openapi: 3.1.0
info:
  contact:
    email: hello@opal.dev
    name: Opal Team
    url: https://www.opal.dev/
  description:
    The Opal API is a RESTful API that allows you to interact with the
    Opal Security platform programmatically.
  title: Opal API
  version: "1.0"
servers:
  - description: Production
    url: https://api.opal.dev/v1
# keep tags alphabetized, also add any new tags to the list below
tags:
  - name: access-rules
    description: Operations related to access rules
  - name: apps
    description: Operations related to apps
  - name: bundles
    description: Operations related to bundles
  - name: campaigns
    description: Operations related to access review campaigns
  - name: configuration-templates
    description: Operations related to configuration templates
  - name: delegations
    description: Operations related to request reviewer delegations
  - name: event-streams
    description: Operations related to event streaming connections
  - name: events
    description: Operations related to events
  - name: groups
    description: Operations related to groups
  - name: group-bindings
    description: Operations related to group bindings
  - name: idp-group-mappings
    description: Operations related to IDP group mappings
  - name: message-channels
    description: Operations related to message channels
  - name: non-human-identities
    description: Operations related to non-human identities
  - name: on-call-schedules
    description: Operations related to on-call schedules
  - name: opal-queries
    description: Operations related to OpalQuery
  - name: owners
    description: Operations related to owners
  - name: requests
    description: Operations related to requests
  - name: resources
    description: Operations related to resources
  - name: paladin
    description: Operations related to Paladin

  - name: sessions
    description: Operations related to sessions
  - name: tags
    description: Operations related to tags
  - name: tokens
    description: Operations related to API tokens
  - name: uars
    description:
      Operations related to UARs. Deprecated in favor of the `campaigns` API.
  - name: users
    description: Operations related to users
paths:
  /apps:
    get:
      summary: Get apps
      description: Returns a list of `App` objects.
      operationId: getApps
      parameters:
        - description: A list of app types to filter by.
          example:
            - OKTA_DIRECTORY
            - GIT_HUB
          explode: false
          in: query
          name: app_type_filter
          required: false
          schema:
            items:
              $ref: "#/components/schemas/AppTypeEnum"
            type: array
          style: form
        - description: An owner ID to filter by.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: owner_filter
          required: false
          schema:
            format: uuid
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AppsList"
          description: A list of apps for your organization.
      security:
        - BearerAuth: []
      tags:
        - apps
  /apps/{app_id}:
    get:
      summary: Get app by ID
      description: Returns an `App` object.
      operationId: getApp
      parameters:
        - description: The ID of the app.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: app_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/App"
          description: The requested `App`.
      security:
        - BearerAuth: []
      tags:
        - apps
  /bundles:
    get:
      summary: Get bundles
      description: Returns a list of `Bundle` objects.
      operationId: getBundles
      parameters:
        - description:
            The maximum number of bundles to return from the beginning of the
            list. Default is 200, max is 1000.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
        - description:
            A cursor indicating where to start fetching items after a specific
            point.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: A filter for the bundle name.
          example: Engineering
          explode: true
          in: query
          name: contains
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: A list of bundles for your organization.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedBundleList"
      security:
        - BearerAuth: []
      tags:
        - bundles
    post:
      description: Creates a bundle.
      operationId: createBundle
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateBundleInfo"
      responses:
        "201":
          description: The bundle successfully created.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Bundle"
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}:
    get:
      summary: Get bundle by ID
      description: Returns a `Bundle` object.
      operationId: getBundle
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Bundle"
          description: The requested `Bundle`.
      security:
        - BearerAuth: []
      tags:
        - bundles
    delete:
      description: Deletes a bundle.
      operationId: deleteBundle
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The bundle was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - bundles
    put:
      description: Updates a bundle.
      operationId: updateBundle
      parameters:
        - description: The ID of the bundle to be updated.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Bundle"
      responses:
        "200":
          description: The bundle was successfully updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Bundle"
        "204":
          description: No changes detected (no-op)
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/resources:
    get:
      description: Returns a list of `Resource` objects in a given bundle.
      operationId: getBundleResources
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The maximum number of resources to return from the beginning of the
            list. Default is 200, max is 1000.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
        - description:
            A cursor indicating where to start fetching items after a specific
            point.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedBundleResourceList"
          description: A list of resources for the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
    post:
      description: Adds a resource to a bundle.
      operationId: addBundleResource
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        required: false
        content:
          application/json:
            schema:
              properties:
                resource_id:
                  description: The ID of the resource to add.
                  example: 72e75a6f-7183-48c5-94ff-6013f213314b
                  format: uuid
                  type: string
                access_level_remote_id:
                  description:
                    The remote ID of the access level to grant to this user. Required
                    if the resource being added requires an access level. If
                    omitted, the default access level remote ID value (empty
                    string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
                access_level_name:
                  description:
                    The name of the access level to grant to this user. If omitted, the
                    default access level name value (empty string) is used.
                  example: AdministratorAccess
                  type: string
              required:
                - resource_id
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BundleResource"
          description: Resource was successfully added to the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/resources/{resource_id}:
    delete:
      description: Removes a resource from a bundle.
      operationId: removeBundleResource
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
        - description: The ID of the resource to remove.
          example: 72e75a6f-7183-48c5-94ff-6013f213314b
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
        - description:
            The remote ID of the access level to grant. If omitted, the default
            access level remote ID value (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: Resource was successfully removed from the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/groups:
    get:
      description: Returns a list of `Group` objects in a given bundle.
      operationId: getBundleGroups
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The maximum number of groups to return from the beginning of the
            list. Default is 200, max is 1000.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
        - description:
            A cursor indicating where to start fetching items after a specific
            point.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedBundleGroupList"
          description: A list of groups for the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
    post:
      description: Adds a group to a bundle.
      operationId: addBundleGroup
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                group_id:
                  description: The ID of the group to add.
                  example: 72e75a6f-7183-48c5-94ff-6013f213314b
                  format: uuid
                  type: string
                access_level_remote_id:
                  description:
                    The remote ID of the access level to grant to this user. Required
                    if the group being added requires an access level. If
                    omitted, the default access level remote ID value (empty
                    string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
                access_level_name:
                  description:
                    The name of the access level to grant to this user. If omitted, the
                    default access level name value (empty string) is used.
                  example: AdministratorAccess
                  type: string
              required:
                - group_id
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BundleGroup"
          description: Group was successfully added to the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/groups/{group_id}:
    delete:
      description: Removes a group from a bundle.
      operationId: removeBundleGroup
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
        - description: The ID of the group to remove.
          example: 72e75a6f-7183-48c5-94ff-6013f213314b
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
        - description: The remote ID of the access level to remove.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: Group was successfully removed from the bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /bundles/{bundle_id}/visibility:
    get:
      description: Gets the visibility of the bundle.
      operationId: getBundleVisibility
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility details of a bundle.
      security:
        - BearerAuth: []
      tags:
        - bundles
    put:
      description: Sets the visibility of the bundle.
      operationId: setBundleVisibility
      parameters:
        - description: The ID of the bundle.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: bundle_id
          required: true
          schema:
            format: uuid
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              description:
                The visibility details of the bundle. Setting to LIMITED visibility
                with no visibility groups will make bundle only visible to
                admins and users with access.
              $ref: "#/components/schemas/VisibilityInfo"
      responses:
        "200":
          description: The visibility details of the bundle were successfully set.
      security:
        - BearerAuth: []
      tags:
        - bundles
  /campaigns:
    get:
      description: Returns a list of `Campaign` objects.
      operationId: getCampaigns
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: Campaign name to filter by. Returns campaigns whose names contain this substring (case-insensitive).
          example: Q3 Access Review
          explode: true
          in: query
          name: name
          required: false
          schema:
            type: string
          style: form
        - description: Filter by campaign status. Status is derived from lifecycle timestamps and review progress.
          example: ONGOING
          explode: true
          in: query
          name: status
          required: false
          schema:
            $ref: "#/components/schemas/CampaignStatusEnum"
          style: form
        - description: Include campaigns created after this timestamp (exclusive). ISO 8601 format.
          example: 2026-01-01T00:00:00Z
          explode: true
          in: query
          name: created_at_after
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns created before this timestamp (exclusive). ISO 8601 format.
          example: 2026-12-31T23:59:59Z
          explode: true
          in: query
          name: created_at_before
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns started after this timestamp (exclusive). ISO 8601 format.
          example: 2026-01-01T00:00:00Z
          explode: true
          in: query
          name: started_at_after
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns started before this timestamp (exclusive). ISO 8601 format.
          example: 2026-12-31T23:59:59Z
          explode: true
          in: query
          name: started_at_before
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns ended after this timestamp (exclusive). ISO 8601 format.
          example: 2026-01-01T00:00:00Z
          explode: true
          in: query
          name: ended_at_after
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns ended before this timestamp (exclusive). ISO 8601 format.
          example: 2026-12-31T23:59:59Z
          explode: true
          in: query
          name: ended_at_before
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns stopped after this timestamp (exclusive). ISO 8601 format.
          example: 2026-01-01T00:00:00Z
          explode: true
          in: query
          name: stopped_at_after
          required: false
          schema:
            type: string
            format: date-time
          style: form
        - description: Include campaigns stopped before this timestamp (exclusive). ISO 8601 format.
          example: 2026-12-31T23:59:59Z
          explode: true
          in: query
          name: stopped_at_before
          required: false
          schema:
            type: string
            format: date-time
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedCampaignsList"
          description: A list of campaigns for your organization.
      security:
        - BearerAuth: []
      tags:
        - campaigns
    post:
      description: |
        Creates a campaign. Campaign scope only supports direct access edges:
        `configuration.query.edgeFilter.directOnly` defaults to `true`, is
        always stored as `true`, and passing `false` returns 400.
      operationId: createCampaign
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateCampaignInfo"
      responses:
        "201":
          description: The campaign successfully created.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Campaign"
      security:
        - BearerAuth: []
      tags:
        - campaigns
  /campaigns/{campaign_id}:
    get:
      summary: Get campaign by ID
      description: Returns a `Campaign` object.
      operationId: getCampaign
      parameters:
        - description: The ID of the campaign.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          explode: true
          in: path
          name: campaign_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Campaign"
          description: The requested `Campaign`.
      security:
        - BearerAuth: []
      tags:
        - campaigns
    put:
      summary: Update campaign
      description: |
        Partially updates a campaign. Omitted fields are left unchanged.
        `configuration.query` and `configuration.reviewer_assignment_policy`
        cannot be updated after create; including either field returns 400.
        `configuration.cron_expression` and
        `configuration.recurring_duration_days` may only be set on template
        campaigns; setting them on a one-off campaign returns 400.
        `configuration.is_template` is immutable and not accepted on update.
        Configuration updates on a stopped or ended (non-template) campaign
        return 400. Name-only updates are still allowed.
      operationId: updateCampaign
      parameters:
        - description: The ID of the campaign.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          explode: true
          in: path
          name: campaign_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateCampaignInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Campaign"
          description: The updated `Campaign`.
      security:
        - BearerAuth: []
      tags:
        - campaigns
  /campaigns/{campaign_id}/start:
    post:
      summary: Start campaign
      description: |
        Starts a draft campaign immediately, setting `started_at` and
        `started_by_user_id`. Returns 400 if the campaign is not in draft
        state, or if it is a recurring template (`is_template: true`) —
        templates spawn draft campaigns on their schedule and cannot be
        started directly.
      operationId: startCampaign
      parameters:
        - description: The ID of the campaign.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          explode: true
          in: path
          name: campaign_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Campaign"
          description: The started `Campaign`.
      security:
        - BearerAuth: []
      tags:
        - campaigns
  /campaigns/{campaign_id}/stop:
    post:
      summary: Stop campaign
      description: |
        Stops an ongoing campaign immediately, setting `stopped_at` and
        `stopped_by_user_id`. Returns 400 if the campaign has not started or
        has already stopped.
      operationId: stopCampaign
      parameters:
        - description: The ID of the campaign.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          explode: true
          in: path
          name: campaign_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/StopCampaignRequest"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Campaign"
          description: The stopped `Campaign`.
      security:
        - BearerAuth: []
      tags:
        - campaigns
  /campaigns/{campaign_id}/end:
    post:
      summary: End campaign
      description: |
        Ends a stopped campaign, setting `ended_at` and `ended_by_user_id`,
        applying pending access changes, and queuing report generation.
        Returns 400 unless the campaign is started and stopped and not already
        ended.
      operationId: endCampaign
      parameters:
        - description: The ID of the campaign.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          explode: true
          in: path
          name: campaign_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Campaign"
          description: The ended `Campaign`.
      security:
        - BearerAuth: []
      tags:
        - campaigns
  /configuration-templates:
    get:
      description: Returns a list of `ConfigurationTemplate` objects.
      operationId: getConfigurationTemplates
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedConfigurationTemplateList"
          description: One page worth of configuration templates for your organization.
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
    post:
      description: Creates a configuration template.
      operationId: createConfigurationTemplate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateConfigurationTemplateInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConfigurationTemplate"
          description: The configuration template just created.
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
    put:
      description: Update a configuration template.
      operationId: updateConfigurationTemplate
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConfigurationTemplate"
          description: The configuration template just updated.
      requestBody:
        description: Configuration template to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateConfigurationTemplateInfo"
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
  /configuration-templates/{configuration_template_id}:
    delete:
      description: Deletes a configuration template.
      operationId: deleteConfigurationTemplate
      parameters:
        - description: The ID of the configuration template.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: configuration_template_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The configuration template was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - configuration-templates
  /event-streams:
    get:
      summary: Get event streams
      description: Returns a list of configured event streaming connections for your organization.
      operationId: getEventStreams
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EventStreamList"
          description: A list of event streams for your organization.
      security:
        - BearerAuth: []
      tags:
        - event-streams
    post:
      summary: Create event stream
      description: Creates a new event streaming connection.
      operationId: createEventStream
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateEventStreamInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EventStream"
          description: The event stream just created. Credentials are returned in clear text only on creation.
      security:
        - BearerAuth: []
      tags:
        - event-streams
  /event-streams/{event_stream_id}:
    put:
      summary: Update event stream
      description: Updates an existing event streaming connection.
      operationId: updateEventStream
      parameters:
        - description: The ID of the event stream.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: event_stream_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateEventStreamInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/EventStream"
          description: The updated event stream.
      security:
        - BearerAuth: []
      tags:
        - event-streams
    delete:
      summary: Delete event stream
      description: Deletes an event streaming connection.
      operationId: deleteEventStream
      parameters:
        - description: The ID of the event stream.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: event_stream_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The event stream was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - event-streams
  /events:
    get:
      description: Returns a list of `Event` objects.
      operationId: events
      parameters:
        - description: A start date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-01
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: start_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: An end date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-12
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: end_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: An actor filter for the events. Supply the ID of the actor.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: actor_filter
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: An object filter for the events. Supply the ID of the object.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: object_filter
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: An event type filter for the events.
          example: USER_MFA_RESET
          explode: true
          in: query
          name: event_type_filter
          required: false
          schema:
            type: string
          style: form
        - description:
            An API filter for the events. Supply the name and preview of the
            API token.
          example: fullaccess:**************************M_g==
          explode: true
          in: query
          name: api_token_filter
          required: false
          schema:
            type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedEventList"
          description: One page worth of events with the appropriate filters applied.
      security:
        - BearerAuth: []
      tags:
        - events
  /events/{event_id}:
    get:
      summary: Get event by ID
      description: Returns an `Event` object.
      operationId: getEvent
      parameters:
        - description: The ID of the event.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: path
          name: event_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Event"
          description: The requested `Event`.
        "404":
          description: Event not found.
      security:
        - BearerAuth: []
      tags:
        - events
  /groups:
    get:
      summary: Get groups
      description: Returns a list of groups for your organization.
      operationId: getGroups
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: The group type to filter by.
          example: OPAL_GROUP
          explode: true
          in: query
          name: group_type_filter
          required: false
          schema:
            $ref: "#/components/schemas/GroupTypeEnum"
          style: form
        - description: The group ids to filter by.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
            - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: query
          name: group_ids
          required: false
          schema:
            items:
              example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
              format: uuid
              type: string
            type: array
          style: form
        - description: Group name.
          example: example-name
          explode: true
          in: query
          name: group_name
          required: false
          schema:
            type: string
          style: form
        - description:
            The IDs of the tags to filter by. Returns only groups that have any
            of these tags applied.
          in: query
          name: tag_ids
          required: false
          schema:
            type: array
            items:
              format: uuid
              type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedGroupsList"
          description: One page worth groups associated with your organization.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Bulk updates a list of groups.
      operationId: updateGroups
      requestBody:
        description: Groups to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateGroupInfoList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UpdateGroupInfoList"
          description: The resulting updated group infos.
      security:
        - BearerAuth: []
      tags:
        - groups
    post:
      description: Creates an Opal group or [imports a remote
        group](https://docs.opal.dev/reference/end-system-objects).
      operationId: createGroup
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateGroupInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Group"
          description: The group just created.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}:
    get:
      summary: Get group by ID
      description: Returns a `Group` object.
      operationId: getGroup
      parameters:
        - description: The ID of the group.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Group"
          description: The requested `Group`.
      security:
        - BearerAuth: []
      tags:
        - groups
    delete:
      description: Deletes a group.
      operationId: delete_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The group was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/message-channels:
    get:
      description: Gets the list of audit and reviewer message channels attached to a group.
      operationId: get_group_message_channels
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannelList"
          description: The audit and reviewer message channels attached to the group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the list of audit message channels attached to a group.
      operationId: set_group_message_channels
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MessageChannelIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated audit message channel IDs for the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/on-call-schedules:
    get:
      description: Gets the list of on call schedules attached to a group.
      operationId: get_group_on_call_schedules
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallScheduleList"
          description: The on call schedules attached to the group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the list of on call schedules attached to a group.
      operationId: set_group_on_call_schedules
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OnCallScheduleIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: bb0197c0-5ea5-45d9-b3b7-b6c439be6435
                  format: uuid
                  type: string
                type: array
          description: The updated on call schedule IDs for the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/access_levels:
    get:
      summary: Get group access levels
      description:
        Returns the list of access levels defined for the group. Groups that
        only offer default (unnamed) access return an empty list.
      operationId: get_group_access_levels
      parameters:
        - description: The ID of the group whose access levels to return.
          name: group_id
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupAccessLevelList"
          description: The access levels defined for the group.
        "404":
          description: Group not found.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/resources:
    get:
      description: Gets the list of resources that the group gives access to.
      operationId: get_group_resources
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupResourceList"
          description: The resources that the group gives access to.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the list of resources that the group gives access to.
      operationId: set_group_resources
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateGroupResourcesInfo"
      responses:
        "200":
          description: The group resource were successfully set.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/containing-groups:
    get:
      summary: Get nested groups
      description: Gets the list of groups that the group gives access to.
      operationId: get_group_containing_groups
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The access level's remote ID to filter by.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form

      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupContainingGroupList"
          description: The groups that the group gives access to.
      security:
        - BearerAuth: []
      tags:
        - groups
    post:
      description: Creates a new containing group.
      operationId: add_group_containing_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GroupContainingGroup"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupContainingGroup"
          description: The created `GroupContainingGroup` object.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/containing-groups/{containing_group_id}:
    get:
      summary: Get nested group by ID
      description: Gets a specific containing group for a group.
      operationId: get_group_containing_group
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the containing group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: containing_group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupContainingGroup"
          description: The created `GroupContainingGroup` object.
      security:
        - BearerAuth: []
      tags:
        - groups
    delete:
      description: Removes a containing group from a group.
      operationId: remove_group_containing_group
      parameters:
        - description: The ID of the member group to remove.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the containing group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: containing_group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The remote ID of the member group's access level to filter by.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form

      responses:
        "204":
          description: The member group was successfully removed from the containing group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/resources/{resource_id}:
    post:
      description: Adds a resource to a group.
      operationId: add_group_resource
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The remote ID of the access level to grant to this user. If
            omitted, the default access level remote ID value (empty string) is
            used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
                duration_minutes: 60
              properties:
                access_level_remote_id:
                  description:
                    The remote ID of the access level to grant to this user. If
                    omitted, the default access level remote ID value (empty
                    string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
                duration_minutes:
                  description:
                    The duration for which the resource can be accessed (in minutes).
                    Use 0 to set to indefinite.
                  example: 60
                  type: integer
                  maximum: 525960 # One year
                  minimum: 0
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupResource"
          description: The created `GroupResource` object.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/visibility:
    get:
      description: Gets the visibility of this group.
      operationId: get_group_visibility
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      description: Sets the visibility of this group.
      operationId: set_group_visibility
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/VisibilityInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/reviewers:
    get:
      deprecated: true
      description: Gets the list of owner IDs of the reviewers for a group.
      operationId: get_group_reviewers
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The IDs of owners that are reviewers for this group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      deprecated: true
      description: Sets the list of reviewers for a group.
      operationId: set_group_reviewers
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated IDs of owners that are reviewers for this group
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/reviewer-stages:
    get:
      deprecated: true
      description: Gets the list of reviewer stages for a group.
      operationId: get_group_reviewer_stages
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The reviewer stages for this group.
      security:
        - BearerAuth: []
      tags:
        - groups
    put:
      deprecated: true
      description: Sets the list of reviewer stages for a group.
      operationId: set_group_reviewer_stages
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerStageList"
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The updated reviewer stages for this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/tags:
    get:
      description: Returns all tags applied to the group.
      operationId: get_group_tags
      parameters:
        - description: The ID of the group whose tags to return.
          name: group_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TagsList"
          description: The tags applied to the group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/users:
    get:
      description: Gets the list of users for this group.
      operationId: get_group_users
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description:
            Number of results to return per page, up to 1000. When set (or when a
            cursor is provided), the response contains a single page of results and
            a `next` cursor; the default page size is 200. When both page_size and
            cursor are omitted, the entire group membership is returned in one
            response with no `next` cursor. For large groups, prefer setting
            page_size and following `next`.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupUserList"
          description: List of users with access to this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/{group_id}/users/{user_id}:
    put:
      description: Updates a user's access level or duration in this group.
      operationId: update_group_user
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user whose access is being updated.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description:
                    The updated duration for which the group can be accessed (in
                    minutes). Use 0 for indefinite, or a negative value to
                    revoke access.
                  type: integer
                  maximum: 525960 # One year
                  example: 120
                access_level_remote_id:
                  description: The updated remote ID of the access level granted to this user.
                  type: string
                  example: arn:aws:iam::590304332660:role/ReadOnlyAccess
              required:
                - duration_minutes
      responses:
        "200":
          description: The GroupUser was successfully updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupUser"
      security:
        - BearerAuth: []
      tags:
        - groups
    post:
      description: Adds a user to this group.
      operationId: add_group_user
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to add.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The duration for which the group can be accessed (in minutes). Use
            0 to set to indefinite.
          example: 60
          explode: true
          in: query
          name: duration_minutes
          required: false
          schema:
            type: integer
            maximum: 525960 # One year
          style: form
          deprecated: true
        - description:
            The remote ID of the access level to grant to this user. If
            omitted, the default access level remote ID value (empty string) is
            used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description:
                    The duration for which the group can be accessed (in minutes). Use
                    0 to set to indefinite.
                  example: 60
                  type: integer
                access_level_remote_id:
                  description:
                    The remote ID of the access level to grant to this user. If
                    omitted, the default access level remote ID value (empty
                    string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
              required:
                - duration_minutes
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupUser"
          description: The GroupUser that was created.
      security:
        - BearerAuth: []
      tags:
        - groups
    delete:
      description: Removes a user's access from this group.
      operationId: delete_group_user
      parameters:
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of a user to remove from this group.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The remote ID of the access level for which this user has direct
            access. If omitted, the default access level remote ID value (empty
            string) is assumed.
          example: 30
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: This user's access was successfully removed from this group.
      security:
        - BearerAuth: []
      tags:
        - groups
  /groups/users/{user_id}:
    get:
      description: Returns all groups that the user is a member of.
      operationId: get_user_groups
      parameters:
        - description: The ID of the user whose groups to return.
          name: user_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupUserList"
          description: The groups that the user is a member of.
      security:
        - BearerAuth: []
      tags:
        - groups
  /group-bindings:
    get:
      summary: Get group bindings
      description: Returns a list of `GroupBinding` objects.
      operationId: getGroupBindings
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedGroupBindingsList"
          description: One page worth of group bindings for your organization.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
    post:
      description: Creates a group binding.
      operationId: createGroupBinding
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateGroupBindingInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupBinding"
          description: The group binding just created.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
    put:
      description: Bulk updates a list of group bindings.
      operationId: updateGroupBindings
      requestBody:
        description: Group bindings to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateGroupBindingInfoList"
      responses:
        "200":
          description: The group bindings were successfully updated.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
  /group-bindings/{group_binding_id}:
    get:
      summary: Get group binding by ID
      description: Returns a `GroupBinding` object.
      operationId: getGroupBinding
      parameters:
        - description: The ID of the group binding.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: group_binding_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupBinding"
          description: The requested `GroupBinding`.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
    delete:
      description: Deletes a group binding.
      operationId: deleteGroupBinding
      parameters:
        - description: The ID of the group binding.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_binding_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The group binding was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - group-bindings
  /idp-group-mappings/{app_resource_id}:
    get:
      description:
        Returns the configured set of available `IdpGroupMapping` objects
        for an Okta app.
      operationId: getIdpGroupMappings
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IdpGroupMappingList"
          description:
            The configured set of available `IdpGroupMapping` objects for an
            Okta app.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
    put:
      description: Updates the list of available `IdpGroupMapping` objects for an Okta app.
      operationId: updateIdpGroupMappings
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              properties:
                mappings:
                  type: array
                  items:
                    properties:
                      group_id:
                        type: string
                        format: uuid
                      alias:
                        type: string
                      hidden_from_end_user:
                        type: boolean
                    type: object
              required:
                - mappings
              type: object
      responses:
        "200":
          description:
            The updated set of available `IdpGroupMapping` objects for an Okta
            app.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
  /idp-group-mappings/{app_resource_id}/groups/{group_id}:
    get:
      description: Gets an `IdpGroupMapping` object for an Okta app and group.
      operationId: getIdpGroupMapping
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IdpGroupMapping"
          description: The `IdpGroupMapping` object for the Okta app and group.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
    post:
      description: |
        Creates or updates an individual `IdpGroupMapping` object (upsert operation).

        **Behavior:**
        - If the mapping doesn't exist, it will be created with the provided values
        - If the mapping exists, only the fields provided in the request will be updated
      operationId: createIdpGroupMapping
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: false
        content:
          application/json:
            schema:
              properties:
                alias:
                  description: Optional alias for the group mapping
                  type: string
                  nullable: true
                hidden_from_end_user:
                  description: |
                    Whether this mapping should be hidden from end users.
                    - **New mappings**: If not provided, defaults to `false`
                    - **Existing mappings**: If not provided, existing value is preserved (no change)
                    - **Explicit values**: If provided, value is updated to the specified boolean
                  type: boolean
                  nullable: true
              type: object
      responses:
        "200":
          description: The IDP group mapping was successfully created or updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/IdpGroupMapping"
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
    delete:
      description: Deletes an `IdpGroupMapping` object.
      operationId: delete_idp_group_mappings
      parameters:
        - description: The ID of the Okta app.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: app_resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The IDP group mapping was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - idp-group-mappings
  /owners:
    get:
      summary: Get owners
      description: Returns a list of `Owner` objects.
      operationId: get_owners
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: Owner name to filter by.
          example: 200
          explode: true
          in: query
          name: name
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedOwnersList"
          description: One page worth of owners in your organization.
      security:
        - BearerAuth: []
      tags:
        - owners
    post:
      description: Creates an owner.
      operationId: createOwner
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateOwnerInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Owner"
          description: The owner just created.
      security:
        - BearerAuth: []
      tags:
        - owners
    put:
      description: Bulk updates a list of owners.
      operationId: updateOwners
      requestBody:
        description: Owners to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateOwnerInfoList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UpdateOwnerInfoList"
          description: The resulting updated owner infos.
      security:
        - BearerAuth: []
      tags:
        - owners
  /owners/{owner_id}:
    get:
      summary: Get owner by ID
      description: Returns an `Owner` object.
      operationId: getOwner
      parameters:
        - description: The ID of the owner.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Owner"
          description: The owner object associated with the passed-in ID.
      security:
        - BearerAuth: []
      tags:
        - owners
    delete:
      description: Deletes an owner.
      operationId: delete_owner
      parameters:
        - description: The ID of the owner.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The owner was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - owners
  /owners/name/{owner_name}:
    get:
      description:
        Returns an `Owner` object. Does not support owners with `/` in
        their name, use /owners?name=... instead.
      operationId: getOwnerFromName
      parameters:
        - description: The name of the owner.
          example: MyOwner
          explode: true
          in: path
          name: owner_name
          required: true
          schema:
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Owner"
          description: The owner object associated with the passed-in name.
      security:
        - BearerAuth: []
      tags:
        - owners
  /owners/{owner_id}/users:
    get:
      description:
        Gets the list of users for this owner, in escalation priority order
        if applicable.
      operationId: get_owner_users
      parameters:
        - description: The ID of the owner.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserList"
          description: The users for this owner.
      security:
        - BearerAuth: []
      tags:
        - owners
    put:
      description:
        Sets the list of users for this owner. If escalation is enabled,
        the order of this list is the escalation priority order of the users. If
        the owner has a source group, adding or removing users from this list
        won't be possible.
      operationId: set_owner_users
      parameters:
        - description: The ID of the owner.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: owner_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UserIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UserList"
          description: The updated users for the owner.
      security:
        - BearerAuth: []
      tags:
        - owners
  /request-templates:
    get:
      description: Returns a list of `RequestTemplate` objects.
      operationId: getRequestTemplates
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedRequestTemplateList"
          description: One page worth of request templates for your organization.
      security:
        - BearerAuth: []
      tags:
        - request-templates
    post:
      description: Creates a request template.
      operationId: createRequestTemplate
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateRequestTemplateInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestTemplate"
          description: The request template just created.
      security:
        - BearerAuth: []
      tags:
        - request-templates
    put:
      description: Updates a request template.
      operationId: updateRequestTemplate
      requestBody:
        description: Request template to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateRequestTemplateInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestTemplate"
          description: The request template just updated.
      security:
        - BearerAuth: []
      tags:
        - request-templates
  /request-templates/{request_template_id}:
    get:
      description: Returns a `RequestTemplate` object.
      operationId: getRequestTemplate
      parameters:
        - description: The ID of the request template.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: request_template_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestTemplate"
          description: The requested request template.
      security:
        - BearerAuth: []
      tags:
        - request-templates
    delete:
      description: Deletes a request template.
      operationId: deleteRequestTemplate
      parameters:
        - description: The ID of the request template.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: request_template_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The request template was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - request-templates
  /requests:
    get:
      summary: Get requests
      description:
        Returns a list of requests for your organization that is visible by
        the admin.
      operationId: getRequests
      parameters:
        - description: A start date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-01
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: start_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: An end date filter for the events.
          examples:
            withDate:
              summary: Example with date
              value: 2021-11-12
            withDatetime:
              summary: Example with date and time in ISO 8601 datetime format.
              value: 2025-01-01T00:00:00Z
          explode: true
          in: query
          name: end_date_filter
          required: false
          schema:
            type: string
          style: form
        - description: Filter requests by their requester ID.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          in: query
          name: requester_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: Filter requests by their target user ID.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          in: query
          name: target_user_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: Filter requests by the resource ID that was requested.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          in: query
          name: resource_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: Filter requests by the group ID that was requested.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          in: query
          name: group_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: Boolean toggle for if it should only show pending requests.
          explode: true
          in: query
          name: show_pending_only
          required: false
          schema:
            type: boolean
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestList"
          description: The list of requests.
      security:
        - BearerAuth: []
      tags:
        - requests
    post:
      description: "Create an access request"
      operationId: "createRequest"
      requestBody:
        description: Resources to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateRequestInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                properties:
                  id:
                    format: uuid
                    type: string
                    example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          description: The resulting request.
      security:
        - BearerAuth: []
      tags:
        - requests
  /requests/relay:
    get:
      summary: Get requests via Relay
      description: Returns a paginated list of requests using Relay-style cursor pagination.
      operationId: getRequestsRelay
      deprecated: true
      parameters:
        - description: Number of results to return after the cursor. Use either
            first/after or last/before, not both.
          example: 10
          in: query
          name: first
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 100
        - description:
            Cursor to fetch results after. Used with 'first' for forward
            pagination.
          example:
            "Y3Vyc29yOnYyOpK5MjAyMS0wMS0wN1QwNzo0MToyNy4xMTlaFjYwZmM2YmJlZjk4YzE1N\
            2ZhNjFhYjk4Nw=="
          in: query
          name: after
          required: false
          schema:
            type: string
        - description: Number of results to return before the cursor. Use either
            first/after or last/before, not both.
          example: 10
          in: query
          name: last
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 100
        - description:
            Cursor to fetch results before. Used with 'last' for backward
            pagination.
          example:
            "Y3Vyc29yOnYyOpK5MjAyMS0wMS0wN1QwNzo0MToyNy4xMTlaFjYwZmM2YmJlZjk4YzE1N\
            2ZhNjFhYjk4Nw=="
          in: query
          name: before
          required: false
          schema:
            type: string
        - description: Filter requests by their status.
          example: PENDING
          in: query
          name: status
          required: false
          schema:
            $ref: "#/components/schemas/RequestStatusEnum"
        - description: Filter requests assigned to a specific user ID.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          in: query
          name: to
          required: false
          schema:
            format: uuid
            type: string
        - description: Filter requests made by a specific user ID.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          in: query
          name: from
          required: false
          schema:
            format: uuid
            type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestConnection"
          description: A paginated list of requests using Relay-style cursor pagination.
      security:
        - BearerAuth: []
      tags:
        - requests
  /requests/{id}:
    get:
      summary: Get request by ID
      description: Returns a request by ID.
      operationId: getRequest
      parameters:
        - description: The ID of the request.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The requested request object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Request"
      security:
        - BearerAuth: []
      tags:
        - requests
  /requests/{id}/approve:
    post:
      description: "Approve an access request"
      operationId: "approveRequest"
      parameters:
        - description: "The ID of the request to approve"
          in: path
          name: id
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        description: Approval parameters
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                level:
                  $ref: "#/components/schemas/RequestApprovalEnum"
                comment:
                  type: string
                  description: "Optional comment for the approval"
                  example: "Approved after security review"
              required:
                - level
      responses:
        "200":
          description: "Request successfully approved"
          content:
            application/json:
              schema:
                type: object
                properties:
                  request:
                    $ref: "#/components/schemas/Request"
      security:
        - BearerAuth: []
      tags:
        - requests
  /requests/{id}/deny:
    post:
      description: "Deny an access request"
      operationId: "denyRequest"
      parameters:
        - description: "The ID of the request to deny"
          in: path
          name: id
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        description: Denial parameters
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: "Comment for the denial"
                  example: "Denied due to insufficient justification"
                level:
                  $ref: "#/components/schemas/RequestApprovalEnum"
              required:
                - comment
      responses:
        "200":
          description: "Request successfully denied"
          content:
            application/json:
              schema:
                type: object
                properties:
                  request:
                    $ref: "#/components/schemas/Request"
      security:
        - BearerAuth: []
      tags:
        - requests
  /requests/{id}/comments:
    get:
      description: Returns a list of comments for a specific request.
      operationId: getRequestComments
      parameters:
        - description: "The ID of the request to get comments for"
          in: path
          name: id
          required: true
          schema:
            type: string
            format: uuid
      responses:
        "200":
          description: A list of comments associated with the specified request.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RequestCommentList"
      security:
        - BearerAuth: []
      tags:
        - requests
    post:
      description: "Comment on an access request"
      operationId: "createRequestComment"
      parameters:
        - description: "The ID of the request to comment on"
          in: path
          name: id
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        description: Comment parameters
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                comment:
                  type: string
                  description: "comment"
              required:
                - comment
      responses:
        "200":
          description: "Request successfully commented"
          content:
            application/json:
              schema:
                type: object
                properties:
                  request:
                    $ref: "#/components/schemas/Request"
      security:
        - BearerAuth: []
      tags:
        - requests
  /resources:
    get:
      summary: Get resources
      description: Returns a list of resources for your organization.
      operationId: getResources
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: The resource type to filter by. Required when remote_id is provided.
          example: AWS_IAM_ROLE
          explode: true
          in: query
          name: resource_type_filter
          required: false
          schema:
            $ref: "#/components/schemas/ResourceTypeEnum"
          style: form
        - description: The resource ids to filter by.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
            - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: query
          name: resource_ids
          required: false
          schema:
            items:
              example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
              format: uuid
              type: string
            type: array
          style: form
        - description: Resource name.
          example: example-name
          explode: true
          in: query
          name: resource_name
          required: false
          schema:
            type: string
          style: form
        - description: The parent resource id to filter by.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: query
          name: parent_resource_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description:
            The ancestor resource id to filter by. Returns all resources that
            are descendants of the specified resource.
          example:
            - 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: query
          name: ancestor_resource_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description:
            Filter resources by their remote id. This will return all resources
            that have a remote id that matches the provided remote id. Note that
            this requires resource_type_filter to be provided.
          in: query
          name: remote_id
          required: false
          schema:
            type: string
          style: form
        - description:
            The IDs of the tags to filter by. Returns only resources that have
            any of these tags applied.
          in: query
          name: tag_ids
          required: false
          schema:
            type: array
            items:
              format: uuid
              type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedResourcesList"
          description: One page worth resources associated with your organization.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Bulk updates a list of resources.
      operationId: updateResources
      requestBody:
        description: Resources to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateResourceInfoList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UpdateResourceInfoList"
          description: The resulting updated resource infos.
      security:
        - BearerAuth: []
      tags:
        - resources
    post:
      description: Creates a resource. See
        [here](https://docs.opal.dev/reference/end-system-objects) for details
        about importing resources.
      operationId: createResource
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateResourceInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Resource"
          description: The resource just created.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}:
    get:
      summary: Get resource by ID
      description: Retrieves a resource.
      operationId: get_resource
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The requested resource.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Resource"
      security:
        - BearerAuth: []
      tags:
        - resources
    delete:
      description: Deletes a resource.
      operationId: delete_resource
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The resource was successfully deleted.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/message-channels:
    get:
      description: Gets the list of audit message channels attached to a resource.
      operationId: get_resource_message_channels
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannelList"
          description: The audit message channels attached to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the list of audit message channels attached to a resource.
      operationId: set_resource_message_channels
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MessageChannelIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated audit message channel IDs for the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/visibility:
    get:
      description: Gets the visibility of this resource.
      operationId: get_resource_visibility
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the visibility of this resource.
      operationId: set_resource_visibility
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/VisibilityInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/VisibilityInfo"
          description: The visibility info of this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/reviewers:
    get:
      description: Gets the list of owner IDs of the reviewers for a resource.
      operationId: get_resource_reviewers
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The IDs of owners that are reviewers for this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the list of reviewers for a resource.
      operationId: set_resource_reviewers
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerIDList"
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
                  format: uuid
                  type: string
                type: array
          description: The updated IDs of owners that are reviewers for this resource
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/reviewer-stages:
    get:
      description: Gets the list reviewer stages for a resource.
      operationId: get_resource_reviewer_stages
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The reviewer stages for this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets the list of reviewer stages for a resource.
      operationId: set_resource_reviewer_stages
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ReviewerStageList"
      responses:
        "200":
          content:
            application/json:
              schema:
                description: A list of reviewer stages.
                items:
                  $ref: "#/components/schemas/ReviewerStage"
                type: array
          description: The updated reviewer stages for this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /non-human-identities:
    get:
      description: Returns a list of non-human identities for your organization.
      operationId: get_nhis
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedResourcesList"
          description: One page worth non-human identities in your organization.
      security:
        - BearerAuth: []
      tags:
        - non-human-identities
  /resources/{resource_id}/non-human-identities:
    get:
      description: Gets the list of non-human identities with access to this resource.
      operationId: get_resource_nhis
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: Limit the number of results returned.
          example: 200
          explode: true
          in: query
          name: limit
          required: false
          schema:
            type: integer
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessList"
          description: List of non-human identities with access to this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/users:
    get:
      summary: Get resource users
      description: Gets the list of users for this resource.
      operationId: get_resource_users
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: Limit the number of results returned.
          example: 200
          explode: true
          in: query
          name: limit
          required: false
          schema:
            type: integer
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceAccessUserList"
          description: List of users with access to this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/non-human-identities/{non_human_identity_id}:
    post:
      description: Gives a non-human identity access to this resource.
      operationId: add_resource_nhi
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The resource ID of the non-human identity to add.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: non_human_identity_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                duration_minutes: 60
                access_level_remote_id: roles/cloudsql.instanceUser
              properties:
                duration_minutes:
                  description:
                    The duration for which the resource can be accessed (in minutes).
                    Use 0 to set to indefinite.
                  example: 60
                  type: integer
                  maximum: 525960 # One year
                access_level_remote_id:
                  description:
                    The remote ID of the access level to grant. If omitted, the default
                    access level remote ID value (empty string) is used.
                  example: roles/cloudsql.instanceUser
                  type: string
              required:
                - duration_minutes
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceNHI"
          description:
            Details about the access that the non-human identity was granted to
            the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    delete:
      description: Removes a non-human identity's direct access from this resource.
      operationId: delete_resource_nhi
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The resource ID of the non-human identity to remove from this
            resource.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: non_human_identity_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The remote ID of the access level for which this non-human identity
            has direct access. If omitted, the default access level remote ID
            value (empty string) is assumed.
          example: roles/cloudsql.instanceUser
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description:
            This non-human identity's access was successfully removed from this
            resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/users/{user_id}:
    post:
      description: Adds a user to this resource.
      operationId: add_resource_user
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to add.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The duration for which the resource can be accessed (in minutes).
            Use 0 to set to indefinite.
          example: 60
          explode: true
          in: query
          name: duration_minutes
          required: false
          schema:
            type: integer
            maximum: 525960 # One year
          style: form
          deprecated: true
        - description:
            The remote ID of the access level to grant to this user. If
            omitted, the default access level remote ID value (empty string) is
            used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description:
                    The duration for which the resource can be accessed (in minutes).
                    Use 0 to set to indefinite.
                  example: 60
                  type: integer
                  maximum: 525960 # One year
                access_level_remote_id:
                  description:
                    The remote ID of the access level to grant to this user. If
                    omitted, the default access level remote ID value (empty
                    string) is used.
                  example: arn:aws:iam::590304332660:role/AdministratorAccess
                  type: string
              required:
                - duration_minutes
              type: object
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceUser"
          description: The ResourceUser that was created.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Updates a user's access level or duration on this resource.
      operationId: update_resource_user
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user whose access is being updated.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              example:
                duration_minutes: 60
                access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
              properties:
                duration_minutes:
                  description:
                    The updated duration for which the resource can be accessed (in
                    minutes). Use 0 for indefinite.
                  type: integer
                  maximum: 525960 # One year
                  example: 120
                access_level_remote_id:
                  description: The updated remote ID of the access level granted to this user.
                  type: string
                  example: arn:aws:iam::590304332660:role/ReadOnlyAccess
              required:
                - duration_minutes
      responses:
        "200":
          description: The ResourceUser was successfully updated.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceUser"
      security:
        - BearerAuth: []
      tags:
        - resources
    delete:
      description: Removes a user's direct access from this resource.
      operationId: delete_resource_user
      parameters:
        - description: The ID of the resource.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of a user to remove from this resource.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The remote ID of the access level for which this user has direct
            access. If omitted, the default access level remote ID value (empty
            string) is assumed.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          description: This user's access was successfully removed from this resource.
      security:
        - BearerAuth: []
      tags:
        - resources
    get:
      summary: Get resource user
      description: Returns information about a specific user's access to a resource.
      operationId: getResourceUser
      parameters:
        - description: The ID of the resource.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: "#/components/schemas/ResourceUser"
                  cursor:
                    type: string
                    description: Pagination cursor for the next page of results
                    example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
                  total_count:
                    type: integer
                    description: Total number of results
                    example: 120
                required:
                  - data
          description: List of ResourceUser records for the user's access to the resource.
        "404":
          description: Resource or user not found.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resource-user-access-status/{resource_id}/{user_id}:
    get:
      deprecated: true
      description: Get user's access status to a resource.
      operationId: resource_user_access_status_retrieve
      parameters:
        - description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description:
            The remote ID of the access level that you wish to query for the
            resource. If omitted, the default access level remote ID value
            (empty string) is used.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          explode: true
          in: query
          name: access_level_remote_id
          required: false
          schema:
            type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceUserAccessStatus"
          description: The access status reflecting the user's access to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/tags:
    get:
      description: Returns all tags applied to the resource.
      operationId: get_resource_tags
      parameters:
        - description: The ID of the resource whose tags to return.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TagsList"
          description: The tags applied to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/scoped-role-permissions:
    get:
      description:
        Returns all the scoped role permissions that apply to the given
        resource. Only OPAL_SCOPED_ROLE resource type supports this field.
      operationId: get_resource_scoped_role_permissions
      parameters:
        - description: The ID of the resource whose scoped role permissions belong to.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ScopedRolePermissionList"
          description: The role permissions that this Opal Scoped Role has.
      security:
        - BearerAuth: []
      tags:
        - resources
    put:
      description: Sets all the scoped role permissions on an OPAL_SCOPED_ROLE resource.
      operationId: set_resource_scoped_role_permissions
      parameters:
        - description:
            The ID of the resource whose scoped role permissions belong to.
            Must be of OPAL_SCOPED_ROLE resource type.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ScopedRolePermissionList"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ScopedRolePermissionList"
          description: The role permissions that this Opal Scoped Role has.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/users/{user_id}:
    get:
      description: Gets the list of resources for this user.
      operationId: get_user_resources
      parameters:
        - description: The ID of the user.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: Limit the number of results returned.
          example: 200
          explode: true
          in: query
          name: limit
          required: false
          schema:
            type: integer
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Include user's access to unmanaged resources.
          example: false
          explode: true
          in: query
          name: include_unmanaged
          required: false
          schema:
            type: boolean
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceAccessUserList"
          description: List of resources user has access to.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/groups:
    get:
      description: Returns a list of groups that grant access to the resource
      operationId: get_resource_groups
      parameters:
        - description: The ID of the resource that the groups grant access to.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/GroupResourceList"
          description: The groups that grant access to the resource.
      security:
        - BearerAuth: []
      tags:
        - resources
  /resources/{resource_id}/access_levels:
    get:
      summary: Get resource access levels
      description:
        Returns the list of access levels defined for the resource. Resources
        that only offer default (unnamed) access return an empty list.
      operationId: get_resource_access_levels
      parameters:
        - description: The ID of the resource whose access levels to return.
          name: resource_id
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ResourceAccessLevelList"
          description: The access levels defined for the resource.
        "404":
          description: Resource not found.
      security:
        - BearerAuth: []
      tags:
        - resources
  /paladin:
    post:
      summary: Create Paladin
      description: Creates a new `Paladin`.
      operationId: createPaladin
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePaladinInfo"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Paladin"
          description: The created Paladin.
      security:
        - BearerAuth: []
      tags:
        - paladin
  /paladin/{paladin_id}:
    get:
      summary: Get Paladin by ID
      description: Returns a `Paladin` object.
      operationId: getPaladin
      parameters:
        - description: The ID of the Paladin.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: paladin_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Paladin"
          description: The Paladin associated with the passed-in ID.
      security:
        - BearerAuth: []
      tags:
        - paladin
    put:
      summary: Update Paladin
      description: Updates a `Paladin` object.
      operationId: updatePaladin
      parameters:
        - description: The ID of the Paladin.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: paladin_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdatePaladinInfo"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Paladin"
          description: The updated Paladin.
      security:
        - BearerAuth: []
      tags:
        - paladin
    delete:
      summary: Delete Paladin
      description: Deletes a Paladin, removing the underlying service user.
      operationId: deletePaladin
      parameters:
        - description: The ID of the Paladin.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: paladin_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The Paladin was deleted.
      security:
        - BearerAuth: []
      tags:
        - paladin
  /paladin/name/{paladin_name}:
    get:
      summary: Get Paladins by name
      description:
        Returns all Paladins whose name exactly matches the given name. Names
        are not unique, so the result is a list and may be empty.
      operationId: getPaladinFromName
      parameters:
        - description: The name of the Paladin.
          example: paladin-agent-1
          explode: true
          in: path
          name: paladin_name
          required: true
          schema:
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaladinList"
          description: The list of Paladins matching the passed-in name.
      security:
        - BearerAuth: []
      tags:
        - paladin
  /paladin/{paladin_id}/context-sources:
    get:
      summary: List Paladin context sources
      description:
        Returns the context sources (Slack channels and documents) configured
        for a Paladin.
      operationId: listPaladinContextSources
      parameters:
        - description: The ID of the Paladin.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: paladin_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaladinContextSourceList"
          description: The context sources configured for the Paladin.
      security:
        - BearerAuth: []
      tags:
        - paladin
    post:
      summary: Add a Paladin context source
      description:
        Configures a context source (a Slack channel or a document) for a
        Paladin to read. Idempotent, so re-adding an existing source returns it.
      operationId: createPaladinContextSource
      parameters:
        - description: The ID of the Paladin.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: paladin_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreatePaladinContextSourceInfo"
        required: true
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaladinContextSource"
          description: The configured context source.
      security:
        - BearerAuth: []
      tags:
        - paladin
  /paladin/{paladin_id}/context-sources/{context_source_id}:
    delete:
      summary: Remove a Paladin context source
      description: Removes a context source from a Paladin.
      operationId: deletePaladinContextSource
      parameters:
        - description: The ID of the Paladin.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: paladin_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the context source.
          example: 8a1f2c3d-4b5e-6f70-8192-a3b4c5d6e7f8
          explode: true
          in: path
          name: context_source_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The context source was removed.
      security:
        - BearerAuth: []
      tags:
        - paladin
  /sessions:
    get:
      description: Returns a list of `Session` objects.
      operationId: sessions
      parameters:
        - description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: true
          in: query
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: form
        - description: The ID of the user you wish to query sessions for.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: query
          name: user_id
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SessionsList"
          description: The sessions associated with a resource.
      security:
        - BearerAuth: []
      tags:
        - sessions
  /user:
    get:
      description: Returns a `User` object.
      operationId: user
      parameters:
        - description: The user ID of the user.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: query
          name: user_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description:
            The email of the user. If both user ID and email are provided, user
            ID will take precedence. If neither are provided, an error will
            occur.
          example: johndoe@domain.org
          explode: true
          in: query
          name: email
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The user object associated with the passed-in email or ID.
      security:
        - BearerAuth: []
      tags:
        - users
  /users:
    get:
      description: Returns a list of users for your organization.
      operationId: getUsers
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description:
            The IDs of the tags to filter by. Returns only users that have any
            of these tags applied.
          in: query
          name: tag_ids
          required: false
          schema:
            type: array
            items:
              format: uuid
              type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedUsersList"
          description: One page worth users in your organization.
      security:
        - BearerAuth: []
      tags:
        - users
  /users/remote_users:
    get:
      description: Returns a list of remote users for your organization.
      operationId: getRemoteUsers
      parameters:
        - description: Filter remote users by their third party provider.
          example: [GIT_HUB]
          in: query
          name: third_party_provider
          required: false
          schema:
            type: array
            items:
              $ref: "#/components/schemas/ThirdPartyProviderEnum"
          style: form
        - description: Filter remote users by their user ID.
          example: [32acc112-21ff-4669-91c2-21e27683eaa1]
          in: query
          name: user_id
          required: false
          schema:
            type: array
            items:
              type: string
              format: uuid
          style: form
        - description: Filter remote users by their remote ID.
          example: [1234567890]
          in: query
          name: remote_id
          required: false
          schema:
            type: array
            items:
              type: string
          style: form
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedRemoteUsersList"
          description: One page worth users in your organization.
      security:
        - BearerAuth: []
      tags:
        - users
  /users/whoami:
    get:
      description:
        Returns the user that the provided API token authenticates as.
      operationId: getUserWhoami
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/User"
          description: The user that the API token authenticates as.
      security:
        - BearerAuth: []
      tags:
        - users
  /users/{user_id}/tags:
    get:
      description: Returns all tags applied to the user.
      operationId: get_user_tags
      parameters:
        - description: The ID of the user whose tags to return.
          name: user_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TagsList"
          description: The tags applied to the user.
      security:
        - BearerAuth: []
      tags:
        - users
  /access-rules:
    get:
      description: Returns a list of access rules for your organization.
      operationId: get_access_rules
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedAccessRulesList"
          description: One page of access rules for your organization.
      security:
        - BearerAuth: []
      tags:
        - access-rules
    post:
      description: Creates a new access rule config for the given group_id.
      operationId: create_access_rule
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateAccessRuleInfo"
      responses:
        "201":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRule"
          description: The created access rule config for the group.
      security:
        - BearerAuth: []
      tags:
        - access-rules
  /access-rules/{access_rule_id}:
    get:
      description:
        Returns a list of access rule config given the group_id of the
        access rule.
      operationId: get_access_rule
      parameters:
        - description: The access rule ID (group ID) of the access rule.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: access_rule_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRule"
          description: The access rules for the group.
      security:
        - BearerAuth: []
      tags:
        - access-rules
    put:
      description: Updates the access rule config for the given group_id.
      operationId: update_access_rule
      parameters:
        - description: The access rule ID (group ID) of the access rule.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: access_rule_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateAccessRuleInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AccessRule"
          description: The updated access rule config for the group.
      security:
        - BearerAuth: []
      tags:
        - access-rules
  /tag/{tag_id}:
    get:
      summary: Get tag by ID
      description: UNSTABLE. May be removed at any time. Gets a tag with the given id.
      operationId: get_tag_by_ID
      parameters:
        - description: The tag ID
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: tag_id
          required: true
          schema:
            type: string
            format: uuid
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Tag"
          description: The tag requested.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: UNSTABLE. May be removed at any time. Deletes a tag with the given id.
      operationId: delete_tag_by_ID
      parameters:
        - description: The tag ID
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: tag_id
          required: true
          schema:
            type: string
            format: uuid
          style: simple
      responses:
        "200":
          description: Tag was deleted.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tag:
    get:
      description: Gets a tag with the given key and value.
      operationId: get_tag
      parameters:
        - description: The key of the tag to get.
          example: api-scope
          explode: false
          in: query
          name: tag_key
          required: true
          schema:
            type: string
          style: form
        - description: The value of the tag to get.
          example: production
          explode: false
          in: query
          name: tag_value
          required: false
          schema:
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Tag"
          description: The tag requested.
      security:
        - BearerAuth: []
      tags:
        - tags
    post:
      description: Creates a tag with the given key and value.
      operationId: create_tag
      parameters:
        - description: The key of the tag to create.
          example: api-scope
          explode: false
          in: query
          name: tag_key
          required: false
          schema:
            type: string
          style: form
          deprecated: true
        - description: The value of the tag to create.
          example: production
          explode: false
          in: query
          name: tag_value
          required: false
          schema:
            type: string
          style: form
          deprecated: true
        - description: The ID of the owner that manages the tag.
          example: f92aa855-cea9-4814-b9d8-f2a60d3e4a06
          explode: false
          in: query
          name: admin_owner_id
          schema:
            format: uuid
            type: string
          style: form
          deprecated: true
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateTagInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Tag"
          description: The tag that was created.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags:
    get:
      summary: Get tags
      description: Returns a list of tags created by your organization.
      operationId: getTags
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedTagsList"
          description: A list of tags created by your organization.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags/{tag_id}/users/{user_id}:
    post:
      description: Applies a tag to a user.
      operationId: add_user_tag
      parameters:
        - description: The ID of the tag to apply.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to apply the tag to.
          name: user_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
      responses:
        "200":
          description: Tag applied to user successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: Removes a tag from a user.
      operationId: remove_user_tag
      parameters:
        - description: The ID of the tag to remove.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the user to remove the tag from.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: user_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag removed from user successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags/{tag_id}/groups/{group_id}:
    post:
      description: Applies a tag to a group.
      operationId: add_group_tag
      parameters:
        - description: The ID of the tag to apply.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group to apply the tag to.
          name: group_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag applied to group successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: Removes a tag from a group.
      operationId: remove_group_tag
      parameters:
        - description: The ID of the tag to remove.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the group to remove the tag from.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: group_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag removed from group successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
  /tags/{tag_id}/resources/{resource_id}:
    post:
      description: Applies a tag to a resource.
      operationId: add_resource_tag
      parameters:
        - description: The ID of the tag to apply.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the resource to apply the tag to.
          name: resource_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag applied to resource successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
    delete:
      description: Removes a tag from a resource.
      operationId: remove_resource_tag
      parameters:
        - description: The ID of the tag to remove.
          name: tag_id
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          required: true
          schema:
            format: uuid
            type: string
          style: simple
        - description: The ID of the resource to remove the tag from.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          explode: false
          in: path
          name: resource_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Tag removed from resource successfully.
      security:
        - BearerAuth: []
      tags:
        - tags
  /message-channels:
    get:
      summary: Get message channels
      description: Returns a list of `MessageChannel` objects.
      operationId: get_message_channels
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannelList"
          description: A list of message channels for your organization.
      security:
        - BearerAuth: []
      tags:
        - message-channels
    post:
      description: Creates a `MessageChannel` objects.
      operationId: create_message_channel
      requestBody:
        description: The `MessageChannel` object to be created.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateMessageChannelInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannel"
          description: The message channel that was created.
      security:
        - BearerAuth: []
      tags:
        - message-channels
  /message-channels/{message_channel_id}:
    get:
      summary: Get message channel by ID
      description: Gets a `MessageChannel` object.
      operationId: get_message_channel
      parameters:
        - description: The ID of the message_channel.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: message_channel_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/MessageChannel"
          description: The requested message channel.
      security:
        - BearerAuth: []
      tags:
        - message-channels
  /on-call-schedules:
    get:
      summary: Get on call schedules
      description: Returns a list of `OnCallSchedule` objects.
      operationId: get_on_call_schedules
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallScheduleList"
          description: A list of on call schedules for your organization.
      security:
        - BearerAuth: []
      tags:
        - on-call-schedules
    post:
      description: Creates a `OnCallSchedule` objects.
      operationId: create_on_call_schedule
      requestBody:
        description: The `OnCallSchedule` object to be created.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateOnCallScheduleInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallSchedule"
          description: The on call schedule that was created.
      security:
        - BearerAuth: []
      tags:
        - on-call-schedules
  /on-call-schedules/{on_call_schedule_id}:
    get:
      summary: Get on call schedule by ID
      description: Gets a `OnCallSchedule` object.
      operationId: get_on_call_schedule
      parameters:
        - description: The ID of the on_call_schedule.
          example: 9546209c-42c2-4801-96d7-9ec42df0f59c
          explode: false
          in: path
          name: on_call_schedule_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OnCallSchedule"
          description: The requested on call schedule.
      security:
        - BearerAuth: []
      tags:
        - on-call-schedules
  /queries/run:
    post:
      summary: Run an ad-hoc OpalQuery
      description: Runs an ad-hoc OpalQuery and returns the results. Supports
        NODE queries (users, resources, groups) and ACCESS_PATH queries
        (principal-to-entitlement access edges). This endpoint is only
        available to our OpalQuery beta group. Please contact Opal support if
        you'd like to be added to the beta.
      operationId: runOpalQuery
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RunOpalQueryRequest"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OpalQueryResults"
          description: The results of the OpalQuery.
      security:
        - BearerAuth: []
      tags:
        - opal-queries
  /tokens:
    get:
      summary: Get tokens
      description:
        Returns a list of first-party API tokens for your organization.
        Requires admin access.
      operationId: getTokens
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
        - description: Filter by token IDs.
          explode: false
          in: query
          name: token_ids
          required: false
          schema:
            items:
              format: uuid
              type: string
            type: array
          style: form
        - description: Filter by user ID.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: user_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedTokensList"
          description: A list of API tokens for your organization.
      security:
        - BearerAuth: []
      tags:
        - tokens
  /tokens/{token_id}:
    delete:
      summary: Delete token
      description: Deletes a first-party API token. Admins can delete any token.
        Non-admins can only delete their own tokens when the organization allows
        all users to create API tokens.
      operationId: deleteToken
      parameters:
        - description: The ID of the token to delete.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          explode: false
          in: path
          name: token_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: The token was successfully deleted.
        "403":
          description: Not authorized to delete this token.
        "404":
          description: Token not found.
      security:
        - BearerAuth: []
      tags:
        - tokens
  /uars:
    get:
      deprecated: true
      description:
        Returns a list of `UAR` objects. Deprecated in favor of `GET /campaigns`.
      operationId: getUARs
      parameters:
        - description: The pagination cursor value.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: Number of results to return per page. Default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedUARsList"
          description: A list of UARs for your organization.
      security:
        - BearerAuth: []
      tags:
        - uars
  /uar:
    post:
      deprecated: true
      description:
        Starts a User Access Review. Deprecated in favor of `POST /campaigns`.
      operationId: create_uar
      requestBody:
        description: The settings of the UAR.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateUARInfo"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UAR"
          description: The UAR that was started.
      security:
        - BearerAuth: []
      tags:
        - uars
  /uar/{uar_id}:
    get:
      deprecated: true
      description:
        Retrieves a specific UAR. Deprecated in favor of
        `GET /campaigns/{campaign_id}`.
      operationId: get_uar
      parameters:
        - description: The ID of the UAR.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: path
          name: uar_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UAR"
          description: The UAR that was requested.
      security:
        - BearerAuth: []
      tags:
        - uars
  /sync_errors:
    get:
      description:
        Returns a list of recent sync errors that have occurred since the
        last successful sync.
      operationId: getSyncErrors
      parameters:
        - description: The ID of the app to list sync errors for.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: false
          in: query
          name: app_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: The ID of the resource to list sync errors for.
          example: 4baf8423-db0a-4037-a4cf-f79c60cb67a5
          explode: false
          in: query
          name: resource_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: The ID of the group to list sync errors for.
          example: 9546209c-42c2-4801-96d7-9ec42df0f59c
          explode: false
          in: query
          name: group_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                items:
                  $ref: "#/components/schemas/SyncErrorList"
                type: array
          description: A list of sync errors.
      security:
        - BearerAuth: []
      tags:
        - apps
  /delegations:
    get:
      summary: Get delegations
      description:
        Returns a list of request reviewer delegations configured for your
        organization.
      operationId: getDelegations
      parameters:
        - description:
            The delegator user ID to filter delegations by the user delegating
            their access review requests.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: delegator_user_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description:
            The delegate user ID to filter delegations by the user being
            delegated to.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          explode: true
          in: query
          name: delegate_user_id
          required: false
          schema:
            format: uuid
            type: string
          style: form
        - description: A cursor to indicate where to start fetching results.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          explode: true
          in: query
          name: cursor
          required: false
          schema:
            type: string
          style: form
        - description: The maximum number of results to return per page. The default is 200.
          example: 200
          explode: true
          in: query
          name: page_size
          required: false
          schema:
            type: integer
            maximum: 1000
          style: form
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedDelegationsList"
          description: A list of delegations for your organization.
      security:
        - BearerAuth: []
      tags:
        - delegations
    post:
      description:
        Creates a new request reviewer delegation to delegate access review
        requests from one user to another.
      operationId: createDelegation
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateDelegationRequest"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Delegation"
          description: Delegation created successfully.
      security:
        - BearerAuth: []
      tags:
        - delegations
  /delegations/{delegation_id}:
    get:
      summary: Get delegation by ID
      description: Returns a specific delegation by its ID.
      operationId: getDelegation
      parameters:
        - description: The ID of the delegation to retrieve.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: delegation_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Delegation"
          description: The requested delegation.
      security:
        - BearerAuth: []
      tags:
        - delegations
    delete:
      description: Deletes a delegation by its ID.
      operationId: deleteDelegation
      parameters:
        - description: The ID of the delegation to remove.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          explode: true
          in: path
          name: delegation_id
          required: true
          schema:
            format: uuid
            type: string
          style: simple
      responses:
        "200":
          description: Delegation removed successfully
      security:
        - BearerAuth: []
      tags:
        - delegations

components:
  schemas:
    AccessEntityFilters:
      type: object
      description:
        Filters for matching entities by type, name, tag, IDs, connections,
        or access levels. Supports recursive logical composition via
        allOf/anyOf.
      properties:
        entityTypes:
          type: array
          description: Filter by entity type. Only RESOURCE, GROUP, and USER are
            queryable via OpalQuery.
          items:
            type: string
            enum: [RESOURCE, GROUP, USER]
        entityItemTypes:
          type: array
          description: Filter by entity item types.
          items:
            $ref: "#/components/schemas/EntityItemTypeEnum"
        entityName:
          $ref: "#/components/schemas/EntityNameFilter"
        entityTag:
          $ref: "#/components/schemas/EntityTagFilter"
        hrIdpStatus:
          $ref: "#/components/schemas/IdpStatusFilter"
        entityAdminOwner:
          $ref: "#/components/schemas/EntityAdminFilter"
        entityIDs:
          type: array
          description: Filter by specific entity UUIDs.
          items:
            type: string
            format: uuid
        importedFromApp:
          type: array
          description: Filter by app IDs from which returned nodes will be imported from.
          items:
            type: string
            format: uuid
        roleRemoteIds:
          type: array
          description: Filter by role remote IDs. Can only be applied within a hasAccessTo clause.
          items:
            type: string
        roleNames:
          type: array
          description: Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause.
          items:
            type: string
        allOf:
          type: array
          description: >
            A list of nested filters that must all match (logical AND). Each
             item has the same shape as this object — scalar fields like
             `entityTypes` or `entityTag`, and can further nest `allOf`,
             `anyOf`, or `not`.
          items:
            $ref: "#/components/schemas/AccessEntityFilters"
        anyOf:
          type: array
          description: >
            A list of nested filters where at least one must match (logical
             OR). Each item has the same shape as this object.
          items:
            $ref: "#/components/schemas/AccessEntityFilters"
        not:
          description: >
            Excludes entities matching the embedded filter (logical NOT). Pass
            a filter object with the same shape as this one — typically a
            single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to
            exclude resources.
          type: object
          x-go-type: AccessEntityFilters

    RunOpalQueryRequest:
      description:
        Request body for running an ad-hoc OpalQuery. The `type` field
        determines which query schema applies.
      oneOf:
        - $ref: "#/components/schemas/OpalNodeQuery"
        - $ref: "#/components/schemas/OpalAccessPathQuery"
      discriminator:
        propertyName: type
        mapping:
          NODE: "#/components/schemas/OpalNodeQuery"
          ACCESS_PATH: "#/components/schemas/OpalAccessPathQuery"
      # example:
      #   type: NODE
      #   query:
      #     nodeFilters:
      #       entityTypes: [RESOURCE]
      #       allOf:
      #         - entityTag:
      #             key: env
      #             value: prod
      #         - entityTag:
      #             key: team
      #             value: platform
      #       not:
      #         entityItemTypes: [AWS_IAM_ROLE]
      #     accessFilters:
      #       isAccessibleBy:
      #         entityTypes: [USER]
      #         entityTag:
      #           key: contractor
      #   first: 50

    OpalNodeQuery:
      type: object
      required:
        - type
      description:
        Request body for a NODE-type OpalQuery. Returns entities (users,
        resources, groups) matching the given filters.
      example:
        type: NODE
        query:
          nodeFilters:
            entityTypes: [RESOURCE]
            entityTag:
              key: env
              value: prod
          accessFilters:
            isAccessibleBy:
              entityTypes: [USER]
              entityTag:
                key: contractor
        first: 50
      properties:
        type:
          type: string
          enum:
            - NODE
        query:
          $ref: "#/components/schemas/OpalNodeQueryBody"
        first:
          type: integer
          description: Maximum number of results to return. Defaults to 200.
          example: 200
        after:
          type: string
          description: Cursor from a previous response to fetch the next page of results.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac

    OpalNodeQueryBody:
      type: object
      description: The filter body for a NODE-type OpalQuery.
      properties:
        nodeFilters:
          $ref: "#/components/schemas/AccessEntityFilters"
        accessFilters:
          $ref: "#/components/schemas/AccessRelationshipFilters"

    OpalQueryResultNode:
      type: object
      required:
        - id
        - name
        - entityType
        - entityItemType
      description: A matched entity from an OpalQuery result.
      properties:
        id:
          type: string
          format: uuid
          description: The entity's unique identifier.
        name:
          type: string
          description: The display name of the entity.
        entityType:
          type: string
          enum:
            - USER
            - GROUP
            - RESOURCE
          description: The top-level entity type.
        entityItemType:
          $ref: "#/components/schemas/EntityItemTypeEnum"

    OpalQueryResultEdge:
      type: object
      required:
        - node
        - cursor
      description:
        A single result edge from an OpalQuery, containing the matched
        entity and its pagination cursor.
      properties:
        node:
          $ref: "#/components/schemas/OpalQueryResultNode"
        cursor:
          type: string
          description: Opaque cursor for this entity, used for pagination.

    OpalQueryResults:
      description:
        Paginated results of an OpalQuery. The `type` field discriminates
        which result schema applies and mirrors the `type` field on the request.
      oneOf:
        - $ref: "#/components/schemas/OpalNodeQueryResults"
        - $ref: "#/components/schemas/OpalAccessPathQueryResults"
      discriminator:
        propertyName: type
        mapping:
          NODE: "#/components/schemas/OpalNodeQueryResults"
          ACCESS_PATH: "#/components/schemas/OpalAccessPathQueryResults"

    OpalNodeQueryResults:
      type: object
      required:
        - type
        - edges
        - pageInfo
      description:
        Paginated results of a NODE-type OpalQuery — one edge per matched
        entity (user, resource, or group).
      properties:
        type:
          type: string
          enum:
            - NODE
        edges:
          type: array
          description: List of matched entities.
          items:
            $ref: "#/components/schemas/OpalQueryResultEdge"
        pageInfo:
          $ref: "#/components/schemas/PageInfo"

    OpalAccessPathQuery:
      type: object
      required:
        - type
      description:
        Request body for an ACCESS_PATH-type OpalQuery. Returns principal-to-
        entitlement access paths matching the given edge filters.
      example:
        type: ACCESS_PATH
        query:
          principalFilter:
            entityTypes: [USER]
          entitlementFilter:
            entityItemTypes: [AWS_IAM_ROLE]
          edgeFilter:
            directOnly: true
        first: 50
      properties:
        type:
          type: string
          enum:
            - ACCESS_PATH
        query:
          $ref: "#/components/schemas/OpalAccessPathQueryBody"
        first:
          type: integer
          description: Maximum number of results to return. Defaults to 200.
          example: 200
        after:
          type: string
          description:
            Opaque cursor from a previous ACCESS_PATH response to fetch the
            next page of results.
        includeCount:
          type: boolean
          description:
            When true, populate totalCount in the response. Defaults to false.
          example: false

    OpalAccessPathQueryBody:
      type: object
      description:
        Edge-query filters for an ACCESS_PATH OpalQuery. At least one of
        principalFilter or entitlementFilter is required.
      properties:
        principalFilter:
          $ref: "#/components/schemas/AccessEntityFilters"
        entitlementFilter:
          $ref: "#/components/schemas/AccessEntityFilters"
        principalAccessFilters:
          description: >
            Advanced access filter on the principal side of each path. Restricts
            results to principals that additionally satisfy these access-edge
            constraints: `hasAccessTo` keeps only principals that also have
            access to a matching entity; `isAccessibleBy` keeps only principals
            that are also accessible by a matching entity. Only takes effect when
            `principalFilter` is also supplied (it refines that filter); on its
            own it has no effect.
          $ref: "#/components/schemas/AccessRelationshipFilters"
        entitlementAccessFilters:
          description: >
            Advanced access filter on the entitlement side of each path.
            Restricts results to entitlements that additionally satisfy these
            access-edge constraints: `hasAccessTo` keeps only entitlements that
            also have access to a matching entity; `isAccessibleBy` keeps only
            entitlements that are also accessible by a matching entity. Only
            takes effect when `entitlementFilter` is also supplied (it refines
            that filter); on its own it has no effect.
          $ref: "#/components/schemas/AccessRelationshipFilters"
        accessLevelRemoteIds:
          type: array
          description: Filter by access-level remote IDs on the terminal edge.
          items:
            type: string
        accessLevelNames:
          type: array
          description: Filter by access-level display names on the terminal edge.
          items:
            type: string
        edgeFilter:
          $ref: "#/components/schemas/OpalAccessPathEdgeFilter"

    OpalAccessPathEdgeFilter:
      type: object
      description: Constraints on the access path edges themselves.
      properties:
        directOnly:
          type: boolean
          description:
            When true, only return direct (depth-1) principal-to-entitlement
            edges.
          example: true
        accessDurationType:
          type: string
          description: Constrain results by whether the terminal access expires.
          enum:
            - EXPIRING_ONLY
            - PERMANENT_ONLY
          example: EXPIRING_ONLY

    OpalAccessPathResultNode:
      type: object
      required:
        - principalId
        - entitlementId
        - depth
        - path
      description: A matched access path from an ACCESS_PATH OpalQuery.
      properties:
        principalId:
          type: string
          format: uuid
          description: The principal entity ID.
        entitlementId:
          type: string
          format: uuid
          description: The entitlement entity ID.
        accessLevelRemoteId:
          type: string
          nullable: true
          description: Remote ID of the terminal access level.
        accessLevelName:
          type: string
          nullable: true
          description: Display name of the terminal access level.
        expiration:
          type: string
          format: date-time
          nullable: true
          description: Expiration of the terminal access, if any.
        depth:
          type: integer
          description: Number of hops from principal to entitlement (path length - 1).
        path:
          type: array
          description: Entity IDs along the path from principal to entitlement.
          items:
            type: string
            format: uuid

    OpalAccessPathResultEdge:
      type: object
      required:
        - node
        - cursor
      description:
        A single ACCESS_PATH result edge containing the matched path and its
        pagination cursor.
      properties:
        node:
          $ref: "#/components/schemas/OpalAccessPathResultNode"
        cursor:
          type: string
          description: Opaque cursor for this path, used for pagination.

    OpalAccessPathQueryResults:
      type: object
      required:
        - type
        - edges
        - pageInfo
      description:
        Paginated results of an ACCESS_PATH-type OpalQuery — one edge per
        matched principal-to-entitlement access path.
      properties:
        type:
          type: string
          enum:
            - ACCESS_PATH
        edges:
          type: array
          description: List of matched access paths.
          items:
            $ref: "#/components/schemas/OpalAccessPathResultEdge"
        pageInfo:
          $ref: "#/components/schemas/PageInfo"
        totalCount:
          type: integer
          nullable: true
          description:
            Exact total number of matching paths when includeCount was true on
            the request; otherwise null.

    AccessRelationshipFilters:
      type: object
      description: >
        Filters the returned nodes by the access edges connected to them.
        When `isAccessibleBy` and `hasAccessTo` are provided, the returned nodes
        must satisfy both edge constraints simultaneously.
      properties:
        isAccessibleBy:
          description:
            Inbound-edge filter. The returned node must be accessible by at
            least one entity matching this filter.
          $ref: "#/components/schemas/AccessEntityFilters"
        hasAccessTo:
          description:
            Outbound-edge filter. The returned node must have access to at
            least one entity matching this filter.
          $ref: "#/components/schemas/AccessEntityFilters"

    EntityNameFilter:
      type: object
      required:
        - stringMatchType
        - string
      description: Filters entities by name using a string match strategy.
      properties:
        stringMatchType:
          $ref: "#/components/schemas/StringMatchType"
        string:
          type: string
          description: The string value to match against the entity name.
          example: engineering

    EntityTagFilter:
      type: object
      required:
        - key
      description:
        Filters entities by a tag key/value pair, optionally scoped to a
        connection.
      properties:
        key:
          type: string
          description: The tag key to filter by.
          example: team
        value:
          type: string
          description:
            The tag value to filter by. If omitted, matches any value for the
            given key.
          example: platform
        connectionId:
          type: string
          format: uuid
          description: If specified, filters by tags associated with this connection.

    IdpStatusFilter:
      type: object
      description: >
        Filters USER entities by their HR/IDP lifecycle status. Only applies to
        USER entities; GROUP and RESOURCE entities never match, in either
        polarity. `statuses` combine with OR. `not` inverts the match within the
        user domain (e.g. "IDP status is NOT active"), so it still returns only
        users rather than sweeping in groups/resources.
      properties:
        statuses:
          type: array
          description: Match users whose HR/IDP status is one of these values.
          items:
            $ref: "#/components/schemas/UserHrIdpStatusEnum"
        not:
          type: boolean
          description:
            Invert the match within the user domain (e.g. "IDP status is NOT
            active").

    EntityAdminFilter:
      type: object
      required:
        - ownerIDs
      description: >
        Filters GROUP and RESOURCE entities by their admin owner. USER entities
        never match, in either polarity. `not` inverts the match within the
        resource/group domain (self-negating, like IdpStatusFilter): omit it (or
        false) to include entities owned by the given owners, set it true to
        exclude them.
      properties:
        ownerIDs:
          type: array
          description: The owner (group) UUIDs to match entities against.
          items:
            type: string
            format: uuid
        not:
          type: boolean
          description:
            Invert the match — return resources/groups NOT owned by the given
            owners.

    StringMatchType:
      type: string
      description: >-
        How to match a string value against entity names. REGEX matches the
        value as a case-insensitive regular expression.
      enum:
        - CONTAINS
        - EQUALS
        - STARTS_WITH
        - ENDS_WITH
        - REGEX

    PaginatedAssignedRequestList:
      type: object
      required:
        - requests
        - cursor
      properties:
        requests:
          type: array
          items:
            $ref: "#/components/schemas/Request"
        cursor:
          type: string
          description: The cursor to continue pagination
    PageInfo:
      type: object
      required:
        - hasNextPage
        - endCursor
        - hasPreviousPage
        - startCursor
      properties:
        hasNextPage:
          type: boolean
          description: Whether there are more items after the end cursor
        endCursor:
          type: string
          description: The cursor to continue pagination forwards
        hasPreviousPage:
          type: boolean
          description: Whether there are more items before the start cursor
        startCursor:
          type: string
          description: The cursor to continue pagination backwards

    RequestEdge:
      type: object
      required:
        - node
        - cursor
      properties:
        node:
          $ref: "#/components/schemas/Request"
        cursor:
          type: string
          description: The cursor for this request edge

    RequestConnection:
      type: object
      required:
        - edges
        - pageInfo
        - totalCount
      properties:
        edges:
          type: array
          items:
            $ref: "#/components/schemas/RequestEdge"
        pageInfo:
          $ref: "#/components/schemas/PageInfo"
        totalCount:
          type: integer
          description: The total number of items available
    UARScope:
      description:
        If set, the access review will only contain resources and groups
        that match at least one of the filters in scope.
      example:
        filter_operator: ANY
        users:
          - userd283-ca87-4a8a-bdbb-df212eca5353
        include_group_bindings: True
        tags:
          - key: uar_scope
            value: high_priority
        names:
          - demo
          - api
        admins:
          - f454d283-ca87-4a8a-bdbb-df212eca5353
          - 8763d283-ca87-4a8a-bdbb-df212ecab139
        resource_types:
          - GCP_CLOUD_SQL_POSTGRES_INSTANCE
        group_types:
          - AWS_SSO_GROUP
        apps:
          - pas2d283-ca87-4a8a-bdbb-df212eca5353
          - apss2d283-ca87-4a8a-bdbb-df212eca5353
        entities:
          - f454d283-as87-4a8a-bdbb-df212eca5353
          - f454d283-as87-4a8a-bdbb-df212eca5329
      properties:
        group_visibility:
          description: Specifies what users can see during an Access Review
          type: string
          enum: [STRICT, VIEW_VISIBLE_AND_ASSIGNED, VIEW_ALL]
        users:
          description:
            The access review will only include the following users. If any
            users are selected, any entity filters will be applied to only the
            entities that the selected users have access to.
          items:
            example: userd283-ca87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        filter_operator:
          description:
            Specifies whether entities must match all (AND) or any (OR) of the
            filters.
          type: string
          enum: [ANY, ALL]
        entities:
          description:
            This access review will include resources and groups with ids in
            the given strings.
          items:
            example: f454d283-as87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        apps:
          description: This access review will include items in the specified applications
          items:
            example: pas2d283-ca87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        admins:
          description:
            This access review will include resources and groups who are owned
            by one of the owners corresponding to the given IDs.
          items:
            example: f454d283-ca87-4a8a-bdbb-df212eca5353
            type: string
            format: uuid
          type: array
        group_types:
          description: This access review will include items of the specified group types
          type: array
          items:
            $ref: "#/components/schemas/GroupTypeEnum"
        resource_types:
          description: This access review will include items of the specified resource types
          type: array
          items:
            $ref: "#/components/schemas/ResourceTypeEnum"
        include_group_bindings:
          type: boolean
          example: False
        tags:
          description:
            This access review will include resources and groups who are tagged
            with one of the given tags.
          items:
            $ref: "#/components/schemas/TagFilter"
          type: array
        names:
          description:
            This access review will include resources and groups whose name
            contains one of the given strings.
          items:
            example: demo
            type: string
          type: array
      type: object
    CampaignStatusEnum:
      description: The current status of a campaign.
      enum:
        - DRAFT
        - ONGOING
        - COMPLETED
        - STOPPED
        - ENDED
      example: ONGOING
      type: string
    CampaignRevokeOnEnum:
      description: When access decisions take effect during a campaign.
      enum:
        - ACTION
        - END
        - NONE
      example: END
      type: string
    CampaignGroupAssetVisibilityPolicyEnum:
      description: Controls what group assets reviewers can see during the campaign.
      enum:
        - STRICT
        - VIEW_VISIBLE_AND_ASSIGNED
        - VIEW_ALL
      example: STRICT
      type: string
    CampaignConfiguration:
      description: Configuration for an access review campaign.
      example:
        configuration_id: 39a4d283-ca87-4a8a-bdbb-df212eca5fdb
        created_at: 2026-07-01T00:00:00Z
        updated_at: 2026-07-01T00:00:00Z
        query: null
        reviewer_assignment_policy: MANUALLY
        allow_self_review: false
        send_reviewer_assignment_notification: true
        allow_reviewer_reassignment: false
        start_date: null
        end_date: 2026-09-30T00:00:00Z
        timezone: America/Los_Angeles
        revoke_on: END
        reminder_schedule: [7, 3, 1]
        reminder_include_manager: true
        require_reason_on_denial: false
        hide_ai_suggestions: false
        custom_start_message: null
        group_asset_visibility_policy: STRICT
        is_template: false
        cron_expression: null
        next_scheduled_run: null
        last_scheduled_run: null
        recurring_duration_days: null
      properties:
        configuration_id:
          description: The ID of the campaign configuration.
          example: 39a4d283-ca87-4a8a-bdbb-df212eca5fdb
          format: uuid
          type: string
        created_at:
          description: The creation time of the configuration.
          example: 2026-07-01T00:00:00Z
          format: date-time
          type: string
        updated_at:
          description: The last updated time of the configuration.
          example: 2026-07-01T00:00:00Z
          format: date-time
          type: string
        query:
          description:
            Access-path query defining the scope of access to review. Uses the
            same principalFilter / entitlementFilter shape as ACCESS_PATH
            OpalQuery.
          allOf:
            - $ref: "#/components/schemas/OpalAccessPathQueryBody"
          nullable: true
        reviewer_assignment_policy:
          $ref: "#/components/schemas/UARReviewerAssignmentPolicyEnum"
        allow_self_review:
          description: Whether reviewers can review their own access.
          example: false
          type: boolean
        send_reviewer_assignment_notification:
          description: Whether to notify reviewers upon assignment.
          example: true
          type: boolean
        allow_reviewer_reassignment:
          description: Whether reviewers may reassign their reviews to another user.
          example: false
          type: boolean
        start_date:
          description: Scheduled start date of the campaign.
          example: 2026-07-02T00:00:00Z
          format: date-time
          nullable: true
          type: string
        end_date:
          description: Scheduled end date of the campaign.
          example: 2026-09-30T00:00:00Z
          format: date-time
          nullable: true
          type: string
        timezone:
          description:
            IANA timezone used to interpret campaign deadlines (e.g.
            America/Los_Angeles).
          example: America/Los_Angeles
          type: string
        revoke_on:
          $ref: "#/components/schemas/CampaignRevokeOnEnum"
        reminder_schedule:
          description: Days before end date to send reminder notifications.
          example: [7, 3, 1]
          items:
            type: integer
          type: array
        reminder_include_manager:
          description: Whether to include the reviewer's manager in reminders.
          example: true
          type: boolean
        require_reason_on_denial:
          description:
            Whether reviewers must provide a reason when denying (revoking)
            access.
          example: false
          type: boolean
        hide_ai_suggestions:
          description: Whether AI suggestions are hidden from reviewers.
          example: false
          type: boolean
        custom_start_message:
          description:
            Optional custom message included when notifying reviewers that the
            campaign started.
          example: Please complete your reviews by Friday.
          nullable: true
          type: string
        group_asset_visibility_policy:
          $ref: "#/components/schemas/CampaignGroupAssetVisibilityPolicyEnum"
        is_template:
          description:
            Whether this configuration is a recurring schedule template.
          example: false
          type: boolean
        cron_expression:
          description:
            Cron expression driving the recurring schedule. Null for one-off
            campaigns.
          example: 0 9 1 * *
          nullable: true
          type: string
        next_scheduled_run:
          description: Next time a draft will be generated from this template.
          example: 2026-08-01T16:00:00Z
          format: date-time
          nullable: true
          type: string
        last_scheduled_run:
          description: Most recent time a draft was generated from this template.
          example: 2026-07-01T16:00:00Z
          format: date-time
          nullable: true
          type: string
        recurring_duration_days:
          description:
            Deadline window in days applied to each draft generated from this
            template.
          example: 14
          nullable: true
          type: integer
      required:
        - configuration_id
        - created_at
        - updated_at
        - reviewer_assignment_policy
        - allow_self_review
        - send_reviewer_assignment_notification
        - allow_reviewer_reassignment
        - timezone
        - revoke_on
        - reminder_include_manager
        - require_reason_on_denial
        - hide_ai_suggestions
        - group_asset_visibility_policy
        - is_template
      type: object
    CreateCampaignConfigurationInfo:
      description:
        Configuration to apply when creating a campaign. `query` is required;
        other omitted fields use defaults.
      example:
        query:
          principalFilter:
            entityTypes: [USER]
        end_date: 2026-09-30T00:00:00Z
        timezone: America/Los_Angeles
        allow_self_review: false
      properties:
        query:
          description: |
            Access-path query defining the scope of access to review. Required.
            Uses the same principalFilter / entitlementFilter shape as
            ACCESS_PATH OpalQuery. Must include at least one of
            principalFilter or entitlementFilter.

            Campaign scope only supports direct access edges:
            `edgeFilter.directOnly` defaults to `true`, is always stored as
            `true`, and passing `false` returns 400.
          allOf:
            - $ref: "#/components/schemas/OpalAccessPathQueryBody"
        reviewer_assignment_policy:
          $ref: "#/components/schemas/UARReviewerAssignmentPolicyEnum"
        allow_self_review:
          description: Whether reviewers can review their own access.
          example: false
          type: boolean
        send_reviewer_assignment_notification:
          description: Whether to notify reviewers upon assignment.
          example: true
          type: boolean
        allow_reviewer_reassignment:
          description: Whether reviewers may reassign their reviews to another user.
          example: false
          type: boolean
        start_date:
          description: Scheduled start date of the campaign.
          example: 2026-07-02T00:00:00Z
          format: date-time
          nullable: true
          type: string
        end_date:
          description: Scheduled end date of the campaign.
          example: 2026-09-30T00:00:00Z
          format: date-time
          nullable: true
          type: string
        timezone:
          description:
            IANA timezone used to interpret campaign deadlines (e.g.
            America/Los_Angeles).
          example: America/Los_Angeles
          type: string
        revoke_on:
          $ref: "#/components/schemas/CampaignRevokeOnEnum"
        reminder_schedule:
          description: Days before end date to send reminder notifications.
          example: [7, 3, 1]
          items:
            type: integer
          type: array
        reminder_include_manager:
          description: Whether to include the reviewer's manager in reminders.
          example: true
          type: boolean
        require_reason_on_denial:
          description:
            Whether reviewers must provide a reason when denying (revoking)
            access.
          example: false
          type: boolean
        hide_ai_suggestions:
          description: Whether AI suggestions are hidden from reviewers.
          example: false
          type: boolean
        custom_start_message:
          description:
            Optional custom message included when notifying reviewers that the
            campaign started.
          example: Please complete your reviews by Friday.
          nullable: true
          type: string
        group_asset_visibility_policy:
          $ref: "#/components/schemas/CampaignGroupAssetVisibilityPolicyEnum"
        is_template:
          description:
            Whether this configuration is a recurring schedule template.
          example: false
          type: boolean
        cron_expression:
          description:
            Cron expression driving the recurring schedule. Null for one-off
            campaigns.
          example: 0 9 1 * *
          nullable: true
          type: string
        recurring_duration_days:
          description:
            Deadline window in days applied to each draft generated from this
            template.
          example: 14
          nullable: true
          type: integer
        excluded_role_assignment_ids:
          description:
            Role assignment IDs to exclude from the campaign scope during
            population.
          items:
            format: uuid
            type: string
          type: array
      required:
        - query
      type: object
    CreateCampaignInfo:
      description: |-
        # CreateCampaignInfo Object
        ### Description
        The `CreateCampaignInfo` object is used to create a campaign.

        ### Usage Example
        Use in the `POST Campaigns` endpoint.
      example:
        name: Q3 Access Review
        configuration:
          query:
            principalFilter:
              entityTypes: [USER]
          end_date: 2026-09-30T00:00:00Z
          timezone: America/Los_Angeles
      properties:
        name:
          description: The name of the campaign.
          example: Q3 Access Review
          type: string
        configuration:
          description:
            Configuration for the campaign. Required; must include a query.
            Other omitted fields use defaults.
          allOf:
            - $ref: "#/components/schemas/CreateCampaignConfigurationInfo"
      required:
        - name
        - configuration
      type: object
    UpdateCampaignConfigurationInfo:
      description: |
        Configuration fields to update on a campaign. All fields are optional;
        omitted fields are left unchanged. `query` and
        `reviewer_assignment_policy` are set at create time and cannot be
        updated here; including either field returns 400.
        `cron_expression` and `recurring_duration_days` may only be set when
        the campaign is a template; setting them on a one-off campaign returns
        400. `is_template` is immutable and not accepted on update.
      example:
        end_date: 2026-09-30T00:00:00Z
        timezone: America/Los_Angeles
        allow_self_review: false
      properties:
        allow_self_review:
          description: Whether reviewers can review their own access.
          example: false
          type: boolean
        send_reviewer_assignment_notification:
          description: Whether to notify reviewers upon assignment.
          example: true
          type: boolean
        allow_reviewer_reassignment:
          description: Whether reviewers may reassign their reviews to another user.
          example: false
          type: boolean
        start_date:
          description: |
            Scheduled start date of the campaign. May only be updated while the
            campaign has not started (started_at is null). When set, the date's
            calendar day in the campaign timezone must be at least tomorrow.
          example: 2026-07-02T00:00:00Z
          format: date-time
          nullable: true
          type: string
        end_date:
          description: |
            Scheduled end date of the campaign. When set, the date's calendar
            day in the campaign timezone must be at least tomorrow.
          example: 2026-09-30T00:00:00Z
          format: date-time
          nullable: true
          type: string
        timezone:
          description:
            IANA timezone used to interpret campaign deadlines (e.g.
            America/Los_Angeles).
          example: America/Los_Angeles
          type: string
        revoke_on:
          $ref: "#/components/schemas/CampaignRevokeOnEnum"
        reminder_schedule:
          description: Days before end date to send reminder notifications.
          example: [7, 3, 1]
          items:
            type: integer
          type: array
        reminder_include_manager:
          description: Whether to include the reviewer's manager in reminders.
          example: true
          type: boolean
        require_reason_on_denial:
          description:
            Whether reviewers must provide a reason when denying (revoking)
            access.
          example: false
          type: boolean
        hide_ai_suggestions:
          description: Whether AI suggestions are hidden from reviewers.
          example: false
          type: boolean
        custom_start_message:
          description:
            Optional custom message included when notifying reviewers that the
            campaign started.
          example: Please complete your reviews by Friday.
          nullable: true
          type: string
        group_asset_visibility_policy:
          $ref: "#/components/schemas/CampaignGroupAssetVisibilityPolicyEnum"
        cron_expression:
          description:
            Cron expression driving the recurring schedule. Only valid on
            template campaigns. Pass an empty string to clear the active months
            (next_scheduled_run is cleared); the campaign remains a template.
          example: 0 9 1 * *
          nullable: true
          type: string
        recurring_duration_days:
          description:
            Deadline window in days applied to each draft generated from this
            template. Only valid on template campaigns.
          example: 14
          nullable: true
          type: integer
      type: object
    UpdateCampaignInfo:
      description: |-
        # UpdateCampaignInfo Object
        ### Description
        The `UpdateCampaignInfo` object is used to partially update a campaign.
        Omitted fields are left unchanged.

        ### Usage Example
        Use in the `PUT Campaign` endpoint.
      example:
        name: Q3 Access Review (Updated)
        configuration:
          end_date: 2026-09-30T00:00:00Z
          timezone: America/Los_Angeles
      properties:
        name:
          description: The name of the campaign.
          example: Q3 Access Review (Updated)
          type: string
        configuration:
          description: Configuration fields to create or update.
          allOf:
            - $ref: "#/components/schemas/UpdateCampaignConfigurationInfo"
      type: object
    Campaign:
      description: An access review campaign.
      example:
        campaign_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: Q3 Access Review
        status: DRAFT
        is_template: false
        created_at: 2026-07-01T00:00:00Z
        updated_at: 2026-07-01T00:00:00Z
        created_by_user_id: 32acc112-21ff-4669-91c2-21e27683eaa1
        configuration: null
        started_at: null
        started_by_user_id: null
        stopped_at: null
        stopped_by_user_id: null
        ended_at: null
        ended_by_user_id: null
      properties:
        campaign_id:
          description: The ID of the campaign.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the campaign.
          example: Q3 Access Review
          type: string
        status:
          $ref: "#/components/schemas/CampaignStatusEnum"
        is_template:
          description:
            Whether this campaign is a recurring schedule template. Templates
            spawn draft campaigns on schedule rather than being reviewed directly.
          example: false
          type: boolean
        created_at:
          description: The creation time of the campaign.
          example: 2026-07-01T00:00:00Z
          format: date-time
          type: string
        updated_at:
          description: The last updated time of the campaign.
          example: 2026-07-01T00:00:00Z
          format: date-time
          type: string
        created_by_user_id:
          description: The ID of the user who created the campaign.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          format: uuid
          type: string
        configuration:
          description: The campaign's configuration, if set.
          allOf:
            - $ref: "#/components/schemas/CampaignConfiguration"
          nullable: true
        started_at:
          description: The time the campaign was started, if started.
          example: 2026-07-02T00:00:00Z
          format: date-time
          nullable: true
          type: string
        started_by_user_id:
          description: The ID of the user who started the campaign, if started.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          format: uuid
          nullable: true
          type: string
        stopped_at:
          description: The time the campaign was manually stopped, if stopped.
          example: 2026-07-10T00:00:00Z
          format: date-time
          nullable: true
          type: string
        stopped_by_user_id:
          description: The ID of the user who stopped the campaign, if stopped.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          format: uuid
          nullable: true
          type: string
        ended_at:
          description: The time the campaign reached its scheduled end, if ended.
          example: 2026-07-14T00:00:00Z
          format: date-time
          nullable: true
          type: string
        ended_by_user_id:
          description: The ID of the user who ended the campaign, if ended.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          format: uuid
          nullable: true
          type: string
      required:
        - campaign_id
        - name
        - status
        - is_template
        - created_at
        - updated_at
        - created_by_user_id
      type: object
    PaginatedCampaignsList:
      description: A list of campaigns.
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - campaign_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: Q3 Access Review
            status: DRAFT
            is_template: false
            created_at: 2026-07-01T00:00:00Z
            updated_at: 2026-07-01T00:00:00Z
            created_by_user_id: 32acc112-21ff-4669-91c2-21e27683eaa1
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Campaign"
          type: array
      required:
        - results
      type: object
    PaginatedUARsList:
      description: A list of UARs.
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - uar_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: Monthly UAR (July)
            send_reviewer_assignment_notification: False
            deadline: 2022-07-14T06:59:59Z
            time_zone: America/Los_Angeles
            self_review_allowed: False
            uar_scope:
              tags:
                - key: uar_scope
                  value: high_priority
              names:
                - demo
                - api
              admins:
                - f454d283-ca87-4a8a-bdbb-df212eca5353
                - 8763d283-ca87-4a8a-bdbb-df212ecab139
          - uar_id: 39a4d283-ca87-4a8a-bdbb-df212eca5fdb
            name: Monthly UAR (August)
            send_reviewer_assignment_notification: True
            deadline: 2022-08-14T06:59:59Z
            time_zone: America/Los_Angeles
            self_review_allowed: False
            uar_scope:
              tags:
                - key: uar_scope
                  value: high_priority
              names:
                - demo
                - api
              admins:
                - f454d283-ca87-4a8a-bdbb-df212eca5353
                - 8763d283-ca87-4a8a-bdbb-df212ecab139
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/UAR"
          type: array
      required:
        - results
      type: object
    UAR:
      description: A user access review.
      example:
        uar_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: Monthly UAR (July)
        send_reviewer_assignment_notification: False
        deadline: 2022-07-14T06:59:59Z
        time_zone: America/Los_Angeles
        self_review_allowed: False
        uar_scope:
          tags:
            - key: uar_scope
              value: high_priority
          names:
            - demo
            - api
          admins:
            - f454d283-ca87-4a8a-bdbb-df212eca5353
            - 8763d283-ca87-4a8a-bdbb-df212ecab139
      properties:
        uar_id:
          description: The ID of the UAR.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the UAR.
          example: Monthly UAR (July)
          type: string
        reviewer_assignment_policy:
          $ref: "#/components/schemas/UARReviewerAssignmentPolicyEnum"
        send_reviewer_assignment_notification:
          description:
            A bool representing whether to send a notification to reviewers
            when they're assigned a new review. Default is False.
          example: False
          type: boolean
        deadline:
          description: The last day for reviewers to complete their access reviews.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        time_zone:
          description:
            The time zone name (as defined by the IANA Time Zone database) used
            in the access review deadline and exported audit report. Default is
            America/Los_Angeles.
          example: America/Los_Angeles
          type: string
        self_review_allowed:
          description:
            A bool representing whether to present a warning when a user is the
            only reviewer for themself. Default is False.
          example: False
          type: boolean
        instantly_action_reviews:
          description:
            A bool representing whether to instantly action changes when
            reviewers submit their decision. Default is False.
          type: boolean
          example: False
        uar_scope:
          $ref: "#/components/schemas/UARScope"
      required:
        - uar_id
        - name
        - deadline
        - reviewer_assignment_policy
        - send_reviewer_assignment_notification
        - time_zone
        - self_review_allowed
        - instantly_action_reviews
      type: object
    CreateUARInfo:
      description: Information needed to start a user access review.
      example:
        name: Monthly UAR (July)
        send_reviewer_assignment_notification: False
        deadline: 2022-07-14T06:59:59Z
        time_zone: America/Los_Angeles
        self_review_allowed: False
        reminder_schedule: [7, 3, 1, 0]
        reminder_include_manager: True
        uar_scope:
          group_visibility: STRICT
          tags:
            - key: uar_scope
              value: high_priority
          names:
            - demo
            - api
          admins:
            - f454d283-ca87-4a8a-bdbb-df212eca5353
            - 8763d283-ca87-4a8a-bdbb-df212ecab139
      properties:
        name:
          description: The name of the UAR.
          example: Monthly UAR (July)
          type: string
        reviewer_assignment_policy:
          $ref: "#/components/schemas/UARReviewerAssignmentPolicyEnum"
        send_reviewer_assignment_notification:
          description:
            A bool representing whether to send a notification to reviewers
            when they're assigned a new review. Default is False.
          example: False
          type: boolean
        deadline:
          description: The last day for reviewers to complete their access reviews.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        time_zone:
          description:
            The time zone name (as defined by the IANA Time Zone database) used
            in the access review deadline and exported audit report. Default is
            America/Los_Angeles.
          example: America/Los_Angeles
          type: string
        self_review_allowed:
          description:
            A bool representing whether to present a warning when a user is the
            only reviewer for themself. Default is False.
          example: False
          type: boolean
        instantly_action_reviews:
          description:
            A bool representing whether to instantly action changes when
            reviewers submit their decision. Default is False.
          type: boolean
          example: False
        reminder_schedule:
          items:
            type: integer
          type: array
        reminder_include_manager:
          type: boolean
          example: False
        uar_scope:
          $ref: "#/components/schemas/UARScope"
      required:
        - name
        - deadline
        - reviewer_assignment_policy
        - send_reviewer_assignment_notification
        - time_zone
        - self_review_allowed
      type: object
    UARReviewerAssignmentPolicyEnum:
      description:
        A policy for auto-assigning reviewers. If auto-assignment is on,
        specific assignments can still be manually adjusted after the access
        review is started. Default is Manually. BY_OWNING_TEAM_ADMIN assigns
        reviews to resource admins in round-robin fashion.
        BY_OWNING_TEAM_ADMIN_ALL assigns reviews to all resource admins.
        BY_APPROVERS assigns reviews to resource approvers in round-robin
        fashion. BY_APPROVERS_ALL assigns reviews to all resource approvers.
      enum:
        - MANUALLY
        - BY_OWNING_TEAM_ADMIN
        - BY_OWNING_TEAM_ADMIN_ALL
        - BY_MANAGER
        - BY_APPROVERS
        - BY_APPROVERS_ALL
      example: MANUALLY
      type: string
    TagFilter:
      description: A tag filter defined by the tags key and value.
      example:
        key: uar_scope
        value: high_priority
      properties:
        key:
          description: The key of the tag.
          example: uar_scope
          type: string
        value:
          description: The value of the tag.
          example: high_priority
          type: string
      required:
        - key
      type: object
    AppsList:
      description: A list of apps.
      example:
        - app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
          name: Okta Org
          description: Okta directory for the engineering team.
          admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
          app_type: OKTA_DIRECTORY
        - app_id: 5247d283-ca87-4a8a-bdbb-df212eca1243
          name: Prod AWS Account
          description: Our production engineering account for AWS.
          admin_owner_id: aab485d-0651-43e2-a748-d69d6584123af
          app_type: AWS
      properties:
        apps:
          items:
            $ref: "#/components/schemas/App"
          type: array
      required:
        - apps
      type: object
    App:
      description: |-
        # App Object
        ### Description
        The `App` object is used to represent an app to an application.

        ### Usage Example
        List from the `GET Apps` endpoint.
      example:
        app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: Okta Org
        description: Okta directory for the engineering team.
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        app_type: OKTA_DIRECTORY
      properties:
        app_id:
          description: The ID of the app.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the app.
          example: Okta Org
          type: string
        description:
          description: A description of the app.
          example: Okta directory for the engineering team.
          type: string
        admin_owner_id:
          description: The ID of the owner of the app.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        app_type:
          $ref: "#/components/schemas/AppTypeEnum"
        validations:
          description: Validation checks of an apps' configuration and permissions.
          items:
            $ref: "#/components/schemas/AppValidation"
          type: array
      required:
        - app_id
        - name
        - description
        - admin_owner_id
        - app_type
      type: object
    AppTypeEnum:
      description: The type of an app.
      enum:
        - ACTIVE_DIRECTORY
        - ANTHROPIC
        - AZURE_AD
        - AWS
        - AWS_SSO
        - CLICKHOUSE
        - COUPA
        - CURSOR
        - CUSTOM
        - CONFLUENCE
        - CUSTOM_CONNECTOR
        - DATABRICKS
        - DATASTAX_ASTRA
        - ALICLOUD
        - DEVIN
        - DOCUSIGN
        - DUO
        - GCP
        - GIT_HUB
        - GIT_LAB
        - GOOGLE_GROUPS
        - GOOGLE_WORKSPACE
        - GRAFANA
        - HUBSPOT
        - ILEVEL
        - INCIDENTIO
        - JIRA
        - LDAP
        - MARIADB
        - MONGO
        - MONGO_ATLAS
        - MYSQL
        - NETSUITE
        - DATADOG
        - OKTA_CIAM
        - OKTA_DIRECTORY
        - OPENAI_PLATFORM
        - OPAL
        - ORACLE_FUSION
        - PAGERDUTY
        - POSTGRES
        - ROOTLY
        - SALESFORCE
        - SNOWFLAKE
        - SLACK
        - TABLEAU
        - TAILSCALE
        - TELEPORT
        - TWINGATE
        - VAULT
        - WORKDAY
        - ZENDESK
        - ZOOM
      example: OKTA_DIRECTORY
      type: string
    EntityTypeEnum:
      description: The type of an entity.
      enum:
        - GROUP
        - RESOURCE
        - USER
      example: GROUP
      type: string
    Event:
      description: |-
        # Event Object
        ### Description
        The `Event` object is used to represent an event.

        ### Usage Example
        Fetch from the `LIST Events` endpoint.
      example:
        event_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        actor_user_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        created_at: 2022-01-23T04:56:07Z
        event_type: USERS_CREATED
      properties:
        event_id:
          description: The ID of the event.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        actor_user_id:
          description: The ID of the actor user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        actor_name:
          description: The name of the actor user.
          example: John Smith
          format: string
        actor_email:
          description: The email of the actor user.
          example: john@acmecorp.com
          type: string
        event_type:
          description: The event type.
          example: USERS_CREATED
          type: string
        created_at:
          description: The day and time the event was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        actor_ip_address:
          description: The IP address of the event actor.
          example: 255.255.255.0
          type: string
        api_token_name:
          description: The name of the API token used to create the event.
          example: My API Token
          type: string
        api_token_preview:
          description: The preview of the API token used to create the event.
          example: "**************************M_g=="
          type: string
        sub_events:
          items:
            $ref: "#/components/schemas/SubEvent"
          type: array
      required:
        - event_id
        - actor_user_id
        - actor_name
        - event_type
        - created_at
      type: object
    AppValidation:
      description: |-
        # App validation object
        ### Description
        The `AppValidation` object is used to represent a validation check of an apps' configuration and permissions.

        ### Usage Example
        List from the `GET Apps` endpoint.
      example:
        key: "iam:GetRole"
        name: "Opal's service account is missing the 'iam:GetRole' permission."
        usage_reason: "Opal uses the 'iam:GetRole' permissions to view access to resources."
        details:
          "403 Google API Error. Service account is not authorized to access role
          assignments."
        severity: HIGH
        status: FAILED
        updated_at: 2021-01-06T20:00:00Z
      properties:
        key:
          description: The key of the app validation. These are not unique IDs between runs.
          example: "iam:GetUser"
          type: string
        name:
          description:
            The human-readable description of whether the validation has the
            permissions.
          example: "Opal's service account is missing the 'iam:GetUser' description."
        usage_reason:
          description: The reason for needing the validation.
          example: Opal uses the 'iam:GetUser' permission to import users.
          type: string
        details:
          description:
            Extra details regarding the validation. Could be an error message
            or restrictions on permissions.
          example:
            403 Google API Error. Service account is not authorized to access role
            assignments.
          type: string
        severity:
          $ref: "#/components/schemas/AppValidationSeverityEnum"
        status:
          $ref: "#/components/schemas/AppValidationStatusEnum"
        updated_at:
          description: The date and time the app validation was last run.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
      required:
        - key
        - name
        - status
        - severity
        - updated_at
    AppValidationSeverityEnum:
      description: The severity of an app validation.
      enum:
        - CRITICAL
        - HIGH
        - MEDIUM
        - LOW
      example: CRITICAL
      type: string
    AppValidationStatusEnum:
      description: The status of an app validation.
      enum:
        - SUCCESS
        - FAILED
      example: FAILED
      type: string
    SubEvent:
      description: |-
        # Sub event Object
        ### Description
        The `SubEvent` object is used to represent a subevent.

        ### Usage Example
        Fetch from the `LIST Events` endpoint.
      example:
        sub_event_type: USERS_CREATED
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        user_name: John Smith
        resource_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_name: Figma
      properties:
        sub_event_type:
          description: The subevent type.
          example: USERS_CREATED
          type: string
      required:
        - sub_event_type
      type: object
      additionalProperties: true
    PaginatedEventList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - event_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            actor_user_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            created_at: 2022-01-23T04:56:07Z
            event_type: USERS_CREATED
          - event_id: 7646aa9a-e2ee-4eb5-8c62-91f29038a373
            actor_user_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            created_at: 2022-02-03T12:33:02Z
            event_type: USER_TEAM_UPDATED
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Event"
          type: array
      type: object
    ResourceAccessUserList:
      example:
        results:
          - full_name: Jake Barnes
            user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-01-23T04:56:07Z
            email: jake@company.dev
            has_direct_access: true
            num_access_paths: 2
          - full_name: Brett Ashley
            user_id: 7646aa9a-e2ee-4eb5-8c62-91f29038a373
            resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-02-03T12:33:02Z
            email: brett@company.dev
            has_direct_access: true
            num_access_paths: 3
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/ResourceAccessUser"
          type: array
      type: object
    ResourceAccessLevel:
      description: |-
        # Access Level Object
        ### Description
        The `AccessLevel` object is used to represent the level of access that a principal has. The "default" access
        level is a `AccessLevel` object whose fields are all empty strings.

        ### Usage Example
        View the `AccessLevel` of a resource/user or resource/group pair to see the level of access granted to the resource.
      example:
        access_level_name: AdminRole
        access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
      properties:
        access_level_name:
          description: The human-readable name of the access level.
          example: AdminRole
          type: string
        access_level_remote_id:
          description: The machine-readable identifier of the access level.
          example: arn:aws:iam::590304332660:role/AdministratorAccess
          type: string
      required:
        - access_level_name
        - access_level_remote_id
      type: object
    ResourceAccessLevelList:
      description: A list of access levels defined for a resource.
      example:
        results:
          - access_level_name: AdminRole
            access_level_remote_id: arn:aws:iam::590304332660:role/AdministratorAccess
          - access_level_name: ReadOnly
            access_level_remote_id: arn:aws:iam::590304332660:role/ReadOnlyAccess
      properties:
        results:
          items:
            $ref: "#/components/schemas/ResourceAccessLevel"
          type: array
      type: object
    ResourceUserAccessStatus:
      description: |-
        # AccessStatus Object
        ### Description
        The `AccessStatus` object is used to represent the user's access to the resource.

        ### Usage Example
        View the `AccessStatus` for a resource/user pair to determine if the user has access to the resource.
      example:
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        status: AUTHORIZED
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        status:
          $ref: "#/components/schemas/ResourceUserAccessStatusEnum"
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - resource_id
        - status
        - user_id
      type: object
    ResourceUserAccessStatusEnum:
      description: The status of the user's access to the resource.
      enum:
        - AUTHORIZED
        - REQUESTED
        - UNAUTHORIZED
      example: AUTHORIZED
      type: string
    ResourceUser:
      description: |-
        # Resource User Object
        ### Description
        The `ResourceUser` object is used to represent a user with direct access to a resource.
      example:
        full_name: Jake Barnes
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        email: jake@company.dev
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        email:
          description: The user's email.
          example: jake@company.dev
          type: string
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - email
        - full_name
        - resource_id
        - user_id
        - access_level
      type: object
    ResourceAccessUser:
      description: |-
        # Resource Access User Object
        ### Description
        The `ResourceAccessUser` object is used to represent a user with access to a resource, either directly or indirectly through group(s).

        ### Usage Example
        Fetch from the `LIST ResourceUsers` endpoint.
      example:
        full_name: Jake Barnes
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        email: jake@company.dev
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        resource_name:
          description: The name of the resource.
          example: AdministratorAccess
          type: string
        description:
          description: The description of the resource.
          example: Full access to all resources and settings.
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        email:
          description: The user's email.
          example: jake@company.dev
          type: string
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        has_direct_access:
          description:
            The user has direct access to this resources (vs. indirectly, like
            through a group).
          example: true
          type: boolean
        num_access_paths:
          description:
            The number of ways in which the user has access through this
            resource (directly and indirectly).
          example: 3
          format: int32
          type: integer
        propagation_status:
          $ref: "#/components/schemas/PropagationStatus"
      required:
        - email
        - full_name
        - resource_id
        - user_id
        - access_level
        - has_direct_access
        - num_access_paths
      type: object
    AccessList:
      example:
        results:
          - principal_id: 74908af0-9383-4feb-b7ea-8b305d737338
            principal_type: RESOURCE
            entity_id: db04925a-635d-4764-870e-500b9b035c8e
            entity_type: RESOURCE
            expiration_date: 2022-01-23T04:56:07Z
            has_direct_access: true
            num_access_paths: 3
          - principal_id: d940df34-726a-4403-864e-16cb2a0d6793
            principal_type: RESOURCE
            entity_id: c26cd16c-a3fa-4b82-96b1-32177f8b8f59
            entity_type: RESOURCE
            expiration_date: 2022-01-23T04:56:07Z
            has_direct_access: true
            num_access_paths: 3
      properties:
        results:
          items:
            $ref: "#/components/schemas/Access"
          type: array
      type: object
    Access:
      description: |-
        # Access Object
        ### Description
        The `Access` object is used to represent a principal's access to an entity, either directly or inherited.

        ### Usage Example
        Fetch from the `LIST ResourceNonHumanIdentities` endpoint.
      example:
        principal_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        principal_type: RESOURCE
        entity_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        entity_type: RESOURCE
        expiration_date: 2022-01-23T04:56:07Z
        has_direct_access: true
        num_access_paths: 3
      properties:
        principal_id:
          description: The ID of the principal with access.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        principal_type:
          $ref: "#/components/schemas/EntityTypeEnum"
        entity_id:
          description: The ID of the entity being accessed.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        entity_type:
          $ref: "#/components/schemas/EntityTypeEnum"
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        expiration_date:
          description: The day and time the principal's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        has_direct_access:
          description:
            The principal has direct access to this entity (vs. inherited
            access).
          example: true
          type: boolean
        num_access_paths:
          description:
            The number of ways in which the principal has access to this entity
            (directly and inherited).
          example: 3
          format: int32
          type: integer
      required:
        - principal_id
        - principal_type
        - entity_id
        - entity_type
        - has_direct_access
        - num_access_paths
      type: object
    ResourceNHI:
      description: |-
        # Resource Non-Human Identity Direct Access Object
        ### Description
        This object is used to represent a non-human identity with direct access to a resource.
      example:
        non_human_identity_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
      properties:
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        non_human_identity_id:
          description: The resource ID of the non-human identity.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        expiration_date:
          description: The day and time the non-human identity's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - resource_id
        - non_human_identity_id
      type: object
    SessionsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - connection_id: h0z968412-2451-4bbd-42h4-057l715d917m
            user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-01-23T04:56:07Z
          - connection_id: 6e6b5597-bd36-4f4c-a629-01e3fa791932
            user_id: b031c922-b84f-4424-9f4f-c49c05871bfe
            resource_id: 77eb1ab7-2c27-4fc4-afdb-137e1265cddd
            expiration_date: 2022-03-12T07:22:18Z
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Session"
          type: array
      type: object
    Paladin:
      description: |-
        # Paladin Object
        ### Description
        The `Paladin` object represents a Paladin, Opal's AI access-request
        reviewer.
      example:
        paladin_id: 32acc112-21ff-4669-91c2-21e27683eaa1
        name: paladin-agent-1
        owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        monitor_mode: true
        admin_view_only: false
        enabled_connectors:
          - SLACK
      properties:
        paladin_id:
          description:
            The ID of the Paladin. Use this value as a reviewer in a request
            configuration's service_user_ids.
          example: 32acc112-21ff-4669-91c2-21e27683eaa1
          format: uuid
          type: string
        name:
          description: The name of the Paladin.
          example: paladin-agent-1
          type: string
        owner_id:
          description: The ID of the owner of the Paladin.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        monitor_mode:
          description:
            When true, the Paladin reasons about requests but takes no action.
            Shown as "Monitor mode" in the UI.
          type: boolean
        admin_view_only:
          description:
            When true, the Paladin's recommendations are visible only to admins.
            Only meaningful when monitor_mode is true.
          type: boolean
        enabled_connectors:
          description: The connectors the Paladin is allowed to use.
          type: array
          items:
            $ref: "#/components/schemas/PaladinConnector"
        instructions:
          description:
            The free-form instructions that guide the Paladin's decisions.
          example: Approve read-only access; escalate anything that grants write access.
          type: string
      required:
        - paladin_id
        - name
        - owner_id
        - monitor_mode
        - admin_view_only
        - enabled_connectors
        - instructions
      type: object
    PaladinList:
      description: |-
        # PaladinList Object
        ### Description
        A list of `Paladin` objects.
      properties:
        results:
          items:
            $ref: "#/components/schemas/Paladin"
          type: array
      required:
        - results
      type: object
    PaladinConnector:
      description: A connector a Paladin is allowed to use.
      enum:
        - NOTION
        - JIRA
        - LINEAR
        - SERVICE_NOW
        - NOTION_TICKETS
        - FRESH_SERVICE
        - SHORTCUT
        - SLACK
        - PAGER_DUTY
        - CONFLUENCE
        - FLEET_DM
      type: string
    PaladinContextSourceKind:
      description:
        The kind of source a Paladin can read. A SLACK_CHANNEL is a Slack
        channel; a DOCUMENT is a Notion or Confluence page.
      enum:
        - SLACK_CHANNEL
        - DOCUMENT
      type: string
    PaladinContextSourceProvider:
      description: The integration a Paladin context source comes from.
      enum:
        - SLACK
        - NOTION
        - CONFLUENCE
      type: string
    PaladinContextSource:
      description: |-
        # PaladinContextSource Object
        ### Description
        A context source (a Slack channel or a document) that a Paladin is
        configured to read during access-request review.
      example:
        id: 8a1f2c3d-4b5e-6f70-8192-a3b4c5d6e7f8
        paladin_id: 32acc112-21ff-4669-91c2-21e27683eaa1
        source_kind: SLACK_CHANNEL
        third_party_provider: SLACK
        remote_id: C0123456789
        name: "#access-requests"
        url: https://example.slack.com/archives/C0123456789
      properties:
        id:
          description: The ID of the context source.
          format: uuid
          type: string
        paladin_id:
          description: The ID of the Paladin this source belongs to.
          format: uuid
          type: string
        source_kind:
          $ref: "#/components/schemas/PaladinContextSourceKind"
        third_party_provider:
          $ref: "#/components/schemas/PaladinContextSourceProvider"
        remote_id:
          description:
            The provider's identifier for the source. The Slack channel ID for
            a channel, or the Notion/Confluence page ID for a document.
          type: string
        name:
          description: A human-readable name for the source.
          type: string
        url:
          description: A link to the source.
          type: string
      required:
        - id
        - paladin_id
        - source_kind
        - third_party_provider
        - remote_id
        - name
        - url
      type: object
    PaladinContextSourceList:
      description: |-
        # PaladinContextSourceList Object
        ### Description
        A list of `PaladinContextSource` objects.
      properties:
        results:
          items:
            $ref: "#/components/schemas/PaladinContextSource"
          type: array
      required:
        - results
      type: object
    CreatePaladinContextSourceInfo:
      description: Information for adding a context source to a Paladin.
      example:
        source_kind: SLACK_CHANNEL
        third_party_provider: SLACK
        remote_id: C0123456789
        name: "#access-requests"
      properties:
        source_kind:
          $ref: "#/components/schemas/PaladinContextSourceKind"
        third_party_provider:
          $ref: "#/components/schemas/PaladinContextSourceProvider"
        remote_id:
          description:
            The provider's identifier for the source. The Slack channel ID for
            a channel, or the Notion/Confluence page ID for a document.
          type: string
        name:
          description: An optional human-readable name for the source.
          type: string
        url:
          description: An optional link to the source.
          type: string
      required:
        - source_kind
        - third_party_provider
        - remote_id
      type: object
    CreatePaladinInfo:
      description: Information for creating a Paladin.
      example:
        name: paladin-agent-1
        owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
      properties:
        name:
          description: The name of the Paladin.
          example: paladin-agent-1
          type: string
        owner_id:
          description: The ID of the owner of the Paladin.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        monitor_mode:
          description:
            When true, the Paladin reasons about requests but takes no action.
            Defaults to true.
          type: boolean
          default: true
        admin_view_only:
          description:
            When true, recommendations are visible only to admins. Only
            meaningful when monitor_mode is true. Defaults to false.
          type: boolean
          default: false
        enabled_connectors:
          description: The connectors the Paladin is allowed to use.
          type: array
          items:
            $ref: "#/components/schemas/PaladinConnector"
        instructions:
          description:
            The free-form instructions that guide the Paladin's decisions.
            Optional; if omitted the Paladin is created without instructions.
          type: string
      required:
        - name
        - owner_id
      type: object
    UpdatePaladinInfo:
      description: Information for updating a Paladin.
      example:
        name: paladin-agent-1
      properties:
        name:
          description: The name of the Paladin.
          example: paladin-agent-1
          type: string
        monitor_mode:
          description:
            When true, the Paladin reasons about requests but takes no action.
            If omitted, the existing value is preserved.
          type: boolean
        admin_view_only:
          description:
            When true, recommendations are visible only to admins. Only
            meaningful when monitor_mode is true. If omitted, the existing value
            is preserved.
          type: boolean
        enabled_connectors:
          description:
            The connectors the Paladin is allowed to use. If omitted, the
            existing connectors are preserved.
          type: array
          items:
            $ref: "#/components/schemas/PaladinConnector"
        instructions:
          description:
            The free-form instructions that guide the Paladin's decisions. If
            omitted, the existing instructions are preserved.
          type: string
      required:
        - name
      type: object
    Session:
      description: |-
        # Session Object
        ### Description
        The `Session` object is used to represent an access session. Some resources can be accessed temporarily via a time-bounded session.

        ### Usage Example
        Fetch from the `LIST Sessions` endpoint.
      example:
        connection_id: h0z968412-2451-4bbd-42h4-057l715d917m
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        resource_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
      properties:
        connection_id:
          description: The ID of the connection.
          example: h0z968412-2451-4bbd-42h4-057l715d917m
          format: uuid
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        resource_id:
          description: The ID of the resource.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: false
          type: string
      required:
        - connection_id
        - user_id
        - resource_id
        - access_level
        - expiration_date
      type: object
    PaginatedUsersList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            email: john.doe@company.dev
            full_name: John Doe
            position: Senior Engineer
          - user_id: e8581682-04f7-473a-a419-472f0fb26d46
            email: jane.smith@company.dev
            full_name: Jane Smith
            position: Product Marketing Lead
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/User"
          type: array
      type: object
      required:
        - results
    PaginatedRemoteUsersList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            remote_id: 1234567890
            third_party_provider: GIT_LAB
          - user_id: 29827fb8-f2dd-4e80-9576-238979927392
            remote_id: remoteid123
            third_party_provider: GIT_HUB
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/RemoteUser"
          type: array
      type: object
      required:
        - results
    RemoteUser:
      description: |-
        # RemoteUser Object
        ### Description
        The `RemoteUser` object is used to represent a remote user.
      example:
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        remote_id: 1234567890
        third_party_provider: GIT_HUB
      properties:
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        remote_id:
          description: The ID of the remote user.
          example: 1234567890
          type: string
        third_party_provider:
          description: The third party provider of the remote user.
          example: GIT_HUB
          $ref: "#/components/schemas/ThirdPartyProviderEnum"
      required:
        - user_id
        - remote_id
        - third_party_provider
      type: object

    User:
      description: |-
        # User Object
        ### Description
        The `User` object is used to represent a user.

        ### Usage Example
        Fetch from the `LIST Sessions` endpoint.
      example:
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        email: john.doe@company.dev
        full_name: John Doe
        first_name: John
        last_name: Doe
        position: Engineer
      properties:
        user_id:
          description: The ID of the user.
          example: h0z968412-2451-4bbd-42h4-057l715d917m
          format: uuid
          type: string
        email:
          description: The email of the user.
          example: john.doe@company.dev
          type: string
        full_name:
          description: The full name of the user.
          example: John Doe
          type: string
        first_name:
          description: The first name of the user.
          example: John
          type: string
        last_name:
          description: The last name of the user.
          example: Doe
          type: string
        position:
          description: The user's position.
          example: Senior Engineer
          type: string
        hr_idp_status:
          $ref: "#/components/schemas/UserHrIdpStatusEnum"
      required:
        - user_id
        - email
        - full_name
        - first_name
        - last_name
        - position
      type: object
    UserList:
      description: A list of users.
      properties:
        users:
          items:
            $ref: "#/components/schemas/User"
          type: array
      type: object
      required:
        - users
    UserIDList:
      description: A list of user IDs.
      example:
        user_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        user_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - user_ids
    UserHrIdpStatusEnum:
      description: User status pulled from an HR/IDP provider.
      enum:
        - ACTIVE
        - SUSPENDED
        - DEPROVISIONED
        - DELETED
        - NOT_FOUND
      example: ACTIVE
      type: string
    ThirdPartyProviderEnum:
      description: The third party provider of the remote user.
      enum:
        - AUTH0
        - SLACK
        - GOOGLE_CHAT
        - JIRA
        - LINEAR
        - SERVICE_NOW
        - FRESH_SERVICE
        - SHORTCUT
        - PAGER_DUTY
        - OPSGENIE
        - GIT_HUB
        - GIT_LAB
        - GIT_LAB_CONNECTION
        - TELEPORT
      example: GIT_HUB
      type: string
    PaginatedGroupsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
            name: Payments Production Admin
            description:
              This group represents Active Directory group "Payments Production
              Admin". We use this AD group to facilitate staging deployments and
              qualifying new releases.
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            group_leader_user_ids:
              - 7c86c85d-0651-43e2-a748-d69d658418e8
            remote_id: 037m2jsg218b2wb
            remote_name: Finance Team
            group_type: ACTIVE_DIRECTORY_GROUP
            max_duration: 120
            recommended_duration: 60
            extensions_duration_in_minutes: 60
            require_manager_approval: False
            require_support_ticket: False
            require_mfa_to_approve: False
            require_mfa_to_request: False
            auto_approval: False
            is_requestable: True
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            app_id: a7c3e291-1234-4abc-9def-1234567890ab
            name: Integrations On-Call
            description:
              Manages the Integrations Team on-call privileged resources. This
              group is automatically synced with the on-call rotation defined in
              PagerDuty.
            admin_owner_id: 4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3
            group_leader_user_ids: []
            remote_id: pagerduty-schedule:P123XYZ
            remote_name: Integrations On-Call
            group_type: PAGERDUTY_ON_CALL_SCHEDULE
            max_duration: 360
            recommended_duration: 120
            extensions_duration_in_minutes: 0
            require_manager_approval: False
            require_support_ticket: True
            require_mfa_to_approve: False
            require_mfa_to_request: False
            auto_approval: False
            is_requestable: True
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Group"
          type: array
      type: object
      required:
        - results
    GroupResource:
      description: |-
        # GroupResource Object
        ### Description
        The `GroupResource` object is used to represent a relationship between a group and a resource.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        resource_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        access_level_remote_id: "write"
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a87-bdbb-df212eca5353
          format: uuid
          type: string
        resource_id:
          description: The ID of the resource.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        group_name:
          description: The name of the group
          example: API Group
          type: string
        resource_name:
          description: The name of the resource
          example: API Group
          type: string
        expiration_date:
          description: The day and time the group's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        access_level:
          $ref: "#/components/schemas/ResourceAccessLevel"
      required:
        - group_id
        - resource_id
        - access_level
      type: object
    GroupContainingGroup:
      description: |-
        # GroupContainingGroup Object
        ### Description
        The `GroupContainingGroup` object is used to represent a relationship between a group and a group.
      example:
        containing_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        containing_group_id:
          description: The groupID of the containing group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        duration_minutes:
          description:
            The updated duration for which the group can be accessed (in
            minutes). Use 0 for indefinite.
          type: integer
          maximum: 525960 # One year
          example: 120
        access_level_remote_id:
          description: The updated remote ID of the access level granted to this group.
          type: string
          example: arn:aws:iam::590304332660:role/ReadOnlyAccess
      required:
        - containing_group_id
      type: object
    Group:
      description: |-
        # Group Object
        ### Description
        The `Group` object is used to represent a group.

        ### Usage Example
        Update from the `UPDATE Groups` endpoint.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        name: Payments Production Admin
        description:
          This group represents Active Directory group "Payments Production
          Admin". We use this AD group to facilitate staging deployments and
          qualifying new releases.
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        group_leader_user_ids:
          - 7c86c85d-0651-43e2-a748-d69d658418e8
        remote_id: 037m2jsg218b2wb
        remote_name: Finance Team
        group_type: ACTIVE_DIRECTORY_GROUP
        max_duration: 120
        recommended_duration: 60
        extensions_duration_in_minutes: 60
        require_manager_approval: False
        require_support_ticket: False
        require_mfa_to_approve: False
        require_mfa_to_request: False
        auto_approval: False
        is_requestable: True
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        app_id:
          description: The ID of the group's app.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        name:
          description: The name of the group.
          example: API Group
          type: string
        description:
          description: A description of the group.
          example:
            This group represents Active Directory group "Payments Production
            Admin". We use this AD group to facilitate staging deployments and
            qualifying new releases.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        group_leader_user_ids:
          description: A list of User IDs for the group leaders of the group
          items:
            type: string
            format: uuid
          type: array
        remote_id:
          description: The ID of the remote.
          example: google-group-group:037m2jsg218b2wb
          type: string
        remote_name:
          description: The name of the remote.
          example: Finance team
          type: string
        group_type:
          $ref: "#/components/schemas/GroupTypeEnum"
        max_duration:
          description:
            The maximum duration for which the group can be requested (in
            minutes).
          type: integer
          example: 120
        recommended_duration:
          description:
            The recommended duration for which the group should be requested
            (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        extensions_duration_in_minutes:
          description:
            The duration for which access can be extended (in minutes). Set to
            0 to disable extensions. When > 0, extensions are enabled for the
            specified duration.
          type: integer
          example: 120
        require_manager_approval:
          description:
            A bool representing whether or not access requests to the group
            require manager approval.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description:
            A bool representing whether or not access requests to the group
            require an access ticket.
          example: False
          type: boolean
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this group.
          example: False
          type: boolean
        require_mfa_to_request:
          description:
            A bool representing whether or not to require MFA for requesting
            access to this group.
          example: False
          type: boolean
        auto_approval:
          description:
            A bool representing whether or not to automatically approve
            requests to this group.
          example: False
          type: boolean
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        group_binding_id:
          description: The ID of the associated group binding.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        is_requestable:
          description:
            A bool representing whether or not to allow access requests to this
            group.
          example: False
          type: boolean
        request_configurations:
          description: A list of request configurations for this group.
          example: []
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
        request_configuration_list:
          description:
            A list of request configurations for this group. Deprecated in
            favor of `request_configurations`.
          deprecated: true
          example: []
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
        metadata:
          description:
            JSON metadata about the remote group. Only set for items linked to
            remote systems. See [this
            guide](https://docs.opal.dev/reference/end-system-objects) for
            details.
          deprecated: true
          example: |-
            { "okta_directory_group": { "group_id": "00g4bs66kwtpe1g12345" } }
          type: string
        remote_info:
          $ref: "#/components/schemas/GroupRemoteInfo"
        custom_request_notification:
          description:
            Custom request notification sent to the requester when the request
            is approved.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity:
          description:
            The risk sensitivity level for the group. When an override is set,
            this field will match that.
          readOnly: true
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        match_remote_name:
          description:
            A bool representing whether or not the group's name is synced from
            the end system. When true, the name is overwritten with the remote
            name on each sync. Defaults to false.
          example: False
          type: boolean
        match_remote_description:
          description:
            A bool representing whether or not the group's description is
            synced from the end system. When true, the description is
            overwritten with the remote description on each sync. Defaults to
            false.
          example: False
          type: boolean
        last_successful_sync:
          readOnly: true
          description: Information about the last successful sync of this group.
          $ref: "#/components/schemas/SyncTask"
      required:
        - group_id
      type: object
    GroupUserList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - full_name: Jake Barnes
            user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
            group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-01-23T04:56:07Z
            email: jake@company.dev
          - full_name: Brett Ashley
            user_id: 7646aa9a-e2ee-4eb5-8c62-91f29038a373
            group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
            expiration_date: 2022-02-03T12:33:02Z
            email: brett@company.dev
      properties:
        results:
          items:
            $ref: "#/components/schemas/GroupUser"
          type: array
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
      type: object
    GroupAccessLevel:
      description: |-
        # Access Level Object
        ### Description
        The `GroupAccessLevel` object is used to represent the level of access that a user has to a group or a group has to a group. The "default" access
        level is a `GroupAccessLevel` object whose fields are all empty strings.

        ### Usage Example
        View the `GroupAccessLevel` of a group/user or group/group pair to see the level of access granted to the group.
      example:
        access_level_name: Developer
        access_level_remote_id: 20
      properties:
        access_level_name:
          description: The human-readable name of the access level.
          example: Developer
          type: string
        access_level_remote_id:
          description: The machine-readable identifier of the access level.
          example: 20
          type: string
      required:
        - access_level_name
        - access_level_remote_id
      type: object
    GroupAccessLevelList:
      description: A list of access levels defined for a group.
      example:
        results:
          - access_level_name: Developer
            access_level_remote_id: "30"
          - access_level_name: Maintainer
            access_level_remote_id: "40"
      properties:
        results:
          items:
            $ref: "#/components/schemas/GroupAccessLevel"
          type: array
      type: object
    GroupUser:
      description: |-
        # Group Access User Object
        ### Description
        The `GroupAccessUser` object is used to represent a user with access to a group.

        ### Usage Example
        Fetch from the `LIST GroupUsers` endpoint.
      example:
        full_name: Jake Barnes
        user_id: 29827fb8-f2dd-4e80-9576-28e31e9934ac
        group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        expiration_date: 2022-01-23T04:56:07Z
        email: jake@company.dev
      properties:
        group_id:
          description: The ID of the group.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
        group_name:
          description: The name of the group.
          example: API Group
          type: string
        description:
          description: The description of the group.
          example: Group required to request API's
          type: string
        user_id:
          description: The ID of the user.
          example: 29827fb8-f2dd-4e80-9576-28e31e9934ac
          format: uuid
          type: string
        access_level:
          $ref: "#/components/schemas/GroupAccessLevel"
          nullable: true
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        email:
          description: The user's email.
          example: jake@company.dev
          type: string
        expiration_date:
          description: The day and time the user's access will expire.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        propagation_status:
          $ref: "#/components/schemas/PropagationStatus"
      required:
        - email
        - full_name
        - group_id
        - user_id
        - group_name
        - description
      type: object
    PropagationStatus:
      description:
        The state of whether the push action was propagated to the remote
        system. If this is null, the access was synced from the remote system.
      properties:
        status:
          $ref: "#/components/schemas/PropagationStatusEnum"
      required:
        - status
    PropagationStatusEnum:
      description:
        The status of whether the user has been synced to the group or
        resource in the remote system.
      enum:
        - SUCCESS
        - ERR_REMOTE_INTERNAL_ERROR
        - ERR_REMOTE_USER_NOT_FOUND
        - ERR_REMOTE_USER_NOT_LINKED
        - ERR_REMOTE_RESOURCE_NOT_FOUND
        - ERR_REMOTE_THROTTLE
        - ERR_NOT_AUTHORIZED_TO_QUERY_RESOURCE
        - ERR_REMOTE_PROVISIONING_VIA_IDP_FAILED
        - ERR_IDP_EMAIL_UPDATE_CONFLICT
        - ERR_TIMEOUT
        - ERR_UNKNOWN
        - ERR_OPAL_INTERNAL_ERROR
        - ERR_ORG_READ_ONLY
        - ERR_OPERATION_UNSUPPORTED
        - PENDING
        - PENDING_MANUAL_PROPAGATION
        - PENDING_TICKET_CREATION
        - ERR_TICKET_CREATION_SKIPPED
        - ERR_DRY_RUN_MODE_ENABLED
        - ERR_HR_IDP_PROVIDER_NOT_LINKED
        - ERR_REMOTE_UNRECOVERABLE_ERROR
        - ERR_REMOTE_TICKET_NOT_FOUND
      example:
        - SUCCESS
      type: string
    UpdateGroupInfoList:
      example:
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            description:
              This group represents Active Directory group "Payments Production
              Admin". We use this AD group to facilitate staging deployments and
              qualifying new releases.
            name: api-group
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            description:
              Manages the Integrations Team on-call privileged resources. This
              group is automatically synced with the on-call rotation defined in
              PagerDuty.
            name: on-call-integrations
            admin_owner_id: 4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        groups:
          description: A list of groups with information to update.
          items:
            $ref: "#/components/schemas/UpdateGroupInfo"
          type: array
      type: object
      required:
        - groups
    UpdateGroupInfo:
      description: |-
        # UpdateGroupInfo Object
        ### Description
        The `UpdateGroupInfo` object is used as an input to the UpdateGroup API.
      example:
        group_id: f454d283-ca87-4a87-bdbb-df212eca5353
        description:
          This group represents Active Directory group "Payments Production
          Admin". We use this AD group to facilitate staging deployments and
          qualifying new releases.
        name: api-group
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a87-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the group.
          example: api-group
          type: string
        description:
          description: A description of the group.
          example:
            This group represents Active Directory group "Payments Production
            Admin". We use this AD group to facilitate staging deployments and
            qualifying new releases.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        max_duration:
          description:
            The maximum duration for which the group can be requested (in
            minutes). Use -1 to set to indefinite. Deprecated in favor of
            `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        recommended_duration:
          description:
            The recommended duration for which the group should be requested
            (in minutes). Will be the default value in a request. Use -1 to set
            to indefinite and 0 to unset. Deprecated in favor of
            `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        require_manager_approval:
          description:
            A bool representing whether or not access requests to the group
            require manager approval. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description:
            A bool representing whether or not access requests to the group
            require an access ticket. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        folder_id:
          description: The ID of the folder that the group is located in.
          example: e27cb7b0-98e2-4555-9916-9e6d8ca6b079
          format: uuid
          type: string
          deprecated: true
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this group.
          example: False
          type: boolean
        require_mfa_to_request:
          description:
            A bool representing whether or not to require MFA for requesting
            access to this group. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        auto_approval:
          description:
            A bool representing whether or not to automatically approve
            requests to this group. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_template_id:
          description:
            The ID of the associated request template. Deprecated in favor of
            `request_configurations`.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
          deprecated: true
        is_requestable:
          description:
            A bool representing whether or not to allow access requests to this
            group. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        group_leader_user_ids:
          description: A list of User IDs for the group leaders of the group
          items:
            type: string
            format: uuid
          type: array
        extensions_duration_in_minutes:
          description:
            The duration for which access can be extended (in minutes).
            Deprecated, set the extension duration in the request_configuration
            you want it to apply to.
          type: integer
          example: 120
          deprecated: true
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description:
            The request configuration list of the configuration template. If
            not provided, the default request configuration will be used.
        request_configuration_list:
          description:
            The request configuration list of the configuration template. If
            not provided, the default request configuration will be used.
            Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
        custom_request_notification:
          description:
            Custom request notification sent to the requester when the request
            is approved.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        match_remote_name:
          description:
            A bool representing whether or not the group's name should be
            synced from the end system. When true, the name is overwritten
            with the remote name on each sync, so a `name` provided together
            with this field set to true will be replaced at the next sync. If
            not provided, the current value is left unchanged.
          example: False
          type: boolean
        match_remote_description:
          description:
            A bool representing whether or not the group's description should
            be synced from the end system. When true, the description is
            overwritten with the remote description on each sync, so a
            `description` provided together with this field set to true will
            be replaced at the next sync. If not provided, the current value
            is left unchanged.
          example: False
          type: boolean
      required:
        - group_id
      type: object
    GroupTypeEnum:
      description: The type of the group.
      enum:
        - ACTIVE_DIRECTORY_GROUP
        - AWS_SSO_GROUP
        - DATABRICKS_ACCOUNT_GROUP
        - DUO_GROUP
        - GIT_HUB_TEAM
        - GIT_LAB_GROUP
        - GOOGLE_GROUPS_GROUP
        - GOOGLE_GROUPS_GKE_GROUP
        - LDAP_GROUP
        - OKTA_GROUP
        - OKTA_GROUP_RULE
        - TAILSCALE_GROUP
        - OPAL_GROUP
        - OPAL_ACCESS_RULE
        - AZURE_AD_SECURITY_GROUP
        - AZURE_AD_MICROSOFT_365_GROUP
        - CONNECTOR_GROUP
        - SNOWFLAKE_ROLE
        - WORKDAY_USER_SECURITY_GROUP
        - PAGERDUTY_ON_CALL_SCHEDULE
        - INCIDENTIO_ON_CALL_SCHEDULE
        - ROOTLY_ON_CALL_SCHEDULE
        - DEVIN_GROUP
        - GIT_HUB_ENTERPRISE_TEAM
        - GRAFANA_TEAM
        - CLICKHOUSE_ROLE
        - SLACK_USER_GROUP
        - TWINGATE_GROUP
        - TWINGATE_GROUP_SYNCED
        - ZENDESK_GROUP
        - ZENDESK_ORGANIZATION
        - HUBSPOT_TEAM
        - TABLEAU_GROUP
        - CONFLUENCE_GROUP
        - JIRA_GROUP
        - DOCUSIGN_GROUP
        - ZOOM_GROUP
      example: OPAL_GROUP
      type: string
    ResourceTypeEnum:
      description: The type of the resource.
      enum:
        - AWS_IAM_ROLE
        - AWS_EC2_INSTANCE
        - AWS_EKS_CLUSTER
        - AWS_RDS_POSTGRES_CLUSTER
        - AWS_RDS_POSTGRES_INSTANCE
        - AWS_RDS_MYSQL_CLUSTER
        - AWS_RDS_MYSQL_INSTANCE
        - AWS_ACCOUNT
        - AWS_SSO_PERMISSION_SET
        - AWS_ORGANIZATIONAL_UNIT
        - AZURE_MANAGEMENT_GROUP
        - AZURE_RESOURCE_GROUP
        - AZURE_SUBSCRIPTION
        - AZURE_VIRTUAL_MACHINE
        - AZURE_STORAGE_ACCOUNT
        - AZURE_STORAGE_CONTAINER
        - AZURE_SQL_SERVER
        - AZURE_SQL_MANAGED_INSTANCE
        - AZURE_SQL_DATABASE
        - AZURE_SQL_MANAGED_DATABASE
        - AZURE_USER_ASSIGNED_MANAGED_Identity
        - AZURE_ENTRA_ID_ROLE
        - AZURE_ENTERPRISE_APP
        - CUSTOM
        - CUSTOM_CONNECTOR
        - DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL
        - GCP_ORGANIZATION
        - GCP_BUCKET
        - GCP_COMPUTE_INSTANCE
        - GCP_FOLDER
        - GCP_GKE_CLUSTER
        - GCP_PROJECT
        - GCP_CLOUD_SQL_POSTGRES_INSTANCE
        - GCP_CLOUD_SQL_MYSQL_INSTANCE
        - GCP_BIG_QUERY_DATASET
        - GCP_BIG_QUERY_TABLE
        - GCP_SERVICE_ACCOUNT
        - GCP_BILLING_ACCOUNT
        - GIT_HUB_REPO
        - GIT_HUB_ORG_ROLE
        - GIT_LAB_PROJECT
        - GOOGLE_WORKSPACE_ROLE
        - MONGO_INSTANCE
        - MONGO_ATLAS_INSTANCE
        - NETSUITE_ROLE
        - DATADOG_ROLE
        - OKTA_APP
        - OKTA_ROLE
        - OPAL_ROLE
        - OPAL_SCOPED_ROLE
        - PAGERDUTY_ROLE
        - TAILSCALE_SSH
        - SALESFORCE_PERMISSION_SET
        - SALESFORCE_PROFILE
        - SALESFORCE_ROLE
        - SNOWFLAKE_DATABASE
        - SNOWFLAKE_SCHEMA
        - SNOWFLAKE_TABLE
        - WORKDAY_ROLE
        - MYSQL_INSTANCE
        - MARIADB_INSTANCE
        - POSTGRES_INSTANCE
        - TELEPORT_ROLE
        - ILEVEL_ADVANCED_ROLE
        - DATASTAX_ASTRA_ROLE
        - COUPA_ROLE
        - CURSOR_ORGANIZATION
        - OPENAI_PLATFORM_PROJECT
        - OPENAI_PLATFORM_SERVICE_ACCOUNT
        - ANTHROPIC_WORKSPACE
        - GIT_HUB_ORG
        - ORACLE_FUSION_ROLE
        - DEVIN_ORGANIZATION
        - DEVIN_ROLE
        - VAULT_SECRET
        - VAULT_POLICY
        - VAULT_OIDC_ROLE
        - GIT_HUB_ENTERPRISE_ROLE
        - GRAFANA_FOLDER
        - GRAFANA_DASHBOARD
        - GRAFANA_BASIC_ROLE
        - GRAFANA_ROLE
        - CLICKHOUSE_DATABASE
        - CLICKHOUSE_TABLE
        - TWINGATE_RESOURCE
        - ZENDESK_ROLE
        - HUBSPOT_ROLE
        - ALICLOUD_RAM_ROLE
        - ALICLOUD_ECS_INSTANCE
        - DOCUSIGN_PERMISSION_PROFILE
        - ZOOM_ROLE
        - ZOOM_LICENSE
      example: AWS_IAM_ROLE
      type: string
    EntityItemTypeEnum:
      description: Granular subtype of an entity.
      enum:
        - USER
        - SERVICE_USER
        - ACTIVE_DIRECTORY_GROUP
        - AWS_SSO_GROUP
        - DUO_GROUP
        - GIT_HUB_TEAM
        - GIT_LAB_GROUP
        - GOOGLE_GROUPS_GROUP
        - GOOGLE_GROUPS_GKE_GROUP
        - LDAP_GROUP
        - OKTA_GROUP
        - OKTA_GROUP_RULE
        - TAILSCALE_GROUP
        - TWINGATE_GROUP
        - TWINGATE_GROUP_SYNCED
        - OPAL_GROUP
        - OPAL_ACCESS_RULE
        - AZURE_AD_SECURITY_GROUP
        - AZURE_AD_MICROSOFT_365_GROUP
        - CONNECTOR_GROUP
        - SNOWFLAKE_ROLE
        - WORKDAY_USER_SECURITY_GROUP
        - DATABRICKS_ACCOUNT_GROUP
        - AWS_IAM_ROLE
        - AWS_EC2_INSTANCE
        - AWS_EKS_CLUSTER
        - AWS_RDS_POSTGRES_INSTANCE
        - AWS_RDS_POSTGRES_CLUSTER
        - AWS_RDS_MYSQL_INSTANCE
        - AWS_RDS_MYSQL_CLUSTER
        - AWS_ACCOUNT
        - AWS_SSO_PERMISSION_SET
        - AZURE_MANAGEMENT_GROUP
        - AZURE_RESOURCE_GROUP
        - AZURE_SUBSCRIPTION
        - AZURE_VIRTUAL_MACHINE
        - AZURE_STORAGE_ACCOUNT
        - AZURE_STORAGE_CONTAINER
        - AZURE_SQL_SERVER
        - AZURE_SQL_MANAGED_INSTANCE
        - AZURE_SQL_DATABASE
        - AZURE_SQL_MANAGED_DATABASE
        - AZURE_USER_ASSIGNED_MANAGED_Identity
        - AZURE_ENTRA_ID_ROLE
        - AZURE_ENTERPRISE_APP
        - CUSTOM
        - CUSTOM_CONNECTOR
        - GCP_ORGANIZATION
        - GCP_BUCKET
        - GCP_COMPUTE_INSTANCE
        - GCP_BIG_QUERY_DATASET
        - GCP_BIG_QUERY_TABLE
        - GCP_FOLDER
        - GCP_GKE_CLUSTER
        - GCP_PROJECT
        - GCP_CLOUD_SQL_POSTGRES_INSTANCE
        - GCP_CLOUD_SQL_MYSQL_INSTANCE
        - GCP_SERVICE_ACCOUNT
        - GCP_BILLING_ACCOUNT
        - GIT_HUB_REPO
        - GIT_HUB_ORG_ROLE
        - GIT_LAB_PROJECT
        - GOOGLE_WORKSPACE_ROLE
        - MONGO_INSTANCE
        - MONGO_ATLAS_INSTANCE
        - OKTA_APP
        - OKTA_ROLE
        - OPAL_ROLE
        - OPAL_SCOPED_ROLE
        - PAGERDUTY_ROLE
        - TAILSCALE_SSH
        - TWINGATE_RESOURCE
        - SALESFORCE_PERMISSION_SET
        - SALESFORCE_PROFILE
        - SALESFORCE_ROLE
        - SNOWFLAKE_DATABASE
        - SNOWFLAKE_SCHEMA
        - SNOWFLAKE_TABLE
        - WORKDAY_ROLE
        - MYSQL_INSTANCE
        - MARIADB_INSTANCE
        - POSTGRES_INSTANCE
        - TELEPORT_ROLE
        - DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL
        - ILEVEL_ADVANCED_ROLE
      example: OPAL_ROLE
      type: string
    VisibilityTypeEnum:
      description: The visibility level of the entity.
      enum:
        - GLOBAL
        - LIMITED
      example: GLOBAL
      type: string
    RolePermissionNameEnum:
      description: The name of the role permission.
      enum:
        - READ
        - READ_ASSIGNMENTS
        - CREATE
        - IMPORT
        - EXPORT
        - SYNC
        - DELETE
        - READ_SETTINGS
        - EDIT_TAGS
        - EDIT_SETTINGS
        - EDIT_SYNC_SETTINGS
        - EDIT_ASSIGNMENTS
        - EDIT_REQUEST_CONFIGURATIONS
        - EDIT_EVENT_STREAM
        - ASSIGN_UAR_REVIEWERS
        - SEND_REMINDERS
        - STOP
        - REQUEST_ON_BEHALF
        - RESET_MFA
      example: READ
      type: string
    RolePermissionTargetTypeEnum:
      description: The type of the target for the role permission.
      enum:
        - RESOURCE
        - CONNECTION
        - GROUP
        - BUNDLE
        - USER
        - ACCESS_REVIEW
        - OWNER
      example: RESOURCE
      type: string
    UpdateGroupResourcesInfo:
      example:
        group_resources:
          - resource_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
            access_level_remote_id: ""
          - resource_id: 6f99639b-7928-4043-8184-47cbc6766145
            access_level_remote_id: "write"
      properties:
        resources:
          items:
            $ref: "#/components/schemas/ResourceWithAccessLevel"
          type: array
      type: object
      required:
        - resources
    IdpGroupMapping:
      description: Information about a group mapping.
      example:
        app_resource_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
        group_id: 6f99639b-7928-4043-8184-47cbc6766145
        alias: "finance-team"
        hidden_from_end_user: False
      properties:
        app_resource_id:
          description: The ID of the app resource.
          example: 1520617d-e72a-47f5-a84c-693817ab48ad2
          format: uuid
          type: string
        group_id:
          description: The ID of the group.
          example: 6f99639b-7928-4043-8184-47cbc6766145
          format: uuid
          type: string
        alias:
          description: The alias of the group.
          example: finance-team
          type: string
        hidden_from_end_user:
          description:
            A bool representing whether or not the group is hidden from the end
            user.
          example: False
          type: boolean
      required:
        - group_id
        - hidden_from_end_user
      type: object
    IdpGroupMappingList:
      example:
        mappings:
          - group_id: 6f99639b-7928-4043-8184-47cbc6766145
            alias: "finance-team"
            hidden_from_end_user: False
          - group_id: 7870617d-e72a-47f5-a84c-693817ab4567
            alias: "engineering-team"
            hidden_from_end_user: False
      properties:
        mappings:
          items:
            $ref: "#/components/schemas/IdpGroupMapping"
          type: array
      type: object
      required:
        - mappings
    ResourceWithAccessLevel:
      description: Information about a resource and corresponding access level
      example:
        resource_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        access_level_remote_id: "write"
      properties:
        resource_id:
          description: The ID of the resource.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        access_level_remote_id:
          description: The ID of the resource.
          example: write
          type: string
      required:
        - resource_id
      type: object
    GroupWithAccessLevel:
      description: Information about a group and corresponding access level
      example:
        group_id: 7870617d-e72a-47f5-a84c-693817ab4567
        access_level_remote_id: "write"
      properties:
        group_id:
          description: The ID of the group.
          example: 7870617d-e72a-47f5-a84c-693817ab4567
          format: uuid
          type: string
        access_level_remote_id:
          description: The ID of the resource.
          example: write
          type: string
      required:
        - group_id
      type: object
    GroupResourceList:
      example:
        group_resources:
          - group_id: 7870617d-e72a-47f5-a84c-693817ab4567
            resource_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
            access_level_remote_id: ""
          - group_id: 50333e67-73ce-47ab-b049-d8abcd45f7a1
            resource_id: 6f99639b-7928-4043-8184-47cbc6766145
            access_level_remote_id: "write"
      properties:
        group_resources:
          items:
            $ref: "#/components/schemas/GroupResource"
          type: array
      type: object
      required:
        - group_resources
    GroupContainingGroupList:
      example:
        containing_groups:
          - containing_group_id: 7870617d-e72a-47f5-a84c-693817ab4567
          - containing_group_id: 50333e67-73ce-47ab-b049-d8abcd45f7a1
      properties:
        containing_groups:
          items:
            $ref: "#/components/schemas/GroupContainingGroup"
          type: array
      type: object
      required:
        - containing_groups
    MessageChannelList:
      example:
        channels:
          - message_channel_id: 7870617d-e72a-47f5-a84c-693817ab4567
            third_party_provider: SLACK
            remote_id: C03FJR97276
            name: api-team-audit-channel
            is_private: False
          - message_channel_id: 1520617d-e72a-47f5-a84c-693817ab48ad2
            third_party_provider: SLACK
            remote_id: A4FJR97365D
            name: api-team-monitor-channel
            is_private: False
      properties:
        channels:
          items:
            $ref: "#/components/schemas/MessageChannel"
          type: array
      type: object
      required:
        - channels
    OnCallScheduleList:
      example:
        on_call_schedules:
          - on_call_schedule_id: 50d5e9f6-f23f-4d5a-ae91-b2640cf3975e
            third_party_provider: PAGER_DUTY
            remote_id: P7OWH2R
            name: Customer Support On-Call
          - on_call_schedule_id: 4d61592c-ed61-4b13-8f22-2fac1c49f574
            third_party_provider: OPSGENIE
            remote_id: 72a8cb04-9e25-465d-a932-992f72077c61
            name: Opal Backend On-Call
      properties:
        on_call_schedules:
          items:
            $ref: "#/components/schemas/OnCallSchedule"
          type: array
      type: object
      required:
        - on_call_schedules
    VisibilityInfo:
      description: Visibility infomation of an entity.
      example:
        visibility: LIMITED
        visibility_group_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        visibility:
          $ref: "#/components/schemas/VisibilityTypeEnum"
        visibility_group_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - visibility
    MessageChannelIDList:
      description: A list of message channel IDs.
      example:
        message_channel_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        message_channel_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - message_channel_ids
    OnCallScheduleIDList:
      description:
        A list of on call schedule Opal UUIDs. To get the matching remote
        IDs, use the /on-call-schedules endpoints.
      example:
        on_call_schedule_ids:
          - 9546209c-42c2-4801-96d7-9ec42df0f59c
          - bb0197c0-5ea5-45d9-b3b7-b6c439be6435
      properties:
        on_call_schedule_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - on_call_schedule_ids
    ReviewerIDList:
      description: A list of reviewer IDs.
      example:
        reviewer_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
      properties:
        reviewer_ids:
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - reviewer_ids
    ReviewerStageList:
      properties:
        stages:
          description: A list of reviewer stages.
          items:
            $ref: "#/components/schemas/ReviewerStage"
          type: array
      type: object
      required:
        - stages
    ReviewerStage:
      description: A reviewer stage.
      example:
        owner_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4567
          - 1520617d-e72a-47f5-a84c-693817ab48ad2
        service_user_ids:
          - 7870617d-e72a-47f5-a84c-693817ab4568
      properties:
        require_manager_approval:
          description: Whether this reviewer stage should require manager approval.
          example: False
          type: boolean
        require_admin_approval:
          description: Whether this reviewer stage should require admin approval.
          example: False
          type: boolean
        operator:
          description:
            The operator of the reviewer stage. Admin and manager approval are
            also treated as reviewers.
          enum:
            - AND
            - OR
          example: AND
          type: string
        owner_ids:
          description: The IDs of owners assigned as reviewers for this stage.
          items:
            type: string
            format: uuid
          type: array
        service_user_ids:
          description: The IDs of service users assigned as reviewers for this stage.
          items:
            type: string
            format: uuid
          type: array
      type: object
      required:
        - operator
        - require_manager_approval
        - owner_ids
        - stage
    MessageChannel:
      description: |-
        # MessageChannel Object
        ### Description
        The `MessageChannel` object is used to represent a message channel.

        ### Usage Example
        Update a groups message channel from the `UPDATE Groups` endpoint.
      example:
        message_channel_id: 6670617d-e72a-47f5-a84c-693817ab4860
        third_party_provider: SLACK
        remote_id: C03FJR97276
        name: api-team-audit-channel
        is_private: False
      properties:
        message_channel_id:
          description: The ID of the message channel.
          example: 6670617d-e72a-47f5-a84c-693817ab4860
          format: uuid
          type: string
        third_party_provider:
          $ref: "#/components/schemas/MessageChannelProviderEnum"
        remote_id:
          description: The remote ID of the message channel
          example: C03FJR97276
          type: string
        name:
          description: The name of the message channel.
          example: api-team-audit-channel
          type: string
        is_private:
          description: A bool representing whether or not the message channel is private.
          example: False
          type: boolean
      type: object
      required:
        - message_channel_id
    CreateMessageChannelInfo:
      description: |-
        # CreateMessageChannelInfo Object
        ### Description
        The `CreateMessageChannelInfo` object is used to describe the message channel object to be created.
      example:
        third_party_provider: SLACK
        remote_id: C03FJR97276
      properties:
        third_party_provider:
          $ref: "#/components/schemas/MessageChannelProviderEnum"
        remote_id:
          description: The remote ID of the message channel
          example: C03FJR97276
          type: string
      type: object
      required:
        - third_party_provider
        - remote_id
    MessageChannelProviderEnum:
      description: The third party provider of the message channel.
      enum:
        - SLACK
      example: SLACK
      type: string
    OnCallSchedule:
      description: |-
        # OnCallSchedule Object
        ### Description
        The `OnCallSchedule` object is used to represent an on call schedule.

        ### Usage Example
        Update a groups on call schedule from the `UPDATE Groups` endpoint.
      example:
        on_call_schedule_id: 50d5e9f6-f23f-4d5a-ae91-b2640cf3975e
        third_party_provider: PAGER_DUTY
        remote_id: P7OWH2R
        name: Customer Support On-Call
      properties:
        on_call_schedule_id:
          description: The ID of the on-call schedule.
          example: 50d5e9f6-f23f-4d5a-ae91-b2640cf3975e
          format: uuid
          type: string
        third_party_provider:
          $ref: "#/components/schemas/OnCallScheduleProviderEnum"
        remote_id:
          description: The remote ID of the on call schedule
          example: P7OWH2R
          type: string
        name:
          description: The name of the on call schedule.
          example: Customer Support On-Call
          type: string
      type: object
      required:
        - message_channel_id
    CreateOnCallScheduleInfo:
      description: |-
        # CreateOnCallScheduleInfo Object
        ### Description
        The `CreateOnCallScheduleInfo` object is used to describe the on call schedule object to be created.
      example:
        third_party_provider: PAGER_DUTY
        remote_id: PNZNINN
      properties:
        third_party_provider:
          $ref: "#/components/schemas/OnCallScheduleProviderEnum"
        remote_id:
          description: The remote ID of the on call schedule
          example: PNZNINN
          type: string
      type: object
      required:
        - third_party_provider
        - remote_id
    OnCallScheduleProviderEnum:
      description: The third party provider of the on call schedule.
      enum:
        - OPSGENIE
        - PAGER_DUTY
      example: PAGER_DUTY
      type: string
    TicketingProviderEnum:
      description: The third party ticketing platform provider.
      enum:
        - JIRA
        - LINEAR
        - SERVICE_NOW
      example: LINEAR
      type: string
    RDSEngineEnum:
      type: string
      description: "The database engine for the RDS instance."
      enum: [MYSQL, POSTGRESQL]
    GroupRemoteInfo:
      description: Information that defines the remote group. This replaces the
        deprecated remote_id and metadata fields. If remote_info is provided, a
        group will be imported into Opal. For group types that support group
        creation through Opal, a new group will be created if remote_info is not
        provided.
      properties:
        active_directory_group:
          description: Remote info for Active Directory group.
          properties:
            group_id:
              description: The id of the Google group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        tailscale_group:
          description: Remote info for Tailscale group.
          properties:
            group_id:
              description: The id of the Tailscale group.
              example: 898931321
              type: string
          type: object
          required:
            - group_id
        twingate_group:
          description: Remote info for Twingate group.
          properties:
            group_id:
              description: The id of the Twingate group.
              example: R3JvdXA6MTIzNA==
              type: string
          type: object
          required:
            - group_id
        twingate_group_synced:
          description: Remote info for Twingate synced group.
          properties:
            group_id:
              description: The id of the Twingate synced group.
              example: R3JvdXA6MTIzNA==
              type: string
          type: object
          required:
            - group_id
        aws_sso_group:
          description: Remote info for AWS SSO group.
          properties:
            group_id:
              description: The id of the AWS SSO group.
              example: 898931321
              type: string
          type: object
          required:
            - group_id
        databricks_account_group:
          description: Remote info for Databricks account group.
          properties:
            group_id:
              description: The id of the Databricks account group.
              example: 898931321
              type: string
          type: object
          required:
            - group_id
        connector_group:
          description: Remote info for Connector group.
          properties:
            group_id:
              description: The id of the Connector group.
              example: 898931321
              type: string
          type: object
          required:
            - group_id
        github_team:
          description: Remote info for GitHub team.
          properties:
            team_id:
              deprecated: true
              description: The id of the GitHub team.
              example: 898931321
              type: string
            team_slug:
              description: The slug of the GitHub team.
              example: opal-security
              type: string
            org_name:
              description: GitHub team's org name, required only for Enterprise
              type: string
          type: object
          required:
            - team_slug
        github_enterprise_team:
          description: Remote info for GitHub Enterprise team.
          properties:
            team_slug:
              description: The slug of the GitHub Enterprise team.
              example: opal-security
              type: string
          type: object
          required:
            - team_slug
        gitlab_group:
          description: Remote info for Gitlab group.
          properties:
            group_id:
              description: The id of the Gitlab group.
              example: 898931321
              type: string
          type: object
          required:
            - group_id
        google_group:
          description: Remote info for Google group.
          properties:
            group_id:
              description: The id of the Google group.
              example: 1y6w882181n7sg
              type: string
          type: object
          required:
            - group_id
        ldap_group:
          description: Remote info for LDAP group.
          properties:
            group_id:
              description: The id of the LDAP group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        okta_group:
          description: Remote info for Okta Directory group.
          properties:
            group_id:
              description: The id of the Okta Directory group.
              example: 00gjs33pe8rtmRrp3rd6
              type: string
          type: object
          required:
            - group_id
        duo_group:
          description: Remote info for Duo Security group.
          properties:
            group_id:
              description: The id of the Duo Security group.
              example: DSRD8W89B9DNDBY4RHAC
              type: string
          type: object
          required:
            - group_id
        azure_ad_security_group:
          description: Remote info for Microsoft Entra ID Security group.
          properties:
            group_id:
              description: The id of the Microsoft Entra ID Security group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        azure_ad_microsoft_365_group:
          description: Remote info for Microsoft Entra ID Microsoft 365 group.
          properties:
            group_id:
              description: The id of the Microsoft Entra ID Microsoft 365 group.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - group_id
        snowflake_role:
          description: Remote info for Snowflake role.
          properties:
            role_id:
              description: The id of the Snowflake role.
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
          type: object
          required:
            - role_id
        okta_group_rule:
          description: Remote info for Okta Directory group rule.
          properties:
            rule_id:
              description: The id of the Okta group rule.
              example: 0pr3f7zMZZHPgUoWO0g4
              type: string
          type: object
          required:
            - rule_id
        workday_user_security_group:
          description: Remote info for Workday User Security group.
          properties:
            group_id:
              description: The id of the Workday User Security group.
              example: 123abc456def
              type: string
          type: object
          required:
            - group_id
        pagerduty_on_call_schedule:
          description: Remote info for PagerDuty on-call schedule group.
          properties:
            schedule_id:
              description: The id of the PagerDuty on-call schedule.
              example: PNZNINN
              type: string
          type: object
          required:
            - schedule_id
        incidentio_on_call_schedule:
          description: Remote info for Incident.io on-call schedule group.
          properties:
            schedule_id:
              description: The id of the Incident.io on-call schedule.
              example: 01HZ8XQM9ZQX8RKMZQ8ZQX8RK
              type: string
          type: object
          required:
            - schedule_id
        rootly_on_call_schedule:
          description: Remote info for Rootly on-call schedule group.
          properties:
            schedule_id:
              description: The id of the Rootly on-call schedule.
              example: 01HZ8XQM9ZQX8RKMZQ8ZQX8RK
              type: string
          type: object
          required:
            - schedule_id
        devin_group:
          description: Remote info for Devin group.
          properties:
            group_name:
              description: The name of the Devin group.
              example: devin-group-01
              type: string
          type: object
          required:
            - group_name
        clickhouse_role:
          description: Remote info for ClickHouse role.
          properties:
            role_id:
              description: The name of the ClickHouse role.
              example: my_clickhouse_role
              type: string
          type: object
          required:
            - role_id
        grafana_team:
          description: Remote info for Grafana team.
          properties:
            team_id:
              description: The ID of the team.
              example: 2323
              type: string
          type: object
          required:
            - team_id
        zendesk_group:
          description: Remote info for Zendesk group.
          properties:
            group_id:
              description: The ID of the Zendesk group.
              example: "12345"
              type: string
          type: object
          required:
            - group_id
        slack_user_group:
          description: Remote info for Slack user group.
          properties:
            group_id:
              description: The id of the Slack user group.
              example: S0614TZR7
              type: string
          type: object
          required:
            - group_id
        zendesk_organization:
          description: Remote info for Zendesk organization.
          properties:
            organization_id:
              description: The ID of the Zendesk organization.
              example: "67890"
              type: string
          type: object
          required:
            - organization_id
        hubspot_team:
          description: Remote info for HubSpot team.
          properties:
            team_id:
              description: The ID of the HubSpot team.
              example: "12345"
              type: string
          type: object
          required:
            - team_id
        tableau_group:
          description: Remote info for Tableau group.
          properties:
            group_id:
              description: The ID of the Tableau group.
              example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
              type: string
          type: object
          required:
            - group_id
        confluence_group:
          description: Remote info for Confluence group.
          properties:
            group_id:
              description: The ID of the Confluence group.
              example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
              type: string
          type: object
          required:
            - group_id
        jira_group:
          description: Remote info for Jira group.
          properties:
            group_id:
              description: The ID of the Jira group.
              example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
              type: string
          type: object
          required:
            - group_id
        docusign_group:
          description: Remote info for Docusign group.
          properties:
            group_id:
              description: The ID of the Docusign group.
              example: "12345"
              type: string
          type: object
          required:
            - group_id
        zoom_group:
          description: Remote info for Zoom group.
          properties:
            group_id:
              description: The ID of the Zoom group.
              example: "SoBVexyrQjqCkcxjpBWi6w"
              type: string
          type: object
          required:
            - group_id
        docusign_signing_group:
          description: Remote info for Docusign signing group.
          properties:
            signing_group_id:
              description: The ID of the Docusign signing group.
              example: "12345"
              type: string
          type: object
          required:
            - signing_group_id
      type: object
    ResourceRemoteInfo:
      description:
        Information that defines the remote resource. This replaces the
        deprecated remote_id and metadata fields.
      properties:
        databricks_account_service_principal:
          description: Remote info for Databricks account service principal.
          properties:
            application_id:
              description: The application ID of the service principal.
              example: 00000000-0000-0000-0000-000000000000
              type: string
            resource_id:
              description: The resource ID of the service principal.
              example: 00000000-0000-0000-0000-000000000000
              type: string
          type: object
          required:
            - application_id
            - resource_id
        azure_subscription:
          description: Remote info for Azure subscription.
          properties:
            resource_id:
              description: The ARM resource ID of the subscription.
              example: /subscriptions/00000000-0000-0000-0000-000000000000
              type: string
          type: object
          required:
            - resource_id
        azure_resource_group:
          description: Remote info for Azure resource group.
          properties:
            resource_id:
              description: The ARM resource ID of the resource group.
              example: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg
              type: string
          type: object
          required:
            - resource_id
        azure_management_group:
          description: Remote info for Azure management group.
          properties:
            resource_id:
              description: The ARM resource ID of the management group.
              example: /providers/Microsoft.Management/managementGroups/my-mg
              type: string
          type: object
          required:
            - resource_id
        azure_virtual_machine:
          description: Remote info for Azure virtual machine.
          properties:
            resource_id:
              description: The ARM resource ID of the virtual machine.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachines/vm01
              type: string
          type: object
          required:
            - resource_id
        azure_storage_account:
          description: Remote info for Azure storage account.
          properties:
            resource_id:
              description: The ARM resource ID of the storage account.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/sa01
              type: string
          type: object
          required:
            - resource_id
        azure_storage_container:
          description: Remote info for Azure storage container.
          properties:
            resource_id:
              description: The ARM resource ID of the storage container.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/sa01/blobServices/default/containers/c01
              type: string
          type: object
          required:
            - resource_id
        azure_sql_server:
          description: Remote info for Azure SQL server.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL server.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/servers/sqldev01
              type: string
          type: object
          required:
            - resource_id
        azure_sql_database:
          description: Remote info for Azure SQL database.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL database.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/servers/sqldev01/databases/db01
              type: string
          type: object
          required:
            - resource_id
        azure_sql_managed_instance:
          description: Remote info for Azure SQL managed instance.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL managed instance.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/managedInstances/mi01
              type: string
          type: object
          required:
            - resource_id
        azure_sql_managed_database:
          description: Remote info for Azure SQL managed database.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL managed database.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/managedInstances/mi01/databases/midb01
              type: string
          type: object
          required:
            - resource_id
        azure_user_assigned_managed_identity:
          description: Remote info for Azure user assigned managed identity.
          properties:
            resource_id:
              description: The ARM resource ID of the user assigned managed identity.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id01
              type: string
          type: object
          required:
            - resource_id
        azure_enterprise_app:
          description: Remote info for Azure Enterprise App.
          properties:
            resource_id:
              description:
                The remote application identifier (service principal or application
                object ID).
              example: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
              type: string
          type: object
          required:
            - resource_id
        azure_entra_id_role:
          description: Remote info for Azure Entra ID role.
          properties:
            resource_id:
              description: The remote role identifier from Entra (object ID).
              example: 11111111-2222-3333-4444-555555555555
              type: string
          type: object
          required:
            - resource_id
        aws_organizational_unit:
          description: Remote info for AWS organizational unit.
          properties:
            parent_id:
              description: The id of the parent organizational unit.
              example: ou-1234
              type: string
            organizational_unit_id:
              description: The id of the AWS organizational unit that is being created.
              example: ou-1234
              type: string
          type: object
          required:
            - organizational_unit_id
        aws_account:
          description: Remote info for AWS account.
          properties:
            account_id:
              description: The id of the AWS account.
              example: 234234234234
              type: string
            organizational_unit_id:
              description:
                The id of the AWS organizational unit. Required only if customer
                has OUs enabled.
              example: ou-1234
              type: string
          type: object
          required:
            - account_id
        aws_permission_set:
          description: Remote info for AWS Identity Center permission set.
          properties:
            arn:
              description: The ARN of the permission set.
              example: arn:aws:sso:::permissionSet/asdf-32139302d201d32/ps-f03323201211e1b9
              type: string
            account_id:
              description:
                The ID of an AWS account to which this permission set is
                provisioned.
              example: 234234234234
              type: string
          type: object
          required:
            - arn
            - account_id
        aws_iam_role:
          description: Remote info for AWS IAM role.
          properties:
            arn:
              description: The ARN of the IAM role.
              example: arn:aws:iam::179308207300:role/MyRole
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - arn
        aws_ec2_instance:
          description: Remote info for AWS EC2 instance.
          properties:
            instance_id:
              description: The instanceId of the EC2 instance.
              example: i-13f1a1e2899f9e93a
              type: string
            region:
              description: The region of the EC2 instance.
              example: us-east-2
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - instance_id
            - region
        aws_rds_cluster:
          description: Remote info for AWS RDS cluster.
          properties:
            cluster_id:
              description: The clusterId of the RDS cluster.
              example: demo-mysql-cluster
              type: string
            region:
              description: The region of the RDS cluster.
              example: us-east-2
              type: string
            resource_id:
              description: The resourceId of the RDS cluster.
              example: cluster-AOO8V0XUCNU13XLZXQDQRSN0NQ
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
            database_name:
              description:
                The name of the database in the RDS cluster. This can be the value
                of the tag `opal:database-name` or the database name.
              example: mydatabase
              type: string
            engine:
              allOf:
                - $ref: "#/components/schemas/RDSEngineEnum"
          type: object
          required:
            - cluster_id
            - region
            - resource_id
            - account_id
            - database_name
            - engine
        aws_rds_instance:
          description: Remote info for AWS RDS instance.
          properties:
            instance_id:
              description: The instanceId of the RDS instance.
              example: demo-mysql-db
              type: string
            region:
              description: The region of the RDS instance.
              example: us-east-2
              type: string
            resource_id:
              description: The resourceId of the RDS instance.
              example: db-AOO8V0XUCNU13XLZXQDQRSN0NQ
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - instance_id
            - region
            - resource_id
        aws_eks_cluster:
          description: Remote info for AWS EKS cluster.
          properties:
            arn:
              description: The ARN of the EKS cluster.
              example: arn:aws:eks:us-east-2:234234234234:cluster/testcluster
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
            - arn
        custom_connector:
          description: Remote info for a custom connector resource.
          properties:
            remote_resource_id:
              description: The id of the resource in the end system
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
            can_have_usage_events:
              description:
                A bool representing whether or not the resource can have usage
                data.
              example: False
              type: boolean
          type: object
          required:
            - remote_resource_id
            - can_have_usage_events
        gcp_organization:
          description: Remote info for GCP organization.
          properties:
            organization_id:
              description: The id of the organization.
              example: organizations/898931321
              type: string
          type: object
          required:
            - organization_id
        gcp_bucket:
          description: Remote info for GCP bucket.
          properties:
            bucket_id:
              description: The id of the bucket.
              example: example-bucket-898931321
              type: string
          type: object
          required:
            - bucket_id
        gcp_compute_instance:
          description: Remote info for GCP compute instance.
          properties:
            instance_id:
              description: The id of the instance.
              example: example-instance-898931321
              type: string
            project_id:
              description: The id of the project the instance is in.
              example: example-project-898931321
              type: string
            zone:
              description: The zone the instance is in.
              example: us-central1-a
              type: string
          type: object
          required:
            - instance_id
            - project_id
            - zone
        gcp_big_query_dataset:
          description: Remote info for GCP BigQuery Dataset.
          properties:
            project_id:
              description: The id of the project the dataset is in.
              example: example-project-898931321
              type: string
            dataset_id:
              description: The id of the dataset.
              example: example-dataset-898931321
              type: string
          type: object
          required:
            - project_id
            - dataset_id
        gcp_big_query_table:
          description: Remote info for GCP BigQuery Table.
          properties:
            project_id:
              description: The id of the project the table is in.
              example: example-project-898931321
              type: string
            dataset_id:
              description: The id of the dataset the table is in.
              example: example-dataset-898931321
              type: string
            table_id:
              description: The id of the table.
              example: example-table-898931321
              type: string
          type: object
          required:
            - project_id
            - dataset_id
            - table_id
        gcp_folder:
          description: Remote info for GCP folder.
          properties:
            folder_id:
              description: The id of the folder.
              example: folder/898931321
              type: string
          type: object
          required:
            - folder_id
        gcp_gke_cluster:
          description: Remote info for GCP GKE cluster.
          properties:
            cluster_name:
              description: The name of the GKE cluster.
              example: example-cluster-898931321
              type: string
          type: object
          required:
            - cluster_name
        gcp_project:
          description: Remote info for GCP project.
          properties:
            project_id:
              description: The id of the project.
              example: example-project-898931321
              type: string
          type: object
          required:
            - project_id
        gcp_sql_instance:
          description: Remote info for GCP SQL instance.
          properties:
            instance_id:
              description: The id of the SQL instance.
              example: example-sql-898931321
              type: string
            project_id:
              description: The id of the project the instance is in.
              example: example-project-898931321
              type: string
          type: object
          required:
            - instance_id
            - project_id
        gcp_billing_account:
          description: Remote info for a GCP billing account.
          properties:
            billing_account_id:
              description: The resource name of the billing account.
              example: billingAccounts/012345-567890-ABCDEF
              type: string
          type: object
          required:
            - billing_account_id
        gcp_service_account:
          description: Remote info for a GCP service account.
          properties:
            email:
              description: The email of the service account.
              example: production@project.iam.gserviceaccount.com
              type: string
            service_account_id:
              description: The id of the service account.
              example: 103561576023829460000
              type: string
            project_id:
              description: The id of the project the service account is in.
              example: example-project-898931321
              type: string
          type: object
          required:
            - email
            - service_account_id
            - project_id
        google_workspace_role:
          description: Remote info for GCP workspace role.
          properties:
            role_id:
              description: The id of the role.
              example: google-workspace-role:01234567890123456
              type: string
          type: object
          required:
            - role_id
        github_repo:
          description: Remote info for GitHub repository.
          properties:
            repo_id:
              deprecated: true
              description: The id of the repository.
              example: 898931321
              type: string
            repo_name:
              description: The name of the repository.
              example: Opal Security
              type: string
            org_name:
              description: GitHub repo's org name, required only for Enterprise.
              type: string
          type: object
          required:
            - repo_name
        github_org_role:
          description: Remote info for GitHub organization role.
          properties:
            role_id:
              description: The id of the role.
              example: 112233
              type: string
            org_name:
              description: GitHub org role's org name, required only for Enterprise.
              type: string
          type: object
          required:
            - role_id
        github_org:
          description: Remote info for GitHub organization.
          properties:
            org_name:
              description: The name of the organization.
              example: Opal Security
              type: string
          type: object
          required:
            - org_name
        github_enterprise_role:
          description: Remote info for GitHub Enterprise role.
          properties:
            role_id:
              description: The id of the role.
              example: 112233
              type: string
          type: object
          required:
            - role_id
        gitlab_project:
          description: Remote info for Gitlab project.
          properties:
            project_id:
              description: The id of the project.
              example: 898931321
              type: string
          type: object
          required:
            - project_id
        okta_app:
          description: Remote info for Okta directory app.
          properties:
            app_id:
              description: The id of the app.
              example: a9dfas0f678asdf67867
              type: string
          type: object
          required:
            - app_id
        okta_standard_role:
          description: Remote info for Okta directory standard role.
          properties:
            role_type:
              description: The type of the standard role.
              example: ORG_ADMIN
              type: string
          type: object
          required:
            - role_type
        okta_custom_role:
          description: Remote info for Okta directory custom role.
          properties:
            role_id:
              description: The id of the custom role.
              example: a9dfas0f678asdf67867
              type: string
          type: object
          required:
            - role_id
        snowflake_database:
          description: Remote info for Snowflake database.
          properties:
            database_name:
              description: The name of the database.
              example: mydatabase
              type: string
          type: object
          required:
            - database_name
        snowflake_schema:
          description: Remote info for Snowflake schema.
          properties:
            database_name:
              description: The name of the database the schema is in.
              example: mydatabase
              type: string
            schema_name:
              description: The name of the schema.
              example: mycatalogschema
              type: string
          type: object
          required:
            - database_name
            - schema_name
        snowflake_table:
          description: Remote info for Snowflake table.
          properties:
            database_name:
              description: The name of the database the table is in.
              example: mydatabase
              type: string
            schema_name:
              description: The name of the schema the table is in.
              example: mycatalogschema
              type: string
            table_name:
              description: The name of the table.
              example: myitemstable
              type: string
          type: object
          required:
            - database_name
            - schema_name
            - table_name
        ilevel_advanced_role:
          description: Remote info for iLevel Advanced role.
          properties:
            role_name:
              description: The name of the role.
              example: IT User
              type: string
          type: object
          required:
            - role_name
        tailscale_ssh:
          description: Remote info for Tailscale SSH tag.
          properties:
            tag_name:
              description: The name of the tag.
              example: admin
              type: string
          type: object
          required:
            - tag_name
        twingate_resource:
          description: Remote info for Twingate resource.
          properties:
            resource_id:
              description: The id of the Twingate resource.
              example: UmVzb3VyY2U6MTIzNA==
              type: string
          type: object
          required:
            - resource_id
        pagerduty_role:
          description: Remote info for Pagerduty role.
          properties:
            role_name:
              description: The name of the role.
              example: owner
              type: string
          type: object
          required:
            - role_name
        workday_role:
          description: Remote info for Workday role.
          properties:
            role_id:
              description: The id of the role.
              example: 123abc456def
              type: string
          type: object
          required:
            - role_id

        salesforce_permission_set:
          description: Remote info for Salesforce permission set.
          properties:
            permission_set_id:
              description: The id of the permission set.
              example: 0PS5Y090202wOV7WAM
              type: string
          type: object
          required:
            - permission_set_id
        salesforce_profile:
          description: Remote info for Salesforce profile.
          properties:
            profile_id:
              description: The id of the permission set.
              example: 0PS5Y090202wOV7WAM
              type: string
            user_license_id:
              description: The id of the user license.
              example: 1005Y030081Qb5XJHS
              type: string
          type: object
          required:
            - profile_id
            - user_license_id
        docusign_permission_profile:
          description: Remote info for Docusign permission profile.
          properties:
            permission_profile_id:
              description: The ID of the Docusign permission profile.
              example: "12345"
              type: string
          type: object
          required:
            - permission_profile_id
        salesforce_role:
          description: Remote info for Salesforce role.
          properties:
            role_id:
              description: The id of the role.
              example: 0PS5Y090202wOV7WAM
              type: string
          type: object
          required:
            - role_id
        teleport_role:
          description: Remote info for Teleport role.
          properties:
            role_name:
              description: The name role.
              example: admin_role
              type: string
          type: object
          required:
            - role_name
        datastax_astra_role:
          description: Remote info for an Astra role.
          properties:
            role_id:
              description: The id of the role.
              example: 123e4567-e89b-12d3-a456-426614174000
              type: string
          type: object
          required:
            - role_id
        coupa_role:
          description: Remote info for Coupa role.
          properties:
            role_id:
              description: The id of the role.
              example: 999
              type: string
          type: object
          required:
            - role_id
        cursor_organization:
          description: Remote info for a Cursor organization.
          properties:
            org_id:
              description: The id of the organization.
              example: 123e4567-e89b-12d3-a456-426614174000
              type: string
          type: object
          required:
            - org_id
        openai_platform_project:
          description: Remote info for OpenAI Platform project.
          properties:
            project_id:
              description: The id of the project.
              example: proj_abc
              type: string
          type: object
          required:
            - project_id
        openai_platform_service_account:
          description: Remote info for OpenAI Platform service account.
          properties:
            project_id:
              description: The id of the project for the service account.
              example: proj_abc
              type: string
            service_account_id:
              description: The id of the service account.
              example: svc_acct_abc
              type: string
          type: object
          required:
            - project_id
            - service_account_id
        anthropic_workspace:
          description: Remote info for Anthropic workspace.
          properties:
            workspace_id:
              description: The id of the workspace.
              example: ws-123456
              type: string
          type: object
          required:
            - workspace_id
        oracle_fusion_role:
          description: Remote info for Oracle Fusion role.
          properties:
            role_id:
              description: The id of the role.
              example: 123e4567-e89b-12d3-a456-426614174000
              type: string
          type: object
          required:
            - role_id
        devin_organization:
          description: Remote info for Devin organization.
          properties:
            org_id:
              description: The id of the organization.
              example: devin-org-01
              type: string
          type: object
          required:
            - org_id
        devin_role:
          description: Remote info for Devin role.
          properties:
            role_id:
              description: The id of the role.
              example: devin-role-01
              type: string
          type: object
          required:
            - role_id
        netsuite_role:
          description: Remote info for NetSuite role.
          properties:
            role_id:
              description: The id of the role.
              example: 123e4567-e89b-12d3-a456-426614174000
              type: string
          type: object
          required:
            - role_id
        datadog_role:
          description: Remote info for Datadog role.
          properties:
            role_id:
              description: The id of the role.
              example: 123e4567-e89b-12d3-a456-426614174000
              type: string
          type: object
          required:
            - role_id
        clickhouse_database:
          description: Remote info for ClickHouse database.
          properties:
            database_name:
              description: The name of the ClickHouse database.
              example: my_database
              type: string
          type: object
          required:
            - database_name
        clickhouse_table:
          description: Remote info for ClickHouse table.
          properties:
            database_name:
              description: The name of the ClickHouse database containing the table.
              example: my_database
              type: string
            table_name:
              description: The name of the ClickHouse table.
              example: my_table
              type: string
          type: object
          required:
            - database_name
            - table_name
        grafana_folder:
          description: Remote info for Grafana folder.
          properties:
            folder_uid:
              description: The UID of the Grafana folder.
              example: fffRTXX
              type: string
          type: object
          required:
            - folder_uid
        grafana_dashboard:
          description: Remote info for Grafana dashboard.
          properties:
            dashboard_uid:
              description: The UID of the Grafana dashboard.
              example: dddRTXX
              type: string
          type: object
          required:
            - dashboard_uid
        grafana_role:
          description: Remote info for Grafana role(fixed or custom).
          properties:
            role_uid:
              description: The UID of the Grafana role.
              example: rrfRTXX
              type: string
          type: object
          required:
            - role_uid
        zendesk_role:
          description: Remote info for Zendesk custom role.
          properties:
            role_id:
              description: The ID of the Zendesk custom role.
              example: "12345"
              type: string
          type: object
          required:
            - role_id
        hubspot_role:
          description: Remote info for HubSpot role.
          properties:
            role_id:
              description: The ID of the HubSpot role.
              example: "12345"
              type: string
          type: object
          required:
            - role_id
        alicloud_ram_role:
          description: Remote info for AliCloud RAM role.
          properties:
            role_arn:
              description: The ARN of the AliCloud RAM role.
              example: "acs:ram::1234567890:role/MyRole"
              type: string
          type: object
          required:
            - role_arn
        alicloud_ecs_instance:
          description: Remote info for AliCloud ECS instance.
          properties:
            instance_id:
              description: The ID of the ECS instance.
              example: "i-bp1a1234567890abcd"
              type: string
          type: object
          required:
            - instance_id
        zoom_role:
          description: Remote info for Zoom role.
          properties:
            role_id:
              description: The ID of the Zoom role.
              example: "0"
              type: string
          type: object
          required:
            - role_id
        zoom_license:
          description: Remote info for Zoom license (user type).
          properties:
            license_type:
              description: The Zoom user type representing the license (e.g. "2" for Licensed).
              example: "2"
              type: string
          type: object
          required:
            - license_type
      type: object
    RiskSensitivityEnum:
      type: string
      description:
        "Indicates the level of potential impact misuse or unauthorized
        access may incur."
      enum: [UNKNOWN, CRITICAL, HIGH, MEDIUM, LOW, NONE]
    CreateResourceInfo:
      description: |-
        # CreateResourceInfo Object
        ### Description
        The `CreateResourceInfo` object is used to store creation info for a resource.

        ### Usage Example
        Use in the `POST Resources` endpoint.
      example:
        remote_resource_id: API_ACCESS_MANAGEMENT_ADMIN-51d203da-313a-4fd9-8fcf-420ce6312345
        name: Okta Engineering Super Admin
        description: Okta super admin role.
        resource_type: OKTA_ROLE
        metadata: |-
          {
            "okta_directory_role":
              {
                "role_id": "SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345",
                "role_type": "SUPER_ADMIN",
              },
          }
        app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        name:
          description: The name of the remote resource.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the remote resource.
          example: Engineering team Okta role.
          type: string
        resource_type:
          $ref: "#/components/schemas/ResourceTypeEnum"
        app_id:
          description: The ID of the app for the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        remote_info:
          $ref: "#/components/schemas/ResourceRemoteInfo"
        remote_resource_id:
          deprecated: true
          description:
            Deprecated - use remote_info instead. The ID of the resource on the
            remote system. Include only for items linked to remote systems. See
            [this guide](https://docs.opal.dev/reference/end-system-objects) for
            details on how to specify this field.
          example: API_ACCESS_MANAGEMENT_ADMIN-51d203da-313a-4fd9-8fcf-420ce6312345
          type: string
        metadata:
          deprecated: true
          description: |-
            Deprecated - use remote_info instead.

            JSON metadata about the remote resource. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field.
            The required format is dependent on resource_type and should have the following schema:
            <style type="text/css">
            code {max-height:300px !important}
            </style>
            ```json
            {
              "$schema": "http://json-schema.org/draft-04/schema#",
              "title": "Resource Metadata",
              "properties": {
                "aws_ec2_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "region": {
                      "type": "string"
                    }
                  },
                  "required": ["instance_id", "region"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS EC2 Instance"
                },
                "aws_eks_cluster": {
                  "properties": {
                    "cluster_name": {
                      "type": "string"
                    },
                    "cluster_region": {
                      "type": "string"
                    },
                    "cluster_arn": {
                      "type": "string"
                    }
                  },
                  "required": ["cluster_name", "cluster_region", "cluster_arn"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS EKS Cluster"
                },
                "aws_rds_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "engine": {
                      "type": "string"
                    },
                    "region": {
                      "type": "string"
                    },
                    "resource_id": {
                      "type": "string"
                    },
                    "database_name": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "instance_id",
                    "engine",
                    "region",
                    "resource_id",
                    "database_name"
                  ],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS RDS Instance"
                },
                "aws_role": {
                  "properties": {
                    "arn": {
                      "type": "string"
                    },
                    "name": {
                      "type": "string"
                    }
                  },
                  "required": ["arn", "name"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "AWS Role"
                },
                "gcp_bucket": {
                  "properties": {
                    "bucket_id": {
                      "type": "string"
                    }
                  },
                  "required": ["bucket_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Bucket"
                },
                "gcp_compute_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "project_id": {
                      "type": "string"
                    },
                    "zone": {
                      "type": "string"
                    }
                  },
                  "required": ["instance_id", "project_id", "zone"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Compute Instance"
                },
                "gcp_folder": {
                  "properties": {
                    "folder_id": {
                      "type": "string"
                    }
                  },
                  "required": ["folder_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Folder"
                },
                "gcp_gke_cluster": {
                  "properties": {
                    "cluster_name": {
                      "type": "string"
                    }
                  },
                  "required": ["cluster_name"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP GKE Cluster"
                },
                "gcp_project": {
                  "properties": {
                    "project_id": {
                      "type": "string"
                    }
                  },
                  "required": ["project_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP Project"
                },
                "gcp_sql_instance": {
                  "properties": {
                    "instance_id": {
                      "type": "string"
                    },
                    "project_id": {
                      "type": "string"
                    }
                  },
                  "required": ["instance_id", "project_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GCP SQL Instance"
                },
                "git_hub_repo": {
                  "properties": {
                    "org_name": {
                      "type": "string"
                    },
                    "repo_name": {
                      "type": "string"
                    }
                  },
                  "required": ["org_name", "repo_name"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GitHub Repo"
                },
                "okta_directory_app": {
                  "properties": {
                    "app_id": {
                      "type": "string"
                    },
                    "logo_url": {
                      "type": "string"
                    }
                  },
                  "required": ["app_id", "logo_url"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Okta Directory App"
                },
                "okta_directory_role": {
                  "properties": {
                    "role_type": {
                      "type": "string"
                    },
                    "role_id": {
                      "type": "string"
                    }
                  },
                  "required": ["role_type", "role_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Okta Directory Role"
                },
                "salesforce_profile": {
                  "properties": {
                    "user_license": {
                      "type": "string"
                    }
                  },
                  "required": ["user_license"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Salesforce Profile"
                }
              },
              "additionalProperties": false,
              "minProperties": 1,
              "maxProperties": 1,
              "type": "object"
            }
            ```
          example: |-
            {
              "okta_directory_role":
                {
                  "role_id": "SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345",
                  "role_type": "SUPER_ADMIN",
                },
            }
          type: string
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        match_remote_name:
          description:
            A bool representing whether or not the resource's name should be
            synced from the end system. When true, the name is overwritten
            with the remote name on each sync, so a `name` provided together
            with this field set to true will be replaced at the next sync.
            Defaults to false.
          example: False
          type: boolean
        match_remote_description:
          description:
            A bool representing whether or not the resource's description
            should be synced from the end system. When true, the description
            is overwritten with the remote description on each sync, so a
            `description` provided together with this field set to true will
            be replaced at the next sync. Defaults to false.
          example: False
          type: boolean
      required:
        - name
        - resource_type
        - app_id
      type: object
    CreateBundleInfo:
      description: |-
        # CreateBundleInfo Object
        ### Description
        The `CreateBundleInfo` object is used to store creation info for a bundle.

        ### Usage Example
        Use in the `POST Bundles` endpoint.
      example:
        name: Engineering Team Bundle
        description: Engineering team bundle.
        admin_owner_id: 7870617d-e72a-47f5-a84c-693817ab4567
      properties:
        name:
          type: string
          description: The name of the bundle.
          example: "Test Bundle"
        description:
          type: string
          description: A brief description of the bundle.
          example: "This is a test bundle"
        admin_owner_id:
          type: string
          description: The ID of the bundle's admin owner.
          example: "7c86c85d-0651-43e2-a748-d69d658418e8"
      required:
        - name
        - admin_owner_id
    CreateGroupInfo:
      description: |-
        # CreateGroupInfo Object
        ### Description
        The `CreateGroupInfo` object is used to store creation info for a group.

        ### Usage Example
        Use in the `POST Groups` endpoint.
      example:
        remote_group_id: 00g4fixjd6Bc9w0TT5d7
        name: Engineering Team
        description: Engineering team Okta group.
        group_type: OKTA_GROUP
        metadata: |-
          { "okta_directory_group": { "group_id": "00g4bs66kwtpe1g12345" } }
        app_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        name:
          description: The name of the remote group.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the remote group.
          example: Engineering team Okta group.
          type: string
        group_type:
          $ref: "#/components/schemas/GroupTypeEnum"
        app_id:
          description: The ID of the app for the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        remote_info:
          $ref: "#/components/schemas/GroupRemoteInfo"
        remote_group_id:
          deprecated: true
          description:
            Deprecated - use remote_info instead. The ID of the group on the
            remote system. Include only for items linked to remote systems. See
            [this guide](https://docs.opal.dev/reference/end-system-objects) for
            details on how to specify this field.
          example: 00g4fixjd6Bc9w012345
          type: string
        metadata:
          deprecated: true
          description: |-
            Deprecated - use remote_info instead.

            JSON metadata about the remote group. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field.
            The required format is dependent on group_type and should have the following schema:
            <style type="text/css">
            code {max-height:300px !important}
            </style>
            ```json
            {
              "$schema": "http://json-schema.org/draft-04/schema#",
              "title": "Group Metadata",
              "properties": {
                "ad_group": {
                  "properties": {
                    "object_guid": {
                      "type": "string"
                    }
                  },
                  "required": ["object_guid"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Active Directory Group"
                },
                "duo_group": {
                  "properties": {
                    "group_id": {
                      "type": "string"
                    }
                  },
                  "required": ["group_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Duo Group"
                },
                "git_hub_team": {
                  "properties": {
                    "org_name": {
                      "type": "string"
                    },
                    "team_slug": {
                      "type": "string"
                    }
                  },
                  "required": ["org_name", "team_slug"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "GitHub Team"
                },
                "google_groups_group": {
                  "properties": {
                    "group_id": {
                      "type": "string"
                    }
                  },
                  "required": ["group_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Google Groups Group"
                },
                "ldap_group": {
                  "properties": {
                    "group_uid": {
                      "type": "string"
                    }
                  },
                  "required": ["group_uid"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "LDAP Group"
                },
                "okta_directory_group": {
                  "properties": {
                    "group_id": {
                      "type": "string"
                    }
                  },
                  "required": ["group_id"],
                  "additionalProperties": false,
                  "type": "object",
                  "title": "Okta Directory Group"
                }
              },
              "additionalProperties": false,
              "minProperties": 1,
              "maxProperties": 1,
              "type": "object"
            }
            ```
          example: |-
            { "okta_directory_group": { "group_id": "00g4bs66kwtpe1g12345" } }
          type: string
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        match_remote_name:
          description:
            A bool representing whether or not the group's name should be
            synced from the end system. When true, the name is overwritten
            with the remote name on each sync, so a `name` provided together
            with this field set to true will be replaced at the next sync.
            Defaults to false.
          example: False
          type: boolean
        match_remote_description:
          description:
            A bool representing whether or not the group's description should
            be synced from the end system. When true, the description is
            overwritten with the remote description on each sync, so a
            `description` provided together with this field set to true will
            be replaced at the next sync. Defaults to false.
          example: False
          type: boolean
      required:
        - name
        - group_type
        - app_id
      type: object
    PaginatedResourcesList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - resource_id: f454d283-ca67-4a8a-bdbb-df212eca5353
            description: This resource represents AWS IAM role "SupportUser".
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            remote_id: arn:aws:iam::490306337630:role/SupportUser
            remote_name: SupportUser
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
            parent_resource_id: f454d283-ca67-4a8a-bdbb-df212eca5345
          - resource_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            description: This resource represents GCP project "app-demo".
            remote_id: app-demo-307223
            remote_name: app-demo
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Resource"
          type: array
      type: object
      required:
        - results
    RequestStatusEnum:
      description: |-
        # Request Status
        ### Description
        The `RequestStatus` enum is used to represent the status of a request.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      enum:
        - PENDING
        - APPROVED
        - DENIED
        - CANCELED
      type: string
    Request:
      description: |-
        # Request Object
        ### Description
        The `Request` object is used to represent a request.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      example:
        id: 7c86c85d-0651-43e2-a748-d69d658418e8
        created_at: 2021-01-06T20:00:00Z
        updated_at: 2021-01-06T20:00:00Z
        requester_id: c86c85d-0651-43e2-a748-d69d658418e8
        target_user_id: r86c85d-0651-43e2-a748-d69d658418e8
        target_group_id: r86c85d-0651-43e2-a748-d69d658418e8
        status: pending
        reason: I need this resource.
        duration_minutes: 1440
        request_comments:
          - id: 7c86c85d-0651-43e2-a748-d69d658418e8
            created_at: 2021-01-06T20:00:00Z
            updated_at: 2021-01-06T20:00:00Z
            request_id: 4c86c85d-0651-43e2-a748-d69d658418e8
            user_id: c86c85d-0651-43e2-a748-d69d658418e8
            comment: This is a comment.
        reviewer_stages:
          - requestedRoleName: "Admin"
            requestedItemName: "AWS Production Account"
            stages:
              - stage: 1
                operator: AND
                reviewers:
                  - id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    status: PENDING
              - stage: 2
                operator: OR
                reviewers:
                  - id: 8d86c85d-0651-43e2-a748-d69d658418e9
                    status: APPROVED
      properties:
        id:
          description: The unique identifier of the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        created_at:
          description: The date and time the request was created.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
        updated_at:
          description: The date and time the request was last updated.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
        requester_id:
          description: The unique identifier of the user who created the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        target_user_id:
          description: The unique identifier of the user who is the target of the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        target_group_id:
          description: The unique identifier of the group who is the target of the request.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        status:
          description: The status of the request.
          example: pending
          $ref: "#/components/schemas/RequestStatusEnum"
        reason:
          description: The reason for the request.
          example: I need access to the AWS account.
          type: string
        duration_minutes:
          description: The duration of the request in minutes.
          example: 120
          type: integer
        requested_items_list:
          description: The list of targets for the request.
          type: array
          items:
            $ref: "#/components/schemas/RequestedItem"
        custom_fields_responses:
          description: The responses given to the custom fields associated to the request
          type: array
          items:
            $ref: "#/components/schemas/RequestCustomFieldResponse"
        stages:
          deprecated: true
          description: The stages configuration for this request
          $ref: "#/components/schemas/RequestItemStages"
        reviewer_stages:
          description:
            The configured reviewer stages for every item in this request, or
            an error message if reviewers could not be loaded
          oneOf:
            - type: array
              items:
                $ref: "#/components/schemas/RequestReviewerStages"
            - type: string
      required:
        - id
        - created_at
        - updated_at
        - requester_id
        - status
        - reason
    RequestCommentList:
      description: A paginated list of request comments
      type: object
      example:
        comments:
          - created_at: 2021-01-06T20:00:00Z
            request_id: 4c86c85d-0651-43e2-a748-d69d658418e8
            user_id: c86c85d-0651-43e2-a748-d69d658418e8
            comment: This is a comment.
      properties:
        comments:
          items:
            $ref: "#/components/schemas/RequestComment"
          type: array
      required:
        - comments
    RequestComment:
      description: |-
        # Request Comment Object
        ### Description
        The `RequestComment` object is used to represent a comment on a request.

        ### Usage Example
        Returned from the `GET Requests` endpoint as part of a `Request` object.
      example:
        created_at: 2021-01-06T20:00:00Z
        request_id: 4c86c85d-0651-43e2-a748-d69d658418e8
        user_id: c86c85d-0651-43e2-a748-d69d658418e8
        comment: This is a comment.
      properties:
        created_at:
          description: The date and time the comment was created.
          example: 2021-01-06T20:00:00Z
          format: date-time
          type: string
        request_id:
          description: The unique identifier of the request the comment is associated with.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        user_id:
          description: The unique identifier of the user who made the comment.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        user_full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        user_email:
          description: The user's email address.
          example: jake.barnes@company.com
          type: string
        comment:
          description: The content of the comment.
          example: This is a comment.
          type: string
      required:
        - created_at
        - request_id
        - user_id
        - comment
    RequestReviewerStages:
      description: The stages configuration for a request item
      type: object
      properties:
        access_level_name:
          description: The name of the access level requested.
          example: admin
          type: string
        access_level_remote_id:
          description: The ID of the access level requested on the remote system.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
        item_name:
          description: The name of the requested item
          type: string
        item_id:
          description: The ID of the resource requested.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        stages:
          description: The stages of review for this request
          type: array
          items:
            $ref: "#/components/schemas/RequestStage"
      required:
        - item_name
        - item_id
        - stages
    RequestItemStages:
      description: The stages configuration for a request item
      type: object
      deprecated: true
      properties:
        requestedRoleName:
          description: The name of the requested role
          type: string
        requestedItemName:
          description: The name of the requested item
          type: string
        stages:
          description: The stages of review for this request
          type: array
          items:
            $ref: "#/components/schemas/RequestStage"
      required:
        - requestedItemName
        - stages
    RequestStage:
      description: A stage in the request review process
      type: object
      properties:
        stage:
          description: The stage number
          type: integer
        operator:
          description: The operator to apply to reviewers in this stage
          $ref: "#/components/schemas/ReviewStageOperator"
        reviewers:
          description: The reviewers for this stage
          type: array
          items:
            $ref: "#/components/schemas/RequestReviewer"
      required:
        - stage
        - operator
        - reviewers
    ReviewStageOperator:
      description: The operator to apply to reviewers in a stage
      type: string
      enum:
        - AND
        - OR
    RequestReviewer:
      description: A reviewer in a request stage
      type: object
      properties:
        id:
          description: The unique identifier of the reviewer
          type: string
          format: uuid
        full_name:
          description: The user's full name.
          example: Jake Barnes
          type: string
        status:
          description: The status of this reviewer's review
          type: string
          enum:
            - PENDING
            - APPROVED
            - REJECTED
      required:
        - id
        - status
    RequestedItem:
      description: |-
        # Requested Item Object
        ### Description
        The `RequestedItem` object is used to represent a request target item.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      properties:
        resource_id:
          description: The ID of the resource requested.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        group_id:
          description: The ID of the group requested.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        access_level_name:
          description: The name of the access level requested.
          example: admin
          type: string
        access_level_remote_id:
          description: The ID of the access level requested on the remote system.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
        name:
          description: The name of the target.
          example: Engineering Team
          type: string
        remote_id:
          description: The ID of the target on the remote system.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
        remote_name:
          description: The name of the target on the remote system.
          example: SupportUser
          type: string
      example:
        resource_id: null
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        access_level_name: admin
        access_level_remote_id: arn:aws:iam::490306337630:role/SupportUser
        name: Engineering Team
    RequestCustomFieldResponse:
      properties:
        field_name:
          type: string
        field_type:
          example: SHORT_TEXT
          $ref: "#/components/schemas/RequestTemplateCustomFieldTypeEnum"
        field_value:
          oneOf:
            - type: string
              example: "This is a response to a long text or short text or multi choice"
            - type: boolean
              example: true
      required:
        - field_name
        - field_type
        - field_value
    RequestTemplateCustomFieldCalloutMetadata:
      description:
        The message shown to a requester by a `CALLOUT` field, and how prominently to
        show it.
      type: object
      properties:
        severity:
          description: How prominently the message is shown.
          enum:
            - INFO
            - WARNING
            - ERROR
          type: string
          example: WARNING
        text:
          description: The message shown to the requester.
          type: string
          example: This role grants access to production customer data.
      required:
        - severity
        - text
    RequestTemplateCustomFieldMultiChoiceMetadata:
      description: The options a requester can pick from in a `MULTI_CHOICE` or `MULTI_SELECT` field.
      type: object
      properties:
        options:
          items:
            type: string
          type: array
          example:
            - Incident response
            - Scheduled maintenance
      required:
        - options
    RequestTemplateCustomFieldInput:
      description:
        A field to put on a request template. Separate from `RequestTemplateCustomField`
        because a callout's name may be omitted on write, while a field read back always
        has one.
      type: object
      properties:
        name:
          description:
            The label shown to the requester. Required for every type except `CALLOUT`,
            which is display-only -- its name is an internal identifier, never displayed,
            and is generated if omitted.
          type: string
          example: Why do you need this access?
        description:
          description: Helper text shown beneath the field.
          type: string
          nullable: true
        type:
          $ref: "#/components/schemas/RequestTemplateCustomFieldTypeEnum"
        required:
          description:
            Whether the requester must answer. Ignored for `CALLOUT` fields, which
            collect no answer.
          type: boolean
          example: true
        metadata:
          $ref: "#/components/schemas/RequestTemplateCustomFieldMetadata"
      required:
        - type
    RequestTemplateCustomFieldMetadata:
      description:
        Extra configuration for field types that need it. Exactly one member is set, and
        which one is determined by the field's `type`.
      type: object
      properties:
        callout_data:
          $ref: "#/components/schemas/RequestTemplateCustomFieldCalloutMetadata"
        multi_choice_data:
          $ref: "#/components/schemas/RequestTemplateCustomFieldMultiChoiceMetadata"
    RequestTemplateCustomField:
      description: A field on a request template.
      type: object
      properties:
        name:
          description:
            The label shown to the requester. `CALLOUT` fields are display-only, so
            their name is an internal identifier and is never displayed.
          type: string
          example: Why do you need this access?
        description:
          description: Helper text shown beneath the field.
          type: string
          nullable: true
        type:
          $ref: "#/components/schemas/RequestTemplateCustomFieldTypeEnum"
        required:
          description:
            Whether the requester must answer. Always false for `CALLOUT` fields, which
            collect no answer.
          type: boolean
          example: true
        metadata:
          $ref: "#/components/schemas/RequestTemplateCustomFieldMetadata"
      required:
        - name
        - type
    RequestTemplate:
      description: A template describing what a requester is asked when requesting access.
      type: object
      properties:
        request_template_id:
          description: The ID of the request template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the request template.
          example: Production access questions
          type: string
        custom_fields:
          description: The fields on this template, in the order they are shown.
          items:
            $ref: "#/components/schemas/RequestTemplateCustomField"
          type: array
      required:
        - request_template_id
        - name
    PaginatedRequestTemplateList:
      type: object
      properties:
        next:
          description: The cursor with which to continue pagination if additional result pages exist.
          type: string
          nullable: true
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzAyMTMlMkIwMCUzQTAw
        previous:
          description: The cursor used to obtain the current result page.
          type: string
          nullable: true
          example: cj0xJnA9MjAyMS0wMS0wNSswMyUzQTI0JTNBNTMuNDMwMjEz
        results:
          items:
            $ref: "#/components/schemas/RequestTemplate"
          type: array
    CreateRequestTemplateInfo:
      description: Information for creating a request template.
      type: object
      properties:
        name:
          description: The name of the request template.
          example: Production access questions
          type: string
        custom_fields:
          description: The fields to put on the template, in the order they are shown.
          items:
            $ref: "#/components/schemas/RequestTemplateCustomFieldInput"
          type: array
      required:
        - name
    UpdateRequestTemplateInfo:
      description:
        Information for updating a request template. Omitted properties are left
        unchanged, but `custom_fields` replaces the template's fields wholesale when
        provided.
      type: object
      properties:
        request_template_id:
          description: The ID of the request template to update.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The new name of the request template.
          type: string
        custom_fields:
          description:
            The complete set of fields for the template. Any field not included is
            removed.
          items:
            $ref: "#/components/schemas/RequestTemplateCustomFieldInput"
          type: array
      required:
        - request_template_id
    RequestTemplateCustomFieldTypeEnum:
      description:
        The type of the custom request field. `CALLOUT` fields are display-only --
        they
        show a message to the requester and collect no answer, so they never appear in a
        request's `custom_fields`.
      enum:
        - SHORT_TEXT
        - LONG_TEXT
        - BOOLEAN
        - MULTI_CHOICE
        - MULTI_SELECT
        - CALLOUT
      type: string
    RequestList:
      description: |-
        # Request List
        ### Description
        The `RequestList` object is used to represent a list of requests.

        ### Usage Example
        Returned from the `GET Requests` endpoint.
      example:
        requests:
          - id: 7c86c85d-0651-43e2-a748-d69d658418e8
            organization_id: w86c85d-0651-43e2-a748-d69d658418e8
            created_at: 2021-01-06T20:00:00Z
            updated_at: 2021-01-06T20:00:00Z
            requester_id: c86c85d-0651-43e2-a748-d69d658418e8
            target_user_id: r86c85d-0651-43e2-a748-d69d658418e8
            target_group_id: g86c85d-0651-43e2-a748-d69d658418e8
            status: pending
            reason: I need this resource.
            duration_minutes: 1440
            request_comments:
              - id: 4c86c85d-0651-43e2-a748-d69d658418e8
                created_at: 2021-01-06T20:00:00Z
                updated_at: 2021-01-06T20:00:00Z
                request_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                user_id: c86c85d-0651-43e2-a748-d69d658418e8
                comment: This is a comment.
        cursor: eyJjcmVhdGVkX2F0IjoiMjAyMS0wMS0wNlQyMDo0NzowMFoiLCJ2YWx1ZSI6ImFkbWluIn0=
      properties:
        requests:
          description: The list of requests.
          type: array
          items:
            $ref: "#/components/schemas/Request"
        cursor:
          description:
            The cursor to use in the next request to get the next page of
            results.
          type: string
          example: eyJjcmVhdGVkX2F0IjoiMjAyMS0wMS0wNlQyMDo0NzowMFoiLCJ2YWx1ZSI6ImFkbWluIn0=
    Resource:
      description: |-
        # Resource Object
        ### Description
        The `Resource` object is used to represent a resource.

        ### Usage Example
        Update from the `UPDATE Resources` endpoint.
      example:
        resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        description: This resource represents AWS IAM role "SupportUser".
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        remote_id: 318038399
        remote_name: repo-name
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
        parent_resource_id: f454d283-ca67-4a8a-bdbb-df212eca5345
        ancestor_resource_ids:
          - f454d283-ca67-4a8a-bdbb-df212eca5345
        descendant_resource_ids:
          - f454d283-ca67-4a8a-bdbb-df212eca5345
      properties:
        resource_id:
          description: The ID of the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        app_id:
          description: The ID of the app.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        name:
          description: The name of the resource.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the resource.
          example: This resource represents AWS IAM role "SupportUser".
          type: string
        admin_owner_id:
          description: The ID of the owner of the resource.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        remote_resource_id:
          description: The ID of the resource on the remote system.
          example: 318038399
          type: string
        remote_resource_name:
          description: The name of the resource on the remote system.
          example: repo-name
          type: string
        resource_type:
          $ref: "#/components/schemas/ResourceTypeEnum"
        max_duration:
          description:
            The maximum duration for which the resource can be requested (in
            minutes).
          type: integer
          example: 120
        recommended_duration:
          description:
            The recommended duration for which the resource should be requested
            (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        extensions_duration_in_minutes:
          description:
            The duration for which access can be extended (in minutes). Set to
            0 to disable extensions. When > 0, extensions are enabled for the
            specified duration.
          type: integer
          example: 120
        require_manager_approval:
          description:
            A bool representing whether or not access requests to the resource
            require manager approval.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description:
            A bool representing whether or not access requests to the resource
            require an access ticket.
          example: False
          type: boolean
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this resource.
          example: False
          type: boolean
        require_mfa_to_request:
          description:
            A bool representing whether or not to require MFA for requesting
            access to this resource.
          example: False
          type: boolean
        require_mfa_to_connect:
          description:
            A bool representing whether or not to require MFA to connect to
            this resource.
          example: False
          type: boolean
        auto_approval:
          description:
            A bool representing whether or not to automatically approve
            requests to this resource.
          example: False
          type: boolean
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        is_requestable:
          description:
            A bool representing whether or not to allow access requests to this
            resource.
          example: False
          type: boolean
        parent_resource_id:
          description: The ID of the parent resource.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4305
          format: uuid
          type: string
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: A list of configurations for requests to this resource.
        request_configuration_list:
          description:
            A list of configurations for requests to this resource. Deprecated
            in favor of `request_configurations`.
          deprecated: true
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          type: array
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
        risk_sensitivity:
          description:
            The risk sensitivity level for the resource. When an override is
            set, this field will match that.
          readOnly: true
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        metadata:
          description:
            JSON metadata about the remote resource. Only set for items linked
            to remote systems. See [this
            guide](https://docs.opal.dev/reference/end-system-objects) for
            details.
          deprecated: true
          example: |-
            {
              "okta_directory_role":
                {
                  "role_id": "SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345",
                  "role_type": "SUPER_ADMIN",
                },
            }
          type: string
        remote_info:
          $ref: "#/components/schemas/ResourceRemoteInfo"
        ancestor_resource_ids:
          description: List of resource IDs that are ancestors of this resource.
          type: array
          items:
            format: uuid
            type: string
          example:
            - f454d283-ca67-4a8a-bdbb-df212eca5345
            - f454d283-ca67-4a8a-bdbb-df212eca5346
        descendant_resource_ids:
          description: List of resource IDs that are descendants of this resource.
          type: array
          items:
            format: uuid
            type: string
          example:
            - f454d283-ca67-4a8a-bdbb-df212eca5347
            - f454d283-ca67-4a8a-bdbb-df212eca5348
        match_remote_name:
          description:
            A bool representing whether or not the resource's name is synced
            from the end system. When true, the name is overwritten with the
            remote name on each sync. Defaults to false.
          example: False
          type: boolean
        match_remote_description:
          description:
            A bool representing whether or not the resource's description is
            synced from the end system. When true, the description is
            overwritten with the remote description on each sync. Defaults to
            false.
          example: False
          type: boolean
        last_successful_sync:
          readOnly: true
          description: Information about the last successful sync of this resource.
          $ref: "#/components/schemas/SyncTask"
      required:
        - resource_id
      type: object
    AwsPermissionSetMetadata:
      description: Metadata for AWS Identity Center permission set.
      properties:
        aws_permission_set:
          type: object
          properties:
            arn:
              description: The ARN of the permission set.
              example: arn:aws:sso:::permissionSet/asdf-32139302d201d32/ps-f03323201211e1b9
              type: string
            account_id:
              description:
                The ID of an AWS account to which this permission set is
                provisioned.
              example: 234234234234
              type: string
          required:
            - arn
            - account_id
      type: object
      required:
        - aws_permission_set
    UpdateResourceInfoList:
      example:
        resources:
          - resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: my-mongo-db
            description: This resource represents AWS IAM role "SupportUser".
            admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            max_duration: 120
            require_manager_approval: False
            require_support_ticket: False
          - resource_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            name: Admin Role
            description: This resource represents GCP project "app-demo".
            admin_owner_id: 4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3
            max_duration: 360
            require_manager_approval: False
            require_support_ticket: True
      properties:
        resources:
          description: A list of resources with information to update.
          items:
            $ref: "#/components/schemas/UpdateResourceInfo"
          type: array
      type: object
      required:
        - resources
    UpdateResourceInfo:
      description: |-
        # UpdateResourceInfo Object
        ### Description
        The `UpdateResourceInfo` object is used as an input to the UpdateResource API.
      example:
        resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: my-mongo-db
        description: This resource represents AWS IAM role "SupportUser".
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        max_duration: 120
        require_manager_approval: False
        require_support_ticket: False
      properties:
        resource_id:
          description: The ID of the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the resource.
          example: my-mongo-db
          type: string
        description:
          description: A description of the resource.
          example: This resource represents AWS IAM role "SupportUser".
          type: string
        admin_owner_id:
          description: The ID of the owner of the resource.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        max_duration:
          description:
            The maximum duration for which the resource can be requested (in
            minutes). Use -1 to set to indefinite. Deprecated in favor of
            `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        recommended_duration:
          description:
            The recommended duration for which the resource should be requested
            (in minutes). Will be the default value in a request. Use -1 to set
            to indefinite and 0 to unset. Deprecated in favor of
            `request_configurations`.
          type: integer
          example: 120
          deprecated: true
        require_manager_approval:
          description:
            A bool representing whether or not access requests to the resource
            require manager approval.
          example: False
          type: boolean
          deprecated: true
        require_support_ticket:
          description:
            A bool representing whether or not access requests to the resource
            require an access ticket. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        folder_id:
          description: The ID of the folder that the resource is located in.
          example: e27cb7b0-98e2-4555-9916-9e6d8ca6b079
          format: uuid
          type: string
          deprecated: true
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this resource.
          example: False
          type: boolean
        require_mfa_to_request:
          description:
            A bool representing whether or not to require MFA for requesting
            access to this resource. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        require_mfa_to_connect:
          description:
            A bool representing whether or not to require MFA to connect to
            this resource.
          example: False
          type: boolean
        auto_approval:
          description:
            A bool representing whether or not to automatically approve
            requests to this resource. Deprecated in favor of
            `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
        risk_sensitivity_override:
          allOf:
            - $ref: "#/components/schemas/RiskSensitivityEnum"
        match_remote_name:
          description:
            A bool representing whether or not the resource's name should be
            synced from the end system. When true, the name is overwritten
            with the remote name on each sync, so a `name` provided together
            with this field set to true will be replaced at the next sync. If
            not provided, the current value is left unchanged.
          example: False
          type: boolean
        match_remote_description:
          description:
            A bool representing whether or not the resource's description
            should be synced from the end system. When true, the description
            is overwritten with the remote description on each sync, so a
            `description` provided together with this field set to true will
            be replaced at the next sync. If not provided, the current value
            is left unchanged.
          example: False
          type: boolean
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_template_id:
          description:
            The ID of the associated request template. Deprecated in favor of
            `request_configurations`.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
          deprecated: true
        is_requestable:
          description:
            A bool representing whether or not to allow access requests to this
            resource. Deprecated in favor of `request_configurations`.
          example: False
          type: boolean
          deprecated: true
        extensions_duration_in_minutes:
          description:
            The duration for which access can be extended (in minutes).
            Deprecated, set the extension duration in the request_configuration
            you want it to apply to.
          type: integer
          example: 120
          deprecated: true
        parent_resource_id:
          description: The ID of the parent resource.
          example: f454d283-ca67-4a8a-bdbb-df212eca5345
          format: uuid
          type: string
          nullable: true
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description:
            A list of configurations for requests to this resource. If not
            provided, the default request configuration will be used.
        request_configuration_list:
          description:
            A list of configurations for requests to this resource. If not
            provided, the default request configuration will be used. Deprecated
            in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
      required:
        - resource_id
      type: object
    PaginatedTagsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - tag_id: f290a738-5f9f-43c2-ad67-fa31ff0eb946
            created_at: 2022-01-23T04:56:07Z
            updated_at: 2022-02-23T01:34:07Z
            user_creator_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
            admin_owner_id: bfb518b1-3f5b-4e3b-8eb8-3b3fabd4ea2b
            key: database-name
            value: redis_db
          - tag_id: 92f0a738-5f9f-43c2-ad67-fa31ff0eb052
            created_at: 2022-03-23T04:56:07Z
            updated_at: 2022-04-23T01:34:07Z
            user_creator_id: a4d7d928-783e-4599-8ec6-088d635af4ac
            admin_owner_id: gtg418b1-3f5b-4e3b-8eb8-3b3fabd4eaa1
            key: database-type
            value: sql
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Tag"
          type: array
      required:
        - results
      type: object
    TagsList:
      example:
        results:
          - tag_id: f290a738-5f9f-43c2-ad67-fa31ff0eb946
            created_at: 2022-01-23T04:56:07Z
            updated_at: 2022-02-23T01:34:07Z
            user_creator_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
            admin_owner_id: bfb518b1-3f5b-4e3b-8eb8-3b3fabd4ea2b
            key: database-name
            value: redis_db
          - tag_id: 92f0a738-5f9f-43c2-ad67-fa31ff0eb052
            created_at: 2022-03-23T04:56:07Z
            updated_at: 2022-04-23T01:34:07Z
            user_creator_id: a4d7d928-783e-4599-8ec6-088d635af4ac
            admin_owner_id: gtg418b1-3f5b-4e3b-8eb8-3b3fabd4eaa1
            key: database-type
            value: sql
      properties:
        tags:
          items:
            $ref: "#/components/schemas/Tag"
          type: array
      required:
        - tags
      type: object
    Tag:
      description: |-
        # Tag Object
        ### Description
        The `Tag` object is used to represent a tag.

        ### Usage Example
        Get tags from the `GET Tag` endpoint.
      example:
        tag_id: f290a738-5f9f-43c2-ad67-fa31ff0eb946
        created_at: 2022-01-23T04:56:07Z
        updated_at: 2022-02-23T01:34:07Z
        user_creator_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
        key: database-name
        value: redis_db
      properties:
        tag_id:
          description: The ID of the tag.
          example: f290a738-5f9f-43c2-ad67-fa31ff0eb946
          format: uuid
          type: string
        created_at:
          description: The date the tag was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        updated_at:
          description: The date the tag was last updated.
          example: 2022-02-23T01:34:07Z
          format: date-time
          type: string
        user_creator_id:
          description: The ID of the user that created the tag.
          example: d4a7d928-783e-4599-8ec6-088d635a5bcc
          format: uuid
          type: string
        key:
          description: The key of the tag.
          example: database-name
          type: string
        value:
          description: The value of the tag.
          example: redis_db
          type: string
      type: object
      required:
        - tag_id
    CreateTagInfo:
      description: |-
        # CreateTagInfo Object
        ### Description
        The `CreateTagInfo` object is used to represent configuration for a new tag.

        ### Usage Example
        Use in the `POST Tag` endpoint.
      example:
        tag_key: api-scope
        tag_value: production
      properties:
        tag_key:
          description: The key of the tag to create.
          example: api-scope
          type: string
        tag_value:
          description: The value of the tag to create.
          example: production
          type: string
      required:
        - tag_key
      type: object
    PaginatedGroupBindingsList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWtJ
        results:
          - group_binding_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            created_by_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            created_at: 2022-01-23T04:56:07Z
            source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            groups:
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
                group_type: OKTA_GROUP
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
                group_type: AWS_SSO_GROUP
          - group_binding_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            created_by_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            source_group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            created_at: 2022-01-23T04:56:07Z
            groups:
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
                group_type: AWS_SSO_GROUP
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
                group_type: OKTA_GROUP
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/GroupBinding"
          type: array
      required:
        - results
    CreateGroupBindingInfo:
      description: |-
        # CreateGroupBindingInfo Object
        ### Description
        The `CreateGroupBindingInfo` object is used as an input to the CreateGroupBinding API.
      example:
        source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
      properties:
        source_group_id:
          description: The ID of the source group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        groups:
          description: The list of groups.
          items:
            properties:
              group_id:
                description: The ID of the group.
                example: f454d283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
            required:
              - group_id
          type: array
      required:
        - source_group_id
        - groups
      type: object
    UpdateGroupBindingInfoList:
      example:
        group_bindings:
          - group_binding_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            groups:
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
          - group_binding_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            source_group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            groups:
              - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
              - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
      properties:
        group_bindings:
          description: A list of group bindings with information to update.
          items:
            $ref: "#/components/schemas/UpdateGroupBindingInfo"
          type: array
      type: object
      required:
        - group_bindings
    UpdateGroupBindingInfo:
      description: |-
        # UpdateGroupBindingInfo Object
        ### Description
        The `UpdateGroupBindingInfo` object is used as an input to the UpdateGroupBinding API.
      example:
        group_binding_id: 0ae19dbf-324d-4216-999c-574d46182c7e
        source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
      properties:
        group_binding_id:
          description: The ID of the group binding.
          example: 0ae19dbf-324d-4216-999c-574d46182c7e
          format: uuid
          type: string
        source_group_id:
          description: The ID of the source group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        groups:
          description: The list of groups.
          items:
            properties:
              group_id:
                description: The ID of the group.
                example: f454d283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
            required:
              - group_id
          type: array
      required:
        - group_binding_id
        - source_group_id
        - groups
      type: object
    GroupBinding:
      description: |-
        # Group Binding Object
        ### Description
        The `GroupBinding` object is used to represent a group binding.

        ### Usage Example
        Get group bindings from the `GET Group Bindings` endpoint.
      example:
        group_binding_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        created_by_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
        created_at: 2022-01-23T04:56:07Z
        source_group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        groups:
          - group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            group_type: OKTA_GROUP
          - group_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            group_type: AWS_SSO_GROUP
      properties:
        group_binding_id:
          description: The ID of the group binding.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        created_by_id:
          description: The ID of the user that created the group binding.
          example: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
          format: uuid
          type: string
        created_at:
          description: The date the group binding was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        source_group_id:
          description: The ID of the source group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        groups:
          description: The list of groups.
          items:
            $ref: "#/components/schemas/GroupBindingGroup"
          type: array
      required:
        - group_binding_id
        - created_by_id
        - created_at
        - source_group_id
        - groups
    GroupBindingGroup:
      description: |-
        # Group Binding Group Object
        ### Description
        The `GroupBindingGroup` object is used to represent a group binding group.

        ### Usage Example
        Get group binding groups from the `GET Group Bindings` endpoint.
      example:
        group_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        group_type: OKTA_GROUP
      properties:
        group_id:
          description: The ID of the group.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        group_type:
          $ref: "#/components/schemas/GroupTypeEnum"
      required:
        - group_id
        - group_type
      type: object
    UpdateAccessRuleInfo:
      description: |-
        # UpdateAccessRuleInfo Object
        ### Description
        The `UpdateAccessRuleInfo` object is used as an input to the UpdateAccessRule and CreateAccessRule API.
      properties:
        name:
          description: The name of the access rule.
          example: Platform Engineering
          type: string
        description:
          description: A description of the group.
          example: This access rule represents all platform engineers in the company.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        status:
          description: The status of the access rule.
          type: string
          enum:
            - ACTIVE
            - PAUSED
          example: ACTIVE
        ruleClauses:
          $ref: "#/components/schemas/RuleClauses"
      required:
        - status
        - ruleClauses
        - name
        - admin_owner_id
        - description
    PaginatedAccessRulesList:
      properties:
        next:
          description: The cursor with which to continue pagination if additional result pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          type: string
        previous:
          description: The cursor used to retrieve the previous page of results.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          type: string
        results:
          items:
            $ref: "#/components/schemas/AccessRule"
          type: array
      required:
        - results
      type: object
    AccessRule:
      description: |-
        # Access Rule Object
        ### Description
        The `AccessRule` object is used to represent an access rule configuration.

        ### Usage Example
        List access rules from the `GET /access-rules` endpoint, or retrieve a single access rule from the `GET /access-rules/{access_rule_id}` endpoint.
      properties:
        access_rule_id:
          description: The ID (group ID) of the access rule.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the access rule.
          example: Platform Engineering
          type: string
        description:
          description: A description of the group.
          example: This access rule represents all platform engineers in the company.
          type: string
        admin_owner_id:
          description: The ID of the owner of the group.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        status:
          description: The status of the access rule.
          type: string
          enum:
            - ACTIVE
            - PAUSED
          example: ACTIVE
        ruleClauses:
          $ref: "#/components/schemas/RuleClauses"
      required:
        - status
        - ruleClauses
        - name
        - admin_owner_id
        - access_rule_id
        - description
    RuleClauses:
      properties:
        when:
          $ref: "#/components/schemas/RuleConjunction"
        unless:
          $ref: "#/components/schemas/RuleConjunction"
      required:
        - when
    RuleConjunction:
      properties:
        clauses:
          type: array
          minItems: 1
          items:
            $ref: "#/components/schemas/RuleDisjunction"
      required:
        - clauses
    RuleDisjunction:
      properties:
        selectors:
          type: array
          items:
            $ref: "#/components/schemas/TagSelector"
        attribute_selectors:
          type: array
          items:
            $ref: "#/components/schemas/UserAttributeSelector"
      required:
        - selectors
    TagSelector:
      properties:
        key:
          type: string
        value:
          type: string
        connection_id:
          type: string
          format: uuid
      required:
        - key
        - value
        - connection_id
    UserAttributeSelector:
      properties:
        attribute:
          type: string
          enum:
            - HR_IDP_STATUS
        values:
          type: array
          items:
            type: string
      required:
        - attribute
        - values
    PaginatedOwnersList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: API Owner
            description: This owner represents the API team owners.
            access_request_escalation_period: 120
          - owner_id: e8581682-04f7-473a-a419-472f0fb26d46
            name: Finance Owner
            description: This owner represents the Finance team owners.
            access_request_escalation_period: 120
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Owner"
          type: array
      type: object
      required:
        - results
    Owner:
      description: |-
        # Owner Object
        ### Description
        The `Owner` object is used to represent an owner.
      example:
        owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: API Owner
        description: This owner represents the API team owners.
        access_request_escalation_period: 120
      properties:
        owner_id:
          description: The ID of the owner.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the owner.
          example: API Owner
          type: string
        description:
          description: A description of the owner.
          example: This owner represents the API team owners.
          type: string
        access_request_escalation_period:
          description:
            The amount of time (in minutes) before the next reviewer is
            notified. Use 0 to remove escalation policy.
          type: integer
          example: 120
        reviewer_message_channel_id:
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          format: uuid
          type: string
          nullable: true
        source_group_id:
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
          nullable: true
      required:
        - owner_id
      type: object
    CreateOwnerInfo:
      description: |-
        # CreateOwnerInfo Object
        ### Description
        The `CreateOwnerInfo` object is used to store creation info for an owner.

        ### Usage Example
        Use in the `POST Owners` endpoint.
      example:
        name: API Owner
        description: This owner represents the API team owners.
        access_request_escalation_period: 120
      properties:
        name:
          description: The name of the owner.
          example: API Owner
          type: string
        description:
          description: A description of the owner.
          example: This owner represents the API team owners.
          type: string
        access_request_escalation_period:
          description:
            The amount of time (in minutes) before the next reviewer is
            notified. Use 0 to remove escalation policy.
          type: integer
          example: 120
        user_ids:
          description:
            Users to add to the created owner. If setting a source_group_id
            this list must be empty.
          example:
            - 7870617d-e72a-47f5-a84c-693817ab4567
            - 1520617d-e72a-47f5-a84c-693817ab48ad2
          items:
            type: string
            format: uuid
          type: array
        reviewer_message_channel_id:
          description: The message channel id for the reviewer channel.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          type: string
        source_group_id:
          description: Sync this owner's user list with a source group.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
      required:
        - name
        - user_ids
      type: object
    UpdateOwnerInfoList:
      example:
        owners:
          - owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            name: API Owner
            description: This owner represents the API team owners.
            access_request_escalation_period: 120
          - owner_id: 99d0b81d-14be-4cf6-bd27-348b4af1d11b
            name: Finance Owner
            description: This owner represents the Finance team owners.
            access_request_escalation_period: 15
      properties:
        owners:
          description: A list of owners with information to update.
          items:
            $ref: "#/components/schemas/UpdateOwnerInfo"
          type: array
      type: object
      required:
        - owners
    UpdateOwnerInfo:
      description: |-
        # UpdateOwnerInfo Object
        ### Description
        The `UpdateOwnerInfo` object is used as an input to the UpdateOwner API.
      example:
        owner_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        name: API Owner
        description: This owner represents the API team owners.
        access_request_escalation_period: 120
      properties:
        owner_id:
          description: The ID of the owner.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        name:
          description: The name of the owner.
          example: API Owner
          type: string
        description:
          description: A description of the owner.
          example: This owner represents the API team owners.
          type: string
        access_request_escalation_period:
          description:
            The amount of time (in minutes) before the next reviewer is
            notified. Use 0 to remove escalation policy.
          example: 120
          type: integer
        reviewer_message_channel_id:
          description:
            The message channel id for the reviewer channel. Use "" to remove
            an existing message channel.
          example: 37cb7e41-12ba-46da-92ff-030abe0450b1
          type: string
        source_group_id:
          description:
            Sync this owner's user list with a source group. Use "" to remove
            an existing source group.
          example: 1b978423-db0a-4037-a4cf-f79c60cb67b3
          format: uuid
          type: string
      required:
        - owner_id
      type: object
    Condition:
      description: |-
        # Condition Object
        ### Description
        The `Condition` object is used to represent a condition.

        ### Usage Example
        Used to match request configurations to users in `RequestConfiguration`
      example:
        group_ids:
          - 1b978423-db0a-4037-a4cf-f79c60cb67b3
      type: object
      properties:
        group_ids:
          description: The list of group IDs to match.
          example:
            - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          items:
            type: string
            format: uuid
          type: array
        role_remote_ids:
          description: The list of role remote IDs to match.
          example:
            - arn:aws:iam::590304332660:role/AdministratorAccess
          type: array
          items:
            type: string
    RequestConfiguration:
      description: |-
        # Request Configuration Object
        ### Description
        The `RequestConfiguration` object is used to represent a request configuration.

        ### Usage Example
        Returned from the `GET Request Configurations` endpoint.
      example:
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        organization_id: w86c85d-0651-43e2-a748-d69d658418e8
        created_at: 2021-01-06T20:00:00Z
        updated_at: 2021-01-06T20:00:00Z
        condition:
          group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        allow_requests: True
        auto_approval: False
        require_mfa_to_request: False
        max_duration_minutes: 120
        recommended_duration_minutes: 120
        require_support_ticket: False
        reviewer_stages:
          - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            owner_ids:
              - 37cb7e41-12ba-46da-92ff-030abe0450b1
              - 37cb7e41-12ba-46da-92ff-030abe0450b2
            stage: 1
        priority: 1
      type: object
      properties:
        condition:
          description: The condition for the request configuration.
          $ref: "#/components/schemas/Condition"
        allow_requests:
          description:
            A bool representing whether or not to allow requests for this
            resource.
          example: True
          type: boolean
        auto_approval:
          description:
            A bool representing whether or not to automatically approve
            requests for this resource.
          example: False
          type: boolean
        require_mfa_to_request:
          description:
            A bool representing whether or not to require MFA for requesting
            access to this resource.
          example: False
          type: boolean
        max_duration_minutes:
          description:
            The maximum duration for which the resource can be requested (in
            minutes).
          type: integer
          example: 120
        recommended_duration_minutes:
          description:
            The recommended duration for which the resource should be requested
            (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        require_support_ticket:
          description:
            A bool representing whether or not access requests to the resource
            require an access ticket.
          example: False
          type: boolean
        extensions_duration_in_minutes:
          description:
            The duration for which access can be extended (in minutes). Set to
            0 to disable extensions. When > 0, extensions are enabled for the
            specified duration.
          type: integer
          example: 120
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        reviewer_stages:
          description: The list of reviewer stages for the request configuration.
          items:
            $ref: "#/components/schemas/ReviewerStage"
          type: array
        priority:
          description: The priority of the request configuration.
          example: 1
          type: integer
      required:
        - organization_id
        - allow_requests
        - auto_approval
        - require_mfa_to_request
        - require_support_ticket
        - priority
    CreateRequestConfigurationInfoList:
      description: |-
        # CreateRequestConfigurationInfoList Object
        ### Description
        The `CreateRequestConfigurationInfoList` object is used as an input to the CreateRequestConfigurations API.

        ### Formatting Requirements
        The `CreateRequestConfigurationInfoList` object must contain a list of `RequestConfiguration` objects.
        Exactly one default `RequestConfiguration` must be provided.  A default `RequestConfiguration` is one with a `condition` of `null`
        and a `priority` of `0`.  The default `RequestConfiguration` will be used when no other `RequestConfiguration` matches the request.

        Only one `RequestConfiguration` may be provided for each priority, and the priorities must be contiguous.  For example, if there are
        two `RequestConfigurations` with priorities 0 and 2, there must be a `RequestConfiguration` with priority 1.

        To use the `condition` field, the `condition` must be a valid JSON object.

        The `condition` must be a JSON object with the key `group_ids` (more options may be added in the future), whose value is a list of
        group IDs.
        The `condition` will match if the user requesting access is a member of any of the groups in the list. Currently, we only support
        using a single group as a condition.
      example:
        request_configurations:
          - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            organization_id: w86c85d-0651-43e2-a748-d69d658418e8
            condition: null
            allow_requests: True
            auto_approval: False
            require_mfa_to_request: False
            max_duration_minutes: 120
            recommended_duration_minutes: 120
            require_support_ticket: False
            reviewer_stages:
              - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                owner_ids:
                  - 37cb7e41-12ba-46da-92ff-030abe0450b1
                  - 37cb7e41-12ba-46da-92ff-030abe0450b2
                stage: 1
            priority: 0
          - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
            organization_id: w86c85d-0651-43e2-a748-d69d658418e8
            condition:
              group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
            allow_requests: True
            auto_approval: False
            require_mfa_to_request: False
            max_duration_minutes: 120
            recommended_duration_minutes: 120
            require_support_ticket: False
            reviewer_stages:
              - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                owner_ids:
                  - 37cb7e41-12ba-46da-92ff-030abe0450b1
                  - 37cb7e41-12ba-46da-92ff-030abe0450b2
                stage: 1
            priority: 1
      properties:
        request_configurations:
          description: A list of request configurations to create.
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          type: array
      type: object
      required:
        - request_configurations
    CreateConfigurationTemplateInfo:
      description: |-
        # CreateConfigurationTemplateInfo Object
        ### Description
        The `CreateConfigurationTemplateInfo` object is used to store creation info for a configuration template.

        ### Usage Example
        Use in the `POST Configuration Templates` endpoint.
      example:
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        visibility: private
        linked_audit_message_channel_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        member_oncall_schedule_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        break_glass_user_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        require_mfa_to_approve: False
        require_mfa_to_connect: False
        name: Prod AWS Template
      required:
        - admin_owner_id
        - visibility
        - name
        - require_mfa_to_approve
        - require_mfa_to_connect
      properties:
        admin_owner_id:
          description: The ID of the owner of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        visibility:
          description: The visibility info of the configuration template.
          example: private
          $ref: "#/components/schemas/VisibilityInfo"
        linked_audit_message_channel_ids:
          description:
            The IDs of the audit message channels linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        member_oncall_schedule_ids:
          description:
            The IDs of the on-call schedules linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        break_glass_user_ids:
          description:
            The IDs of the break glass users linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this configuration template.
          example: False
          type: boolean
        require_mfa_to_connect:
          description:
            A bool representing whether or not to require MFA to connect to
            resources associated with this configuration template.
          example: False
          type: boolean
        name:
          description: The name of the configuration template.
          example: Prod AWS Template
          type: string
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description:
            The request configuration list of the configuration template. If
            not provided, the default request configuration will be used.
        request_configuration_list:
          description:
            The request configuration list of the configuration template. If
            not provided, the default request configuration will be used.
            Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description:
            Custom request notification sent upon request approval for this
            configuration template.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
    ConfigurationTemplate:
      description: |-
        # Configuration Template Object
        ### Description
        The `ConfigurationTemplate` object is used to represent a configuration template.

        ### Usage Example
        Returned from the `GET Configuration Templates` endpoint.
      example:
        configuration_template_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        visibility: private
        linked_audit_message_channel_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        member_oncall_schedule_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        break_glass_user_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        require_mfa_to_approve: False
        require_mfa_to_connect: False
        name: Prod AWS Template
      properties:
        configuration_template_id:
          description: The ID of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the configuration template.
          example: Prod AWS Template
          type: string
        admin_owner_id:
          description: The ID of the owner of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        visibility:
          description: The visibility info of the configuration template.
          example: private
          $ref: "#/components/schemas/VisibilityInfo"
        linked_audit_message_channel_ids:
          description:
            The IDs of the audit message channels linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        request_configuration_id:
          description:
            The ID of the request configuration linked to the configuration
            template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        member_oncall_schedule_ids:
          description:
            The IDs of the on-call schedules linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 7c86c85d-0651-43e2-a748-d69d658418e8
          items:
            type: string
            format: uuid
          type: array
        break_glass_user_ids:
          description:
            The IDs of the break glass users linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this configuration template.
          example: False
          type: boolean
        require_mfa_to_connect:
          description:
            A bool representing whether or not to require MFA to connect to
            resources associated with this configuration template.
          example: False
          type: boolean
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description:
            Custom request notification sent upon request approval for this
            configuration template.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
    TicketPropagationConfiguration:
      description:
        Configuration for ticket propagation, when enabled, a ticket will
        be created for access changes related to the users in this resource.
      type: object
      properties:
        enabled_on_grant:
          type: boolean
        enabled_on_revocation:
          type: boolean
        ticket_provider:
          $ref: "#/components/schemas/TicketingProviderEnum"
        ticket_project_id:
          type: string
      required:
        - enabled_on_grant
        - enabled_on_revocation
    UpdateConfigurationTemplateInfo:
      description: |-
        # UpdateConfigurationTemplateInfo Object
        ### Description
        The `ConfigurationTemplate` object is used to represent an update to a configuration template.

        ### Usage Example
        Use in the `PUT Configuration Templates` endpoint.
      example:
        configuration_template_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        visibility: private
        linked_audit_message_channel_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        member_oncall_schedule_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        break_glass_user_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
        require_mfa_to_approve: False
        require_mfa_to_connect: False
        name: Prod AWS Template
      required:
        - configuration_template_id
      properties:
        configuration_template_id:
          description: The ID of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        name:
          description: The name of the configuration template.
          example: Prod AWS Template
          type: string
        admin_owner_id:
          description: The ID of the owner of the configuration template.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        visibility:
          description: The visibility info of the configuration template.
          example: private
          $ref: "#/components/schemas/VisibilityInfo"
        linked_audit_message_channel_ids:
          description:
            The IDs of the audit message channels linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        request_configurations:
          type: array
          items:
            $ref: "#/components/schemas/RequestConfiguration"
          description: The request configuration list linked to the configuration template.
        request_configuration_list:
          description:
            The request configuration list linked to the configuration
            template. Deprecated in favor of `request_configurations`.
          $ref: "#/components/schemas/CreateRequestConfigurationInfoList"
          deprecated: true
          example:
            request_configurations:
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition: null
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 0
              - request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e9
                organization_id: w86c85d-0651-43e2-a748-d69d658418e8
                condition:
                  group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b4
                allow_requests: True
                auto_approval: False
                require_mfa_to_request: False
                max_duration_minutes: 120
                recommended_duration_minutes: 120
                require_support_ticket: False
                reviewer_stages:
                  - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
                    owner_ids:
                      - 37cb7e41-12ba-46da-92ff-030abe0450b1
                      - 37cb7e41-12ba-46da-92ff-030abe0450b2
                    stage: 1
                priority: 1
        member_oncall_schedule_ids:
          description:
            The IDs of the on-call schedules linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 7c86c85d-0651-43e2-a748-d69d658418e8
          items:
            type: string
            format: uuid
          type: array
        break_glass_user_ids:
          description:
            The IDs of the break glass users linked to the configuration
            template.
          example:
            - 37cb7e41-12ba-46da-92ff-030abe0450b1
            - 37cb7e41-12ba-46da-92ff-030abe0450b2
          items:
            type: string
            format: uuid
          type: array
        require_mfa_to_approve:
          description:
            A bool representing whether or not to require MFA for reviewers to
            approve requests for this configuration template.
          example: False
          type: boolean
        require_mfa_to_connect:
          description:
            A bool representing whether or not to require MFA to connect to
            resources associated with this configuration template.
          example: False
          type: boolean
        ticket_propagation:
          $ref: "#/components/schemas/TicketPropagationConfiguration"
        custom_request_notification:
          description:
            Custom request notification sent upon request approval for this
            configuration template.
          type: string
          maxLength: 800
          nullable: true
          example: "Check your email to register your account."
    PaginatedConfigurationTemplateList:
      description: |-
        # PaginatedConfigurationTemplateList Object
        ### Description
        The `PaginatedConfigurationTemplateList` object is used to store a list of configuration templates.

        ### Usage Example
        Returned from the `GET Configuration Templates` endpoint.
      example:
        results:
          - configuration_template_id: 7c86c85d-0651-43e2-a748-d69d658418e8
            admin_owner_id: a4d7d928-783e-4599-8ec6-088d635af4ac
            visibility: private
            linked_audit_message_channel_ids:
              - l3cb7e41-12ba-46da-92ff-030abe0450b1
              - f3cb7e41-12ba-46da-92ff-030abe0450b2
            request_configuration_id: r3cb7e41-12ba-46da-92ff-030abe0450b1
            member_oncall_schedule_ids:
              - 23cb7e41-12ba-46da-92ff-030abe0450b1
              - m3cb7e41-12ba-46da-92ff-030abe0450b2
            break_glass_user_ids:
              - 63cb7e41-12ba-46da-92ff-030abe0450b1
              - b3cb7e41-12ba-46da-92ff-030abe0450b2
            require_mfa_to_approve: False
            require_mfa_to_connect: False
      properties:
        results:
          items:
            $ref: "#/components/schemas/ConfigurationTemplate"
          type: array
    CreateRequestInfo:
      description: All the information needed for creating a request
      properties:
        resources:
          type: array
          items:
            type: object
            properties:
              id:
                description:
                  The ID of the resource requested. Should not be specified if
                  group_id is specified.
                example: group283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
              access_level_remote_id:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
              access_level_name:
                description:
                  The ID of the access level requested on the remote system. This
                  field is deprecated and no longer required. We will populate
                  based on the access_level_remote_id.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
                deprecated: true
        groups:
          type: array
          items:
            type: object
            properties:
              id:
                description:
                  The ID of the group requested. Should not be specified if
                  resource_id is specified.
                example: f454d283-ca87-4a8a-bdbb-df212eca5353
                format: uuid
                type: string
              access_level_remote_id:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
              access_level_name:
                description: The ID of the access level requested on the remote system.
                example: arn:aws:iam::490306337630:role/SupportUser
                type: string
            required:
              - id
        target_user_id:
          description:
            The ID of the user to be granted access. Should not be specified if
            target_group_id is specified.
          example: userd283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        target_group_id:
          description:
            The ID of the group the request is for.  Should not be specified if
            target_user_id is specified.
          example: userd283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        reason:
          type: string
        support_ticket:
          type: object
          properties:
            ticketing_provider:
              $ref: "#/components/schemas/TicketingProviderEnum"
            remote_id:
              type: string
            identifier:
              type: string
            url:
              type: string
          required:
            - ticketing_provider
            - remote_id
            - identifier
            - url
        duration_minutes:
          description:
            The duration of the request in minutes. -1 represents an indefinite
            duration
          type: integer
          minimum: -1
        custom_metadata:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
              type:
                $ref: "#/components/schemas/RequestTemplateCustomFieldTypeEnum"
              value:
                type: string
            required:
              - name
              - type
              - value

      required:
        - reason
        - duration_minutes
        - resources
        - groups
    SyncErrorList:
      example:
        sync_errors:
          - app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
            first_seen: 2022-07-14T06:59:59Z
            last_seen: 2022-08-23T04:32:46Z
            error_message: Failed to connect to the remote system - insufficient credentials.
          - app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
            first_seen: 2023-04-24T06:59:59Z
            last_seen: 2024-08-21T04:32:46Z
            error_message: Resource not found.
      properties:
        sync_errors:
          items:
            $ref: "#/components/schemas/SyncError"
          type: array
      type: object
      required:
        - sync_errors
    SyncError:
      description: |-
        # SyncError Object
        ### Description
        The `SyncError` object is used to represent a sync error.

        ### Usage Example
        List from the `GET Sync Errors` endpoint.
      example:
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        first_seen: 2022-07-14T06:59:59Z
        last_seen: 2022-08-23T04:32:46Z
        error_message: Failed to connect to the remote system - insufficient credentials.
      properties:
        first_seen:
          description: The time when this error was first seen.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        last_seen:
          description: The time when this error was most recently seen.
          example: 2022-07-14T06:59:59Z
          type: string
          format: date-time
        error_message:
          description: The error message associated with the sync error.
          example: Failed to connect to the remote system - insufficient credentials.
          type: string
        app_id:
          description: The ID of the app that the error occured for.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
      required:
        - first_seen
        - last_seen
        - error_message
      type: object
    Bundle:
      properties:
        bundle_id:
          description: The ID of the bundle.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        name:
          description: The name of the bundle.
          example: Bundle 1
          type: string
        description:
          description: The description of the bundle.
          example: Description of bundle 1
          type: string
        created_at:
          type: string
          format: date-time
          description: The creation timestamp of the bundle, in ISO 8601 format
          readOnly: true
        updated_at:
          type: string
          format: date-time
          description: The last updated timestamp of the bundle, in ISO 8601 format
          readOnly: true
        admin_owner_id:
          description: The ID of the owner of the bundle.
          example: 4aed3e8a-727b-4d72-8010-3b8710c50bec
          format: uuid
          type: string
        total_num_items:
          description: The total number of items in the bundle.
          example: 15
          type: integer
          readOnly: true
        total_num_resources:
          description: The total number of resources in the bundle.
          example: 10
          type: integer
          readOnly: true
        total_num_groups:
          description: The total number of groups in the bundle.
          example: 5
          type: integer
          readOnly: true
    PaginatedBundleList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        totalCount: 2
        bundles:
          - id: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            name: Bundle 1
            description: Description of bundle 1
            admin_owner_id: 4aed3e8a-727b-4d72-8010-3b8710c50bec
            total_num_items: 0
            total_num_resources: 0
            total_num_groups: 0
          - id: 8294e9c9-deb6-48e9-9c99-da2a1e04a87f
            name: Bundle 2
            description: Description of bundle 2
            admin_owner_id: 4aed3e8a-727b-4d72-8010-3b8710c50bec
            total_num_items: 0
            total_num_resources: 0
            total_num_groups: 0
      properties:
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
        bundles:
          items:
            $ref: "#/components/schemas/Bundle"
          type: array
      type: object
      required:
        - bundles
    BundleResource:
      properties:
        bundle_id:
          description: The ID of the bundle containing the resource.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        resource_id:
          description: The ID of the resource within a bundle.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        access_level_name:
          description: The access level of the resource within a bundle.
          example: Read
          type: string
        access_level_remote_id:
          description: The remote ID of the access level of the resource within a bundle.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
    PaginatedBundleResourceList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        total_count: 3
        bundle_resources:
          - id: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            name: Resource 1
            access_level_name: read
            access_level_remote_id: pull
      properties:
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
        bundle_resources:
          items:
            $ref: "#/components/schemas/BundleResource"
          type: array
      type: object
      required:
        - bundle_resources
    BundleGroup:
      properties:
        bundle_id:
          description: The ID of the bundle containing the group.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        group_id:
          description: The ID of the group within a bundle.
          example: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
          format: uuid
          type: string
          readOnly: true
        access_level_name:
          description: The access level of the group within a bundle.
          example: Read
          type: string
        access_level_remote_id:
          description: The remote ID of the access level of the group within a bundle.
          example: arn:aws:iam::490306337630:role/SupportUser
          type: string
    PaginatedBundleGroupList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        total_count: 2
        bundle_groups:
          - id: a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            name: Group 1
          - id: 8294e9c9-deb6-48e9-9c99-da2a1e04a87f
            name: Group 2
      properties:
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
        bundle_groups:
          items:
            $ref: "#/components/schemas/BundleGroup"
          type: array
      type: object
      required:
        - bundle_groups
    ScopedRolePermissionList:
      example:
        permissions:
          - target_ids:
              - a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
              - 8294e9c9-deb6-48e9-9c99-da2a1e04a87f
            target_type: RESOURCE
            permission_name: READ
      properties:
        permissions:
          type: array
          items:
            $ref: "#/components/schemas/ScopedRolePermission"
      type: object
      required:
        - permissions
    ScopedRolePermission:
      type: object
      properties:
        target_ids:
          description:
            The IDs of the entities that this permission applies to. If empty
            of missing, the permission will have untargeted scope.
          example:
            - a381e7a3-e5e0-4c48-b1d6-4ccb4c191bc1
            - 8294e9c9-deb6-48e9-9c99-da2a1e04a87f
          items:
            type: string
            format: uuid
          type: array
        target_type:
          $ref: "#/components/schemas/RolePermissionTargetTypeEnum"
        permission_name:
          $ref: "#/components/schemas/RolePermissionNameEnum"
        allow_all:
          type: boolean
      required:
        - target_type
        - permission_name
        - allow_all
    SyncTask:
      type: object
      description:
        Represents a sync task that has been completed, either successfully
        or with errors.
      properties:
        id:
          description: The ID of the sync task.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        completed_at:
          description: The time when the sync task was completed.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
      required:
        - id
        - completed_at
      example:
        id: 7c86c85d-0651-43e2-a748-d69d658418e8
        completed_at: 2023-10-01T12:00:00Z
    RequestApprovalEnum:
      type: string
      enum: [REGULAR, ADMIN]
      description: "The decision level for the approval"
      example: "REGULAR"
    Delegation:
      type: object
      description: |-
        # Delegation Object
        ### Description
        The `Delegation` object represents a delegation of access review requests from one user to another.

        ### Usage Example
        List from the `GET Delegations` endpoint.
        Get from the `GET Delegation` endpoint.
      properties:
        id:
          description: The ID of the delegation.
          example: 4aed3e8a-727b-4d72-8010-3b8710c50bec
          format: uuid
          type: string
        delegator_user_id:
          description: The ID of the user delegating their access review requests.
          example: 123e4567-e89b-12d3-a456-426614174000
          format: uuid
          type: string
        delegate_user_id:
          description: The ID of the user being delegated to.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        start_time:
          description: The start time of the delegation.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
        end_time:
          description: The end time of the delegation.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
        reason:
          description: The reason for the delegation.
          example: "I need to be out of the office"
          type: string
        created_at:
          description: The creation time of the delegation.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
        updated_at:
          description: The last updated time of the delegation.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
      required:
        - id
        - delegator_user_id
        - delegate_user_id
        - start_time
        - end_time
        - reason
        - created_at
        - updated_at
    PaginatedDelegationsList:
      type: object
      description: A list of delegations for your organization.
      properties:
        results:
          description: The delegations in the result set.
          type: array
          items:
            $ref: "#/components/schemas/Delegation"
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        total_count:
          description: The total number of items in the result set.
          example: 2
          type: integer
    CreateDelegationRequest:
      type: object
      description: Request body for creating a new delegation of access review
        requests from one user to another.
      properties:
        delegator_user_id:
          description: The ID of the user delegating their access review requests.
          example: 123e4567-e89b-12d3-a456-426614174000
          format: uuid
          type: string
        delegate_user_id:
          description: The ID of the user being delegated to.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        start_time:
          description: The start time of the delegation.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
        end_time:
          description: The end time of the delegation.
          example: 2023-10-01T12:00:00Z
          type: string
          format: date-time
        reason:
          description: The reason for the delegation.
          example: "I need to be out of the office"
          type: string
      required:
        - delegator_user_id
        - delegate_user_id
        - start_time
        - end_time
        - reason
    ApiAccessLevelEnum:
      description: The access level of an API token.
      enum:
        - READ_ONLY
        - FULL_ACCESS
      type: string
    EventStreamConnectionTypeEnum:
      description: The type of event stream connection.
      enum:
        - WEBHOOK
      type: string
    WebhookAuthTypeEnum:
      description: The authentication type for webhook connections.
      enum:
        - NONE
        - API_KEY
        - HMAC
      type: string
    WebhookApiKeyLocationEnum:
      description: Where the API key is placed in webhook requests.
      enum:
        - HEADER
        - QUERY_PARAM
      type: string
    WebhookApiKeyCredential:
      description: An API key credential for webhook authentication.
      properties:
        id:
          description: The unique identifier for the credential.
          format: uuid
          type: string
        name:
          description: The name of the API key.
          type: string
        value:
          description: The value of the API key.
          type: string
        location:
          $ref: "#/components/schemas/WebhookApiKeyLocationEnum"
      required:
        - id
        - name
        - value
        - location
      type: object
    WebhookHmacCredential:
      description: An HMAC credential for webhook authentication.
      properties:
        id:
          description: The unique identifier for the credential.
          format: uuid
          type: string
        secret:
          description: The HMAC secret value.
          type: string
        created_at:
          description: When the credential was created.
          format: date-time
          type: string
      required:
        - id
        - secret
        - created_at
      type: object
    WebhookCredentials:
      description: Authentication credentials for a webhook connection.
      properties:
        auth_type:
          $ref: "#/components/schemas/WebhookAuthTypeEnum"
        api_key_credentials:
          description: API key credentials, present when auth_type is API_KEY.
          items:
            $ref: "#/components/schemas/WebhookApiKeyCredential"
          type: array
        hmac_credential_1:
          description: Primary HMAC credential, present when auth_type is HMAC.
          nullable: true
          $ref: "#/components/schemas/WebhookHmacCredential"
        hmac_credential_2:
          description: Secondary HMAC credential for rotation, present when auth_type is HMAC.
          nullable: true
          $ref: "#/components/schemas/WebhookHmacCredential"
      required:
        - auth_type
      type: object
    EventStreamConnection:
      description: The connection configuration for an event stream.
      properties:
        name:
          description: The name of the connection.
          type: string
        connection_type:
          $ref: "#/components/schemas/EventStreamConnectionTypeEnum"
        enabled:
          description: Whether the connection is enabled.
          type: boolean
        webhook_url:
          description: The webhook URL, present when connection_type is WEBHOOK.
          type: string
        credentials:
          $ref: "#/components/schemas/WebhookCredentials"
      required:
        - name
        - connection_type
        - enabled
      type: object
    EventStream:
      description: An event streaming connection that publishes events to an external system.
      properties:
        event_stream_id:
          description: The ID of the event stream.
          format: uuid
          type: string
        connection:
          $ref: "#/components/schemas/EventStreamConnection"
      required:
        - event_stream_id
        - connection
      type: object
    EventStreamList:
      description: A list of event streams.
      properties:
        event_streams:
          items:
            $ref: "#/components/schemas/EventStream"
          type: array
      required:
        - event_streams
      type: object
    CreateEventStreamInfo:
      description: Information needed to create an event stream.
      properties:
        name:
          description: The name for the event stream.
          type: string
        connection_type:
          $ref: "#/components/schemas/EventStreamConnectionTypeEnum"
        webhook_url:
          description: The webhook URL. Required when connection_type is WEBHOOK.
          type: string
        credentials:
          $ref: "#/components/schemas/WebhookCredentials"
      required:
        - name
        - connection_type
      type: object
    UpdateEventStreamInfo:
      description: Information needed to update an event stream.
      properties:
        name:
          description: Updated name for the event stream.
          type: string
        enabled:
          description: Whether the event stream should be enabled.
          type: boolean
        webhook_url:
          description: Updated webhook URL.
          type: string
        credentials:
          $ref: "#/components/schemas/WebhookCredentials"
      type: object
    Token:
      description: A first-party API token.
      example:
        token_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        created_at: 2022-01-23T04:56:07Z
        token_preview: ab123
        token_label: My API Token
        creator_user_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
        user_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
        access_level: READ_ONLY
      properties:
        token_id:
          description: The ID of the API token.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        created_at:
          description: The date and time the token was created.
          example: 2022-01-23T04:56:07Z
          format: date-time
          type: string
        token_label:
          description: A human-readable label for the token.
          example: My API Token
          type: string
        creator_user_id:
          description: The ID of the user who created the token.
          example: d4a7d928-783e-4599-8ec6-088d635a5bcc
          format: uuid
          type: string
        user_id:
          description: The ID of the user the token authenticates as.
          example: d4a7d928-783e-4599-8ec6-088d635a5bcc
          format: uuid
          type: string
        last_used_at:
          description: The date and time the token was last used.
          example: 2022-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
        access_level:
          $ref: "#/components/schemas/ApiAccessLevelEnum"
        expires_at:
          description: The date and time the token expires.
          example: 2023-01-23T04:56:07Z
          format: date-time
          nullable: true
          type: string
      required:
        - token_id
        - created_at
        - token_label
        - creator_user_id
        - user_id
        - access_level
      type: object
    PaginatedTokensList:
      example:
        next: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        previous: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
        results:
          - token_id: f454d283-ca87-4a8a-bdbb-df212eca5353
            created_at: 2022-01-23T04:56:07Z
            token_label: My API Token
            creator_user_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
            user_id: d4a7d928-783e-4599-8ec6-088d635a5bcc
            access_level: READ_ONLY
      properties:
        next:
          description:
            The cursor with which to continue pagination if additional result
            pages exist.
          example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
          nullable: true
          type: string
        previous:
          description: The cursor used to obtain the current result page.
          example: cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ
          nullable: true
          type: string
        results:
          items:
            $ref: "#/components/schemas/Token"
          type: array
      required:
        - results
      type: object
    StopCampaignRequest:
      properties:
        revoke_unreviewed:
          default: false
          description: Revoke all unreviewed access grants. Access grants with no reviewer decision will be immediately revoked.
          type: boolean
      type: object
  securitySchemes:
    BearerAuth:
      scheme: bearer
      type: http