to represent configuration for a new tag.

        ### Usage Example
        Use in the `POST Tag` endpoint.
      example:
        tag_key: api-scope
        tag_value: production
      properties:
        tag_key:
          description: The key of the tag to create.
          example: api-scope
          type: string
        tag_value:
          description: The value of the tag to create.
          example: production
          type: string
      required:
        - tag_key
      type: object
    PaginatedGroupBindingsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWtJ
        results:
          - group_binding_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            created_by_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            created_at: 2022-01-23T04:56:07Z
            source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            groups:
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
                group_type: OKTA_GROUP
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
                group_type: AWS_SSO_GROUP
          - group_binding_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            created_by_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            source_group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            created_at: 2022-01-23T04:56:07Z
            groups:
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
                group_type: AWS_SSO_GROUP
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
                group_type: OKTA_GROUP
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/GroupBinding"
          type: array
      required:
        - results
    CreateGroupBindingInfo:
      description: |-
        # CreateGroupBindingInfo Object
        ### Description
        The `CreateGroupBindingInfo` object is used as an input to the CreateGroupBinding API.
      example:
        source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
      properties:
        source_group_id:
          description: The ID of the source group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        groups:
          description: The list of groups.
          items:
            properties:
              group_id:
                description: The ID of the group.
                example: f454d283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
            required:
              - group_id
          type: array
      required:
        - source_group_id
        - groups
      type: object
    UpdateGroupBindingInfoList:
      example:
        group_bindings:
          - group_binding_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            groups:
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
          - group_binding_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            source_group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            groups:
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        group_bindings:
          description: A list of group bindings with information to update.
          items:
            $ref: "#/components/schemas/UpdateGroupBindingInfo"
          type: array
      type: object
      required:
        - group_bindings
    UpdateGroupBindingInfo:
      description: |-
        # UpdateGroupBindingInfo Object
        ### Description
        The `UpdateGroupBindingInfo` object is used as an input to the UpdateGroupBinding API.
      example:
        group_binding_id: 0ae19dbf-324d-4216-999c-574d46182c7e
        source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
      properties:
        group_binding_id:
          description: The ID of the group binding.
          example: 0ae19dbf-324d-4216-999c-574d46182c7e
          format: uuid
          type: string
        source_group_id:
          description: The ID of the source group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        groups:
          description: The list of groups.
          items:
            properties:
              group_id:
                description: The ID of the group.
                example: f454d283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
            required:
              - group_id
          type: array
      required:
        - group_binding_id
        - source_group_id
        - groups
      type: object
    GroupBinding:
      description: |-
        # Group Binding Object
        ### Description
        The `GroupBinding` object is used to represent a group binding.

        ### Usage Example
        Get group bindings from the `GET Group Bindings` endpoint.
      example:
        group_binding_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        created_by_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
        created_at: 2022-01-23T04:56:07Z
        source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            group_type: OKTA_GROUP
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            group_type: AWS_SSO_GROUP
      properties:
        group_binding_id:
          description: The ID of the group binding.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        created_by_id:
          description: The ID of the user that created the group binding.
          example: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
          format: uuid
          type: string
        created_at:
          description: The date the group binding was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        source_group_id:
          description: The ID of the source group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        groups:
          description: The list of groups.
          items:
            $ref: "#/components/schemas/GroupBindingGroup"
          type: array
      required:
        - group_binding_id
        - created_by_id
        - created_at
        - source_group_id
        - groups
    GroupBindingGroup:
      description: |-
        # Group Binding Group Object
        ### Description
        The `GroupBindingGroup` object is used to represent a group binding group.

        ### Usage Example
        Get group binding groups from the `GET Group Bindings` endpoint.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        group_type: OKTA_GROUP
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        group_type:
          $ref: "#/components/schemas/GroupTypeEnum"
      required:
        - group_id
        - group_type
      type: object
    UpdateAccessRuleInfo:
      description: |-
        # UpdateAccessRuleInfo Object
        ### Description
        The `UpdateAccessRuleInfo` object is used as an input to the UpdateAccessRule and CreateAccessRule API.
      properties:
        name:
          description: The name of the access rule.
          example: Platform Engineering
          type: string
        description:
          description: A description of the group.
          example: This access rule represents all platform engineers in the company.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        status:
          description: The status of the access rule.
          type: string
          enum:
            - ACTIVE
            - PAUSED
          example: ACTIVE
        ruleClauses:
          $ref: "#/components/schemas/RuleClauses"
      required:
        - status
        - ruleClauses
        - name
        - admin_owner_id
        - description
    AccessRule:
      description: |-
        # Access Rule Object
        ### Description
        The `AccessRule` object is used to represent an access rule configuration.

        ### Usage Example
        Get access rule configurations from the `GET Access Rule Configs` endpoint.
      properties:
        access_rule_id:
          description: The ID (group ID) of the access rule.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the access rule.
          example: Platform Engineering
          type: string
        description:
          description: A description of the group.
          example: This access rule represents all platform engineers in the company.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        status:
          description: The status of the access rule.
          type: string
          enum:
            - ACTIVE
            - PAUSED
          example: ACTIVE
        ruleClauses:
          $ref: "#/components/schemas/RuleClauses"
      required:
        - status
        - ruleClauses
        - name
        - admin_owner_id
        - access_rule_id
        - description
    RuleClauses:
      properties:
        when:
          $ref: "#/components/schemas/RuleConjunction"
        unless:
          $ref: "#/components/schemas/RuleConjunction"
      required:
        - when
    RuleConjunction:
      properties:
        clauses:
          type: array
          minItems: 1
          items:
            $ref: "#/components/schemas/RuleDisjunction"
      required:
        - clauses
    RuleDisjunction:
      properties:
        selectors:
          type: array
          items:
            $ref: "#/components/schemas/TagSelector"
      required:
        - selectors
    TagSelector:
      properties:
        key:
          type: string
        value:
          type: string
        connection_id:
          type: string
          format: uuid
      required:
        - key
        - value
        - connection_id
    PaginatedOwnersList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: API Owner
            description: This owner represents the API team owners.
            access_request_escalation_period: 120
          - owner_id: e8581682-04f7-473a-a419-472f0fb26d46
            name: Finance Owner
            description: This owner represents the Finance team owners.
            access_request_escalation_period: 120
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Owner"
          type: array
      type: object
      required:
        - results
    Owner:
      description: |-
        # Owner Object
        ### Description
        The `Owner` object is used to represent an owner.
      example:
        owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: API Owner
        description: This owner represents the API team owners.
        access_request_escalation_period: 120
      properties:
        owner_id:
          description: The ID of the owner.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the owner.
          example: API Owner
          type: string
        description:
          description: A description of the owner.
          example: This owner represents the API team owners.
          type: string
        access_request_escalation_period:
          description: The amount of time (in minutes) before the next reviewer is notified. Use 0 to remove escalation policy.
          type: integer
          example: 120
        reviewer_message_channel_id:
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          format: uuid
          type: string
          nullable: true
        source_group_id:
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
          nullable: true
      required:
        - owner_id
      type: object
    CreateOwnerInfo:
      description: |-
        # CreateOwnerInfo Object
        ### Description
        The `CreateOwnerInfo` object is used to store creation info for an owner.

        ### Usage Example
        Use in the `POST Owners` endpoint.
      example:
        name: API Owner
        description: This owner represents the API team owners.
        access_request_escalation_period: 120
      properties:
        name:
          description: The name of the owner.
          example: API Owner
          type: string
        description:
          description: A description of the owner.
          example: This owner represents the API team owners.
          type: string
        access_request_escalation_period:
          description: The amount of time (in minutes) before the next reviewer is notified. Use 0 to remove escalation policy.
          type: integer
          example: 120
        user_ids:
          description: Users to add to the created owner. If setting a source_group_id this list must be empty.
          example:
            - 7870617d-e72a-47f5-a84c-693817ab4567
            - 1520617d-e72a-47f5-a84c-693817ab48ad2
          items:
            type: string
            format: uuid
          type: array
        reviewer_message_channel_id:
          description: The message channel id for the reviewer channel.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          type: string
        source_group_id:
          description: Sync this owner's user list with a source group.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
      required:
        - name
        - user_ids
      type: object
    UpdateOwnerInfoList:
      example:
        owners:
          - owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: API Owner
            description: This owner represents the API team owners.
            access_request_escalation_period: 120
          - owner_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            name: Finance Owner
            description: This owner represents the Finance team owners.
            access_request_escalation_period: 15
      properties:
        owners:
          description: A list of owners with information to update.
          items:
            $ref: "#/components/schemas/UpdateOwnerInfo"
          type: array
      type: object
      required:
        - owners
    UpdateOwnerInfo:
      description: |-
        # UpdateOwnerInfo Object
        ### Description
        The `UpdateOwnerInfo` object is used as an input to the UpdateOwner API.
      example:
        owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: API Owner
        description: This owner represents the API team owners.
        access_request_escalation_period: 120
      properties:
        owner_id:
          description: The ID of the owner.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the owner.
          example: API Owner
          type: string
        description:
          description: A description of the owner.
          example: This owner represents the API team owners.
          type: string
        access_request_escalation_period:
          description: The amount of time (in minutes) before the next reviewer is notified. Use 0 to remove escalation policy.
          example: 120
          type: integer
        reviewer_message_channel_id:
          description: The message channel id for the reviewer channel. Use "" to remove an existing message channel.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          type: string
        source_group_id:
          description: Sync this owner's user list with a source group. Use "" to remove an existing source group.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
      required:
        - owner_id
      type: object
    Condition:
      description: |-
        # Condition Object
        ### Description
        The `Condition` object is used to represent a condition.

        ### Usage Example
        Used to match request configurations to users in `RequestConfiguration`
      example:
        group_ids:
          - 1b978423-db0a-4037-a4cf-f79c60cb67b3
      type: object
      properties:
        group_ids:
          description: The list of group IDs to match.
          example:
            - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          items:
            type: string
            format: uuid
          type: array
        role_remote_ids:
          description: The list of role remote IDs to match.
          example:
            - arn:aws:iam::590304332660:role/AdministratorAccess
          type: array
          items:
            type: string
    RequestConfiguration:
      description: |-
        # Request Configuration Object
        ### Description
        The `RequestConfiguration` object is used to represent a request configuration.

        ### Usage Example
        Returned from the `GET Request Configurations` endpoint.
      example:
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        organization_id: w86c85d-0651-43e2-a748-d69d658418e8
        created_at: 2021-01-06T20:00:00Z
        updated_at: 2021-01-06T20:00:00Z
        condition:
          group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        allow_requests: True
        auto_approval: False
        require_mfa_to_request: False
        max_duration_minutes: 120
        recommended_duration_minutes: 120
        require_support_ticket: False
        reviewer_stages:
          - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            owner_ids:
              - 37cb7e41-12ba-46da-92ff-030abe0450b1
              - 37cb7e41-12ba-46da-92ff-030abe0450b2
            stage: 1
        priority: 1
      type: object
      properties:
        condition:
          description: The condition for the request configuration.
          $ref: "#/components/schemas/Condition"
        allow_requests:
          description: A bool representing whether or not to allow requests for this resource.
          example: True
          type: boolean
        auto_approval:
          description: A bool representing whether or not to automatically approve requests for this resource.
          example: False
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this resource.
          example: False
          type: boolean
        max_duration_minutes:
          description: The maximum duration for which the resource can be requested (in minutes).
          type: integer
          example: 120
        recommended_duration_minutes:
          description: The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        require_support_ticket:
          description: A bool representing whether or not access requests to the resource require an access ticket.
          example: False
          type: boolean
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        reviewer_stages:
          description: The list of reviewer stages for the request configuration.
          items:
            $ref: "#/components/schemas/ReviewerStage"
          type: array
        priority:
          description: The priority of the request configuration.
          example: 1
          type: integer
      required:
        - organization_id
        - allow_requests
        - auto_approval
        - require_mfa_to_request
        - require_support_ticket
        - priority
    CreateRequestConfigurationInfoList:
      description: |-
        # CreateRequestConfigurationInfoList Object
        ### Description
        The `CreateRequestConfigurationInfoList` object is used as an input to the CreateRequestConfigurations API.

        ### Formatting Requirements
        The `CreateRequestConfigurationInfoList` object must contain a list of `RequestConfiguration` objects.
        Exactly one default `RequestConfiguration` must be provided.  A default `RequestConfiguration` is one with a `condition` of `null`
        and a `priority` of `0`.  The default `RequestConfiguration` will be used when no other `RequestConfiguration` matches the request.

        Only one `RequestConfiguration` may be provided for each priority, and the priorities must be contiguous.  For example, if there are
        two `RequestConfigurations` with priorities 0 and 2, there must be a `RequestConfiguration` with priority 1.

        To use the `condition` field, the `condition` must be a valid JSON object.

        The `condition` must be a JSON object with the key `group_ids` (more options may be added in the future), whose value is a list of
        group IDs.
        The `condition` will match if the user requesting access is a member of any of the groups in the list. Currently, we only support
        using a single group as a condition.
      example:
        request_configurations:
          - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            organization_id: w86c85d-0651-43e2-a748-d69d658418e8
            condition: null
            allow_requests: True
            auto_approval: False
            require_mfa_to_request: False
            max_duration_minutes: 120
            recommended_duration_minutes: 120
            require_support_ticket: False
            reviewer_stages:
              - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                owner_ids:
                  - 37cb7e41-12ba-46da-92ff-030abe0450b1
                  - 37cb7e41-12ba-46da-92ff-030abe0450b2
                stage: 1
            priority: 0
          - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
            organization_id: w86c85d-0651-43e2-a748-d69d658418e8
            condition:
              group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
            allow_requests: True
            auto_approval: False
            require_mfa_to_request: False
            max_duration_minutes: 120
            recommended_duration_minutes: 120
            require_support_ticket: False
            reviewer_stages:
              - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                owner_ids:
                  - 37cb7e41-12ba-46da-92ff-030abe0450b1
                  - 37cb7e41-12ba-46da-92ff-030abe0450b2
                stage: 1
            priority: 1
      properties:
        request_configurations:
          description: A list of request configurations to create.
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          type: array
      type: object
      required:
        - request_configurations
    CreateConfigurationTemplateInfo:
      description: |-
        # CreateConfigurationTemplateInfo Object
        ### Description
        The `CreateConfigurationTemplateInfo` object is used to store creation info for a configuration template.

        ### Usage Example
        Use in the `POST Configuration Templates` endpoint.
      example:
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        visibility: private
        linked_audit_message_channel_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        member_oncall_schedule_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        break_glass_user_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        require_mfa_to_approve: False
        require_mfa_to_connect: False
        name: Prod AWS Template
      required:
        - admin_owner_id
        - visibility
        - name
        - require_mfa_to_approve
        - require_mfa_to_connect
      properties:
        admin_owner_id:
          description: The ID of the owner of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        visibility:
          description: The visibility info of the configuration template.
          example: private
          $ref: "#/components/schemas/VisibilityInfo"
        linked_audit_message_channel_ids:
          description: The IDs of the audit message channels linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        member_oncall_schedule_ids:
          description: The IDs of the on-call schedules linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        break_glass_user_ids:
          description: The IDs of the break glass users linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this configuration template.
          example: False
          type: boolean
        require_mfa_to_connect:
          description: A bool representing whether or not to require MFA to connect to resources associated with this configuration template.
          example: False
          type: boolean
        name:
          description: The name of the configuration template.
          example: Prod AWS Template
          type: string
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: The request configuration list of the configuration template. If not provided, the default request configuration will be used.
        request_configuration_list:
          description: The request configuration list of the configuration template. If not provided, the default request configuration will be used. Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval for this configuration template.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
    ConfigurationTemplate:
      description: |-
        # Configuration Template Object
        ### Description
        The `ConfigurationTemplate` object is used to represent a configuration template.

        ### Usage Example
        Returned from the `GET Configuration Templates` endpoint.
      example:
        configuration_template_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        visibility: private
        linked_audit_message_channel_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        member_oncall_schedule_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        break_glass_user_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        require_mfa_to_approve: False
        require_mfa_to_connect: False
        name: Prod AWS Template
      properties:
        configuration_template_id:
          description: The ID of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the configuration template.
          example: Prod AWS Template
          type: string
        admin_owner_id:
          description: The ID of the owner of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        visibility:
          description: The visibility info of the configuration template.
          example: private
          $ref: "#/components/schemas/VisibilityInfo"
        linked_audit_message_channel_ids:
          description: The IDs of the audit message channels linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        request_configuration_id:
          description: The ID of the request configuration linked to the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        member_oncall_schedule_ids:
          description: The IDs of the on-call schedules linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        break_glass_user_ids:
          description: The IDs of the break glass users linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this configuration template.
          example: False
          type: boolean
        require_mfa_to_connect:
          description: A bool representing whether or not to require MFA to connect to resources associated with this configuration template.
          example: False
          type: boolean
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval for this configuration template.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
    TicketPropagationConfiguration:
      description: Configuration for ticket propagation, when enabled, a ticket will be created for access changes related to the users in this resource.
      type: object
      properties:
        enabled_on_grant:
          type: boolean
        enabled_on_revocation:
          type: boolean
        ticket_provider:
          $ref: "#/components/schemas/TicketingProviderEnum"
        ticket_project_id:
          type: string
      required:
        - enabled_on_grant
        - enabled_on_revocation
    UpdateConfigurationTemplateInfo:
      description: |-
        # UpdateConfigurationTemplateInfo Object
        ### Description
        The `ConfigurationTemplate` object is used to represent an update to a configuration template.

        ### Usage Example
        Use in the `PUT Configuration Templates` endpoint.
      example:
        configuration_template_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        visibility: private
        linked_audit_message_channel_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        member_oncall_schedule_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        break_glass_user_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        require_mfa_to_approve: False
        require_mfa_to_connect: False
        name: Prod AWS Template
      required:
        - configuration_template_id
      properties:
        configuration_template_id:
          description: The ID of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the configuration template.
          example: Prod AWS Template
          type: string
        admin_owner_id:
          description: The ID of the owner of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        visibility:
          description: The visibility info of the configuration template.
          example: private
          $ref: "#/components/schemas/VisibilityInfo"
        linked_audit_message_channel_ids:
          description: The IDs of the audit message channels linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: The request configuration list linked to the configuration template.
        request_configuration_list:
          description: The request configuration list linked to the configuration template. Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
        member_oncall_schedule_ids:
          description: The IDs of the on-call schedules linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 7c86c85d-0651-43e2-a748-d69d658418e8
          items:
            type: string
            format: uuid
          type: array
        break_glass_user_ids:
          description: The IDs of the break glass users linked to the configuration template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this configuration template.
          example: False
          type: boolean
        require_mfa_to_connect:
          description: A bool representing whether or not to require MFA to connect to resources associated with this configuration template.
          example: False
          type: boolean
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval for this configuration template.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
    PaginatedConfigurationTemplateList:
      description: |-
        # PaginatedConfigurationTemplateList Object
        ### Description
        The `PaginatedConfigurationTemplateList` object is used to store a list of configuration templates.

        ### Usage Example
        Returned from the `GET Configuration Templates` endpoint.
      example:
        results:
          - configuration_template_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            admin_owner_id: a4d7d928-783e-4599-8ec6-088d635af4ac
            visibility: private
            linked_audit_message_channel_ids:
              - l3cb7e41-12ba-46da-92ff-030abe0450b1
              - f3cb7e41-12ba-46da-92ff-030abe0450b2
            request_configuration_id: r3cb7e41-12ba-46da-92ff-030abe0450b1
            member_oncall_schedule_ids:
              - 23cb7e41-12ba-46da-92ff-030abe0450b1
              - m3cb7e41-12ba-46da-92ff-030abe0450b2
            break_glass_user_ids:
              - 63cb7e41-12ba-46da-92ff-030abe0450b1
              - b3cb7e41-12ba-46da-92ff-030abe0450b2
            require_mfa_to_approve: False
            require_mfa_to_connect: False
      properties:
        results:
          items:
            $ref: "#/components/schemas/ConfigurationTemplate"
          type: array
    CreateRequestInfo:
      description: All the information needed for creating a request
      properties:
        resources:
          type: array
          items:
            type: object
            properties:
              id:
                description: The ID of the resource requested. Should not be specified if group_id is specified.
                example: group283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
              access_level_remote_id:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
              access_level_name:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
        groups:
          type: array
          items:
            type: object
            properties:
              id:
                description: The ID of the group requested. Should not be specified if resource_id is specified.
                example: f454d283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
              access_level_remote_id:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
              access_level_name:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
            required:
              - id
        target_user_id:
          description: The ID of the user to be granted access. Should not be specified if target_group_id is specified.
          example: userd283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        target_group_id:
          description: The ID of the group the request is for.  Should not be specified if target_user_id is specified.
          example: userd283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        reason:
          type: string
        support_ticket:
          type: object
          properties:
            ticketing_provider:
              $ref: "#/components/schemas/TicketingProviderEnum"
            remote_id:
              type: string
            identifier:
              type: string
            url:
              type: string
          required:
            - ticketing_provider
            - remote_id
            - identifier
            - url
        duration_minutes:
          description: The duration of the request in minutes. -1 represents an indefinite duration
          type: integer
          minimum: -1
        custom_metadata:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
              type:
                $ref: "#/components/schemas/RequestTemplateCustomFieldTypeEnum"
              value:
                type: string
            required:
              - name
              - type
              - value

      required:
        - reason
        - duration_minutes
        - resources
        - groups
    SyncErrorList:
      example:
        sync_errors:
          - app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
            first_seen: 2022-07-14T06:59:59Z
            last_seen: 2022-08-23T04:32:46Z
            error_message: Failed to connect to the remote system - insufficient credentials.
          - app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
            first_seen: 2023-04-24T06:59:59Z
            last_seen: 2024-08-21T04:32:46Z
            error_message: Resource not found.
      properties:
        sync_errors:
          items:
            $ref: "#/components/schemas/SyncError"
          type: array
      type: object
      required:
        - sync_errors
    SyncError:
      description: |-
        # SyncError Object
        ### Description
        The `SyncError` object is used to represent a sync error.

        ### Usage Example
        List from the `GET Sync Errors` endpoint.
      example:
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        first_seen: 2022-07-14T06:59:59Z
        last_seen: 2022-08-23T04:32:46Z
        error_message: Failed to connect to the remote system - insufficient credentials.
      properties:
        first_seen:
          description: The time when this error was first seen.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        last_seen:
          description: The time when this error was most recently seen.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        error_message:
          description: The error message associated with the sync error.
          example: Failed to connect to the remote system - insufficient credentials.
          type: string
        app_id:
          description: The ID of the app that the error occured for.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
      required:
        - first_seen
        - last_seen
        - error_message
      type: object
    Bundle:
      properties:
        bundle_id:
          description: The ID of the bundle.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        name:
          description: The name of the bundle.
          example: Bundle 1
          type: string
        description:
          description: The description of the bundle.
          example: Description of bundle 1
          type: string
        created_at:
          type: string
          format: date-time
          description: The creation timestamp of the bundle, in ISO 8601 format
          readOnly: true
        updated_at:
          type: string
          format: date-time
          description: The last updated timestamp of the bundle, in ISO 8601 format
          readOnly: true
        admin_owner_id:
          description: The ID of the owner of the bundle.
          example: 4aed3e8a-727b-4d72-8010-3b8710c50bec
          format: uuid
          type: string
        total_num_items:
          description: The total number of items in the bundle.
          example: 15
          type: integer
          readOnly: true
        total_num_resources:
          description: The total number of resources in the bundle.
          example: 10
          type: integer
          readOnly: true
        total_num_groups:
          description: The total number of groups in the bundle.
          example: 5
          type: integer
          readOnly: true
    PaginatedBundleList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        totalCount: 2
        bundles:
          - id: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            name: Bundle 1
            description: Description of bundle 1
            admin_owner_id: 4aed3e8a-727b-4d72-8010-3b8710c50bec
            total_num_items: 0
            total_num_resources: 0
            total_num_groups: 0
          - id: 8294e9c9-deb6-48e9-9c99-da2a1e04a87f
            name: Bundle 2
            description: Description of bundle 2
            admin_owner_id: 4aed3e8a-727b-4d72-8010-3b8710c50bec
            total_num_items: 0
            total_num_resources: 0
            total_num_groups: 0
      properties:
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
        bundles:
          items:
            $ref: "#/components/schemas/Bundle"
          type: array
      type: object
      required:
        - bundles
    BundleResource:
      properties:
        bundle_id:
          description: The ID of the bundle containing the resource.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        resource_id:
          description: The ID of the resource within a bundle.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        access_level_name:
          description: The access level of the resource within a bundle.
          example: Read
          type: string
        access_level_remote_id:
          description: The remote ID of the access level of the resource within a bundle.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
    PaginatedBundleResourceList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        total_count: 3
        bundle_resources:
          - id: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            name: Resource 1
            access_level_name: read
            access_level_remote_id: pull
      properties:
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
        bundle_resources:
          items:
            $ref: "#/components/schemas/BundleResource"
          type: array
      type: object
      required:
        - bundle_resources
    BundleGroup:
      properties:
        bundle_id:
          description: The ID of the bundle containing the group.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        group_id:
          description: The ID of the group within a bundle.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
    PaginatedBundleGroupList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        total_count: 2
        bundle_groups:
          - id: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            name: Group 1
          - id: 8294e9c9-deb6-48e9-9c99-da2a1e04a87f
            name: Group 2
      properties:
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        next:
          description:
            The cursor with which to continue pagination if additional
            result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
        bundle_groups:
          items:
            $ref: "#/components/schemas/BundleGroup"
          type: array
      type: object
      required:
        - bundle_groups
  securitySchemes:
    BearerAuth:
      scheme: bearer
      type: http