Skip to content
Okta Identity Governance
/
Management APIs
/
/
Retrieve the principal's...

Retrieve the principal's effective entitlements for a resource

Request

OAuth 2.0 scope:
  • okta.governance.entitlements.read
Admin roles:
  • APP_ADMIN

Retrieves the principal's effective entitlements for a specific resource

Query
filterstring, (scim-filter)(scim-filter)required

Apply various filters by using supported principal entitlements filtering properties.

The resource and the principal are both required. Supply parent.externalId and parent.type, or parentResourceOrn, for the resource. Supply targetPrincipal.externalId and targetPrincipal.type, or targetPrincipalOrn, for the principal.

Note: Query parameter percent encoding is required. See Percent-encoding

Examples:
Filter by user and application
filter=parent.externalId eq "0oafxqCAJWWGELFTYASJ" AND parent.type eq "APPLICATION" AND targetPrincipal.externalId eq "00ub0oNGTSWTBKOLGLNR" AND targe
Filter by user and application ORNs
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:oidc:0oafxqCAJWWGELFTYASJ" AND targetPrincipalOrn eq "orn:okta:directory:00o11edPw
curl -i -X GET \
  'https://subdomain-okta.login.adsbillinghub.com/governance/api/v1/principal-entitlements?filter=parent.externalId%20eq%20%220oafxqCAJWWGELFTYASJ%22%20AND%20parent.type%20eq%20%22APPLICATION%22%20AND%20targetPrincipal.externalId%20eq%20%2200ub0oNGTSWTBKOLGLNR%22%20AND%20targetPrincipal.type%20eq%20%22OKTA_USER%22'

Responses

List of all principal entitlements for a specific resource.

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
dataArray of objects(principal-entitlement)

Principal entitlements list

Response

When a user has been granted some License and Role entitlement's to Salesforce

{
  "data": [
    { … },
    { … }
  ]
}