Skip to content
Okta Identity Governance
/
/
/
Create a request conditio...

Create a request condition

Request

OAuth 2.0 scope:
  • okta.accessRequests.condition.manage
Admin roles:
  • ACCESS_REQUESTS_ADMIN

Creates a request condition to govern how a resource can be requested.

Specify the following to create a request condition:

  • What resource can be requested? (resourceId in path)
  • What access scope can be requested? (accessScopeSettings in request body)
  • Who can request access? (requesterSettings in request body)
  • What is the approval process? (approvalSequenceId in request body)

Any requesterSettings or accessScopeSettings parameters in the request body are validated against the resource's current request settings. After a request condition is created successfully, its status is set to INACTIVE.

Note: You can define a maximum of 100 conditions for each resource (app).

Path
resourceIdstringrequired

Unique identifier for the resource in Okta instance ID format or ORN format

Bodyapplication/jsonrequired
namestring, [ 1 .. 255 ] charactersrequired

Writable unique key on create. Modifiable on update.

descriptionstring, [ 1 .. 2000 ] characters

Human readable description

requesterSettingsobject(requester-settings-creatable_RequesterSettings)required
accessScopeSettingsobject(access-scope-settings-creatable_AccessScopeSettings)required
accessDurationSettingsobject(access-duration-settings-creatable)
approvalSequenceIdstring, = 24 characters(approval-sequence-id)required

Unique identifier for the approval sequence

priorityinteger, >= 0(priority)

The priority of the condition. The smaller the number, the higher the priority. The highest priority is 0. A new condition will default to the lowest priority.

A request condition allowing everyone to request permanent access to an application

curl -i -X POST \
  'https://subdomain-okta.login.adsbillinghub.com/governance/api/v2/resources/{resourceId}/request-conditions' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Application | Permanent | Everyone",
    "description": "A request condition allowing everyone to request permanent access to an application",
    "approvalSequenceId": "61eb0f06c462d20007f051ac",
    "requesterSettings": {
      "type": "EVERYONE"
    },
    "accessScopeSettings": {
      "type": "RESOURCE_DEFAULT"
    },
    "priority": 0
  }'

Responses

A successful response for creating request condition

Headers
X-Rate-Limit-Limitinteger, >= 1required

The rate-limit ceiling for the current request

Example:60
X-Rate-Limit-Remaininginteger, >= 0required

The number of requests left for the current rate-limit window

Example:60
X-Rate-Limit-Resetinteger, >= 0required

The time when the rate limit resets, specified in UTC epoch time (in seconds)

Example:1609459200
Bodyapplication/json
namestring, [ 1 .. 255 ] charactersrequired

Writable unique key on create. Modifiable on update.

descriptionstring, [ 1 .. 2000 ] characters

Human readable description

idstring, (request-condition-id), = 20 characters(request-condition-id)rco[0-9a-zA-Z]+required

Unique identifier for the object

Example:"rcord7d69lUIn7u5D1d5"
createdBystring, (okta-user-id), [ 1 .. 20 ] characters(created-by)read-onlyrequired

The id of the Okta user who created the resource

createdstring, (date-time)(created)read-onlyrequired

The ISO 8601 formatted date and time when the resource was created

lastUpdatedstring, (date-time)(last-updated)read-onlyrequired

The ISO 8601 formatted date and time when the object was last updated

lastUpdatedBystring, (okta-user-id), [ 1 .. 20 ] characters(last-updated-by)read-onlyrequired

The id of the Okta user who last updated the object

statusstring(request-condition-status)required

status indicating if this condition is active or not. Default status is INACTIVE

Enum:"ACTIVE""INACTIVE""INVALID""DELETED"
priorityinteger, >= 0(priority)required

The priority of the condition. The smaller the number, the higher the priority. The highest priority is 0. A new condition will default to the lowest priority.

requesterSettingsobject(requester-settings-full_RequesterSettings)required
accessScopeSettingsobject(access-scope-settings-full_AccessScopeSettings)required
accessDurationSettingsobject(access-duration-settings-full)
approvalSequenceIdstring, = 24 characters(approval-sequence-id-read-only)

If an approval sequence was deleted, then conditions referencing it will become invalid and the approvalSequenceId will not be present.

Response

A request condition allowing everyone to request permanent access to an application

{
  "id": "rcob0oNGTSWTBKOLGLNR",
  "name": "Application | Permanent | Everyone",
  "description": "A request condition allowing everyone to request permanent access to an application",
  "approvalSequenceId": "61eb0f06c462d20007f051ac",
  "requesterSettings": {
    "type": "EVERYONE"
  },
  "accessScopeSettings": {
    "type": "RESOURCE_DEFAULT"
  },
  "priority": 0,
  "status": "INACTIVE",
  "created": "2019-08-24T14:15:22Z",
  "createdBy": "00ub0oNGTSWTBKOLGLNR",
  "lastUpdated": "2019-08-24T14:15:22Z",
  "lastUpdatedBy": "00ub0oNGTSWTBKOLGLNR",
  "_links": {
    "self": { … }
  }
}