Okta Identity Governance API

Okta Identity Governance is a SaaS-delivered, converged and intuitive Identity and Access management platform. Use it to simplify and manage your identity and access lifecycles across multiple systems and improve the overall security of your company.

Okta Identity Governance builds upon the existing Okta Life Cycle Management products, such as Provisioning and Workflows, which help enterprises simplify access fulfillment and entitlement tasks throughout a user’s identity lifecycle.

Note: You can use the Okta Identity Governance APIs if you're subscribed to Okta Identity Governance. The APIs that are in Beta are available on both the Preview and Production environments. Contact your Customer Success Manager or Account Executive for more information.

Domain model

Nouns

Noun API reference

• Campaigns
• Reviews
• Request conditions
• Request sequences
• Request settings

Relationships

Entitlement management

Resource - "An object that may be governed"

Entitlements - A collection of entitlement with corresponding allowed values

Entitlement Bundle

Collection - A group of resources and associated entitlements

Grant

Principal Entitlement : Assigned entitlement with values for a Principal

Governance object lifecycles

Governance objects have lifecycles that are driven by system and user interactions.

When using governance APIs, it is important to understand the potential status values of objects, and how they transition from one lifecycle state to another.

Campaign

Campaign status lifecycle

The following lifecycle operations are available on single Request Types.

• Add
• Launch
• End
• Delete

Request condition

Request condition lifecycle

A request condition may transition to INVALID status if:

• The resource is deleted.
• All groups referenced in its requesterSettings have been deleted.
• All groups referenced in its accessScopeSettings have been deleted.
• All entitlement bundles referenced in its accessScopeSettings have been deleted.
• All entitlements referenced in its accessScopeSettings have been deleted.
• The resource opted out of entitlement management, but its accessScopeSettings reference an entitlement bundle or entitlement.

The transition to INVALID status may occur when:

• The system notices any of the aforementioned states during a related API operation (Create request, etc...)
• Periodically when request condition integrity is checked

Request

Request.status lifecycle

Request.grantStatus lifecycle

Only applicable if Request.status === 'APPROVED'

Request.revocationStatus lifecycle

Only applicable if Request.accessDuration is defined.

Collection

Collection lifecycle

Collection assignment processing lifecycle

Access Request v1 (Request types)

• Request Types (v1)
• Requests (v1)
• Owner (v1)