{"componentChunkName":"component---src-templates-simple-markdown-js","path":"/iga/","matchPath":"","result":{"data":{"markdownRemark":{"html":"

Okta Identity Governance API

\n

Okta Identity Governance is a SaaS-delivered, converged and intuitive Identity and Access management platform. Use it to simplify and manage your identity and access lifecycles across multiple systems and improve the overall security of your company.

\n

Okta Identity Governance builds upon the existing Okta Life Cycle Management products, such as Provisioning and Workflows, which help enterprises simplify access fulfillment and entitlement tasks throughout a user’s identity lifecycle.

\n
\n

Note: You can use the Okta Identity Governance APIs if you're subscribed to Okta Identity Governance. The APIs that are in Beta are available on both the Preview and Production environments. Contact your Customer Success Manager or Account Executive for more information.

\n
\n

Domain model

\n

Nouns

\n
RESOURCERESOURCE-PROVIDERCAMPAIGNSREVIEWSREQUEST-CONDITIONSREQUEST-SEQUENCESCATALOG-ENTRIESREQUESTSprovided bygenerateusegenerateallows
\n

Noun API reference

\n\n

Relationships

\n\n
\n
\n RESOURCECAMPAIGNREVIEWREQUEST-CONDITIONCATALOG-ENTRY\n
\n
\n
RESOURCEGRANTENTITLEMENT-BUNDLEENTITLEMENTREVIEWREQUEST (v1)CAMPAIGNREQUEST-CONDITIONShas manyhas manyhas manyhas manyhas manyreferenced byreferenced by
CAMPAIGNsettingremediationSettingssettingresourceSettingssettingreviewerSettingssettingscheduleSettingssettingnotificationSettingssettingprincipalScopeSettingsSTATUSREVIEWShasgenerates
REVIEWCAMPAIGNRESOURCEPRINCIPALREVIEWERDECISIONREMEDIATIONHISTORYcreated byhashashasmade by reviewerhashas
REQUEST-CONDITIONsettingsresourceSettingssettingsrequesterSettingssettingsaccessSettingssettingsapprovalSettingsCATALOG-ENTRYgenerates
ENTRYRESOURCECHILD-ENTRYACCESS-SCOPEGROUPENTITLEMENT-BUNDLEENTITLEMENT-VALUErepresents onecould have childrenrelated torelated toviaviavia
\n
\n \n

Governance Engine

\n

Resource - \"An object that may be governed\"

\n
RESOURCEstringresourceId0oa...,00g...,00e...enumresourceTypeAPP, GROUPstringnameSalesforce instance, Engineers, Salesforce AdminstringdescriptionThis instance..., This group...ENTITLEMENTSwhen resourceType = APP
\n

Entitlements - A collection of entitlement with corresponding allowed values

\n
ENTITLEMENTstringidstringnamestringdisplayNamestringdescriptionbooleanmultiValuebooleanrequiredENTITLEMENT-VALUEstringidstringdisplayNamestringvaluestringdescriptionRESOURCEhas allbelongs to parent
\n

Entitlement Bundle

\n
ENTITLEMENT-BUNDLEstringnamestringdescriptionENTITLEMENTSRESOURCEENTITLEMENT-VALUEhas somebelongs towith selectedbelongs to
\n

Collection - A group of resources and associated entitlements

\n\n
\n
\n mermaidCOLLECTION-ASSIGNMENT\n
\n
\n
COLLECTIONstringnamestringdescriptionRESOURCEENTITLEMENTcontainscontainsbelongs to
COLLECTION-ASSIGNMENTCOLLECTIONPRINCIPALGRANTSfor a targetassigned togenerates one or more
\n
\n \n

Grant

\n
GRANTenumgrantTypeenumactionsettingsscheduleSettingsenumstatusTARGET-PRINCIPALRESOURCEstringtypestringexternalIdENTITLEMENTSENTITLEMENT-BUNDLEgranted tofor a targetmay havemay have
\n

Principal Entitlement : Assigned entitlement with values for a Principal

\n
PRINCIPAL-ENTITLEMENTstringidstringnamestringdisplayNamestringdescriptionbooleanmultiValuebooleanrequiredENTITLEMENT-VALUEstringidstringdisplayNamestringvaluestringdescriptionRESOURCETARGET-PRINCIPALwithbelongs to parentassigned to
\n

Governance object lifecycles

\n

Governance objects have lifecycles that are driven by system and user interactions.

\n

When using governance APIs, it is important to understand the potential status values of objects, and how they transition from one lifecycle state to another.

\n

Campaign

\n

Campaign status lifecycle

\n
/launch
background job
background job
background job
/end
background purger
/delete
/delete
404 Not found
SCHEDULED
LAUNCHING
ACTIVE
ERROR
COMPLETED
\n

The following lifecycle operations are available on single Request Types.

\n\n

Request condition

\n

Request condition lifecycle

\n
POST
/activate
PATCH
DELETE
PATCH
/deactivate
PATCH
DELETE
404 Not found
new condition
INACTIVE
ACTIVE
INVALID
\n

A request condition may transition to INVALID status if:

\n\n

The transition to INVALID status may occur when:

\n\n

Request

\n

Request.status lifecycle

\n
POST
system action, request available in Access Requests
system action, request invalid
required approvals approved
any approval rejects
requester cancels
request expires
new request
SUBMITTED
PENDING
REJECTED
APPROVED
DENIED
CANCELED
EXPIRED
\n

Request.grantStatus lifecycle

\n

Only applicable if Request.status === 'APPROVED'

\n
system action
assign to app success
add to group success
create grant success
assign to app failure
add to group failure
create grant failure
certain cases (app group?)
Request.status==APPROVED
Request.grantStatus=PENDING
Request.grantStatus=GRANTED
Request.grantStatus=FAILED
Request.grantStatus=MANUAL_GRANT_REQUIRED
\n

Request.revocationStatus lifecycle

\n

Only applicable if Request.accessDuration is defined.

\n
system action
accessDuration exceeded, successful access revocation
accessDuration exceeded, failed access revocation
Request.grantStatus==GRANTED
Request.revocationStatus=PENDING, revocationScheduled=TIMESTAMP
Request.revocationStatus=REVOKED
Request.revocationStatus=FAILED
\n

Collection

\n

Collection lifecycle

\n
POST /collections
POST /collections/{id}/resources
DELETE /collections/{id}/resources/{id}
DELETE /collections/{id}
GET /collections/{id}
404 Not Found
No Collection
Empty Collection
Collection with Resources
No Collection
\n

Collection assignment processing lifecycle

\n
POST /collections/{id}/assignments
background job
background job fails
PUT /collections/{id}/resources/id
DELETE /collections/{id}/assignments/{id}
background job
Collection Assignment Removed, Grants Removed
Collection Assignment Updated, Grants Pending
Collection Assigned, Grants Created
Syslog event for failed assignment
Collection Assignment Removed, Grants Remain
\n

Access Request v1 (Request types)

\n
REQUEST-TYPES (v1)REQUESTS (v1)OWNER (v1)allowadministrated by
\n\n\n
\n
\n REQUEST-TYPE (v1)REQUEST (v1)OWNER (v1)\n
\n
\n
REQUEST-TYPE (v1)settingapprovalSettingssettingrequestSettingssettingresourceSettingsOWNER (v1)REQUEST (v1)administrated byallows
REQUEST (v1)REQUEST-TYPE (v1)CREATOR (v1)REQUESTER (v1)REQUESTER-FIELD-VALUES (v1)APPROVAL (v1)APPROVER (v1)DECISION (v1)APPROVER-FIELD-VALUES (v1)ACTION (v1)RESOURCEallowed bycreated-byrequested-byprovided by requestermay requirehasmade by approverprovided by approvermay generatehas
OWNER (v1)TEAM (v1)MEMBER (v1)OKTA-USERishasis
\n
\n \n

Request Type

\n

Request Type status lifecycle

\n
/publish
DELETE /request-types/:requestTypeId
/un-publish
Invalid state detected during an operation
404 Not found
DRAFT
ACTIVE
DISABLED
\n

The only terminal state for a Request Type is when the resource can no longer be found.

\n

A DISABLED Request Type may be repaired through the administrative portal and re-enter a DRAFT or ACTIVE state.

\n

The following lifecycle operations are available on single Request Types.

\n\n

V1 Request

\n

V1 Request.requestStatus lifecycle

\n
Moved to pending in UI
Moved to resolved in UI
OPEN
PENDING
RESOLVED
\n

A Request progresses in its lifecycle state based on team or administrative actions on a variety of channels, including:

\n\n

The following lifecycle operations are available on single Request.

\n","headings":[{"value":"Okta Identity Governance API","depth":1},{"value":"Domain model","depth":2},{"value":"Nouns","depth":3},{"value":"Noun API reference","depth":4},{"value":"Relationships","depth":3},{"value":"Governance Engine","depth":2},{"value":"Resource - \"An object that may be governed\"","depth":3},{"value":"Entitlements - A collection of entitlement with corresponding allowed values","depth":3},{"value":"Entitlement Bundle","depth":3},{"value":"Collection - A group of resources and associated entitlements","depth":3},{"value":"Grant","depth":3},{"value":"Principal Entitlement : Assigned entitlement with values for a Principal","depth":3},{"value":"Governance object lifecycles","depth":2},{"value":"Campaign","depth":3},{"value":"Campaign status lifecycle","depth":4},{"value":"Request condition","depth":3},{"value":"Request condition lifecycle","depth":4},{"value":"Request","depth":3},{"value":"Request.status lifecycle","depth":4},{"value":"Request.grantStatus lifecycle","depth":4},{"value":"Request.revocationStatus lifecycle","depth":4},{"value":"Collection","depth":3},{"value":"Collection lifecycle","depth":4},{"value":"Collection assignment processing lifecycle","depth":4},{"value":"Access Request v1 (Request types)","depth":2},{"value":"Request Type","depth":3},{"value":"Request Type status lifecycle","depth":4},{"value":"V1 Request","depth":3},{"value":"V1 Request.requestStatus lifecycle","depth":4}]},"contentItem":{"data":{"lastModified":"2025-08-14T17:31:26.000Z","enableToc":null,"disableLastModified":null,"tocMaxDepth":null,"requestLogin":false}},"siteConfig":{"enableToc":false,"disableLastModified":true,"tocMaxDepth":4}},"pageContext":{"matchPath":"","id":"4cbe6527-d4b7-5394-aeb8-ab92a9095aa8__redocly content/iga/","seo":{"title":"Okta Identity Governance API","description":null,"image":"","keywords":null,"jsonLd":null,"lang":null,"siteUrl":null},"pageId":"iga/index.md","pageBaseUrl":"/iga/index","type":"markdown","toc":{"enable":true,"maxDepth":4,"headings":[{"depth":1,"value":"Okta Identity Governance API","id":"okta-identity-governance-api"},{"depth":2,"value":"Domain model","id":"domain-model"},{"depth":3,"value":"Nouns","id":"nouns"},{"depth":4,"value":"Noun API reference","id":"noun-api-reference"},{"depth":3,"value":"Relationships","id":"relationships"},{"depth":2,"value":"Governance Engine","id":"governance-engine"},{"depth":3,"value":"Resource - \"An object that may be governed\"","id":"resource---an-object-that-may-be-governed"},{"depth":3,"value":"Entitlements - A collection of entitlement with corresponding allowed values","id":"entitlements---a-collection-of-entitlement-with-corresponding-allowed-values"},{"depth":3,"value":"Entitlement Bundle","id":"entitlement-bundle"},{"depth":3,"value":"Collection - A group of resources and associated entitlements","id":"collection---a-group-of-resources-and-associated-entitlements"},{"depth":3,"value":"Grant","id":"grant"},{"depth":3,"value":"Principal Entitlement : Assigned entitlement with values for a Principal","id":"principal-entitlement--assigned-entitlement-with-values-for-a-principal"},{"depth":2,"value":"Governance object lifecycles","id":"governance-object-lifecycles"},{"depth":3,"value":"Campaign","id":"campaign"},{"depth":4,"value":"Campaign status lifecycle","id":"campaign-status-lifecycle"},{"depth":3,"value":"Request condition","id":"request-condition"},{"depth":4,"value":"Request condition lifecycle","id":"request-condition-lifecycle"},{"depth":3,"value":"Request","id":"request"},{"depth":4,"value":"Request.status lifecycle","id":"requeststatus-lifecycle"},{"depth":4,"value":"Request.grantStatus lifecycle","id":"requestgrantstatus-lifecycle"},{"depth":4,"value":"Request.revocationStatus lifecycle","id":"requestrevocationstatus-lifecycle"},{"depth":3,"value":"Collection","id":"collection"},{"depth":4,"value":"Collection lifecycle","id":"collection-lifecycle"},{"depth":4,"value":"Collection assignment processing lifecycle","id":"collection-assignment-processing-lifecycle"},{"depth":2,"value":"Access Request v1 (Request types)","id":"access-request-v1-request-types"},{"depth":3,"value":"Request Type","id":"request-type"},{"depth":4,"value":"Request Type status lifecycle","id":"request-type-status-lifecycle"},{"depth":3,"value":"V1 Request","id":"v1-request"},{"depth":4,"value":"V1 Request.requestStatus lifecycle","id":"v1-requestrequeststatus-lifecycle"}]},"data":{"title":"Okta Identity Governance API","meta":[{"name":"description","content":"Learn how the Okta Identity Governance API works"}]},"catalogInfo":null,"link":"/iga/","sidebarName":"reference","isLanding":false,"showPrevButton":null,"showNextButton":null,"apiVersions":null,"apiVersionId":null,"isDefaultApiVersion":null}},"staticQueryHashes":["1123603147","1302185487","1344209882","1398840060","1520077861","1975142765","2667623876","2950305614","3240152602","3743992808","561138138"]}