Skip to content
Okta Identity Governance
/
Management APIs
/
/
List all grants

List all grants

Request

Beta
OAuth 2.0 scope:
  • okta.governance.entitlements.read
Admin roles:
  • APP_ADMIN

Lists active grants (status="ACTIVE") for your org.

The filter expression (?filter=) is required.

Pagination parameters are accepted. Standard link headers are in the response.

By default, results are sorted by id.

Query
afterstring, non-empty(id)

The pagination cursor that points to the last record of the previous request

limitinteger, [ 1 .. 200 ]

The maximum number of records returned in a response

Default:20
filterstring, (scim-filter)required

A filter expression that returns entries based on the following properties:

  • targetResourceOrn (alternatively, you can use target.externalId and target.type for a specific resource )
  • targetPrincipalOrn (alternatively, you can use targetPrincipal.externalId and targetPrincipal.type for a specific principal)
  • entitlementBundleId
  • entitlements.id
  • entitlements.values.id
  • action

The eq operator is supported for these properties. The AND and OR logical operators are supported for combining multiple expressions.

Note: Query parameter percent encoding is required. See Special characters.

Example:filter=target.externalId eq "0oafxqCAJWWGELFTYASJ" AND target.type eq "APPLICATION" AND targetPrincipal.externalId eq "00ub0oNGTSWTBKOLGLNR" AND targe
Examples:
Filter grants for a resource and user
filter=target.externalId eq "0oafxqCAJWWGELFTYASJ" AND target.type eq "APPLICATION" AND targetPrincipal.externalId eq "00ub0oNGTSWTBKOLGLNR" AND targe
Filter grants for a resource and user using ORNs
filter=targetResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:oidc:0oafxqCAJWWGELFTYASJ" AND targetPrincipalOrn eq "orn:okta:directory:00o11edPw
Filter all grants for a resource using target resource ORN
filter=targetResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:oidc:0oafxqCAJWWGELFTYASJ"
Filter grants with resource and entitlement bundle
filter=targetResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:oidc:0oafxqCAJWWGELFTYASJ" AND entitlementBundleId eq "enbllojq9J9J105DL1d6"
Filter grants with resource and entitlement value ID
filter=target.externalId eq "0oafxqCAJWWGELFTYASJ" AND target.type eq "APPLICATION" AND entitlements.values.id eq "entfxqCAJWWFTFUUYBBB"
Filter grants with resource and entitlement ID
filter=target.externalId eq "0oafxqCAJWWGELFTYASJ" AND target.type eq "APPLICATION" AND entitlements.id eq "espfxqCAJWWFTFUUYKKK"
Filter grants with multiple entitlement value IDs and entitlment bundle ID
filter=target.externalId eq "0oafxqCAJWWGELFTYASJ" AND target.type eq "APPLICATION" AND (entitlements.values.id eq "entfxqCAJWWFTFUUYBBB" OR entitleme
Filter grants with resource and action
filter=target.externalId eq "0oafxqCAJWWGELFTYASJ" AND target.type eq "APPLICATION" AND action eq "ALLOW"
includeArray of strings

The include parameter adds additional properties to the response.

Items Enum ValueDescription
full_entitlements

Include complete entitlements in the response

metadata

Include metadata such as collection generating the grant in the response

Examples:
Include complete entitlements in the response
include=full_entitlements
Include metadata such as collection generating the grant in the response
include=metadata
curl -i -X GET \
  'https://subdomain-okta.login.adsbillinghub.com/governance/api/v1/grants?after=string&limit=20&filter=target.externalId%20eq%20%220oafxqCAJWWGELFTYASJ%22%20AND%20target.type%20eq%20%22APPLICATION%22%20AND%20targetPrincipal.externalId%20eq%20%2200ub0oNGTSWTBKOLGLNR%22%20AND%20targetPrincipal.type%20eq%20%22OKTA_USER%22&include=full_entitlements'

Responses

Get grants

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
One of:
dataArray of objects(Grant)
Response

A principal user can have active POLICY grants and ENTITLEMENT-BUNDLE grants. This is common when an entitlement policy grants a user an entitlement, and then a user requests access to a specific entitlement bundle at a later date.

{
  "data": [
    { … },
    { … }
  ],
  "_links": {
    "self": { … }
  }
}