Access certification campaigns allow key stakeholders to periodically review users’ access to resources. Okta can then modify resource access, based on stakeholder reviews. Manage campaign tasks with the following campaign APIs.
See Identity Governance for more information on access certification campaigns and Identity Governance.
- okta.governance.accessCertifications.manage
- ACCESS_CERTIFICATIONS_ADMIN
Creates a campaign that governs access to resources.
Specify the following for a campaign:
resourceSettings: Which resources are subject to reviewprincipalScopeSettings: Which users with access to the resources are subject to reviewscheduleSettings: The schedule of the campaignreviewerSettings: Who needs to review accessremediationSettings: What needs to be done after access is reviewednotificationSettings: Configure automatic notifications to a campaign creator or reviewer
Notes:
- You can certify access to service accounts that are managed in Okta Privileged Access if you're also subscribed to Okta Privileged Access. See Certify service accounts in the product documentation.
- You can certify AI agent access to resource connections if you're also subscribed to Okta for AI Agents. See Create identity campaigns to certify resource connections.
Specifies the characteristics of a single campaign
Name of the campaign. Maintain some uniqueness when naming the campaign as it helps to identify and filter for campaigns when needed.
Identifies the campaign as a resource (RESOURCE) or an identity (USER) campaign
| Enum Value | Description |
|---|---|
| RESOURCE | Certify access to resources in a campaign |
| USER | Certify access for an identity (user or AI agent) in a campaign |
Scheduler specific settings.
A campaign can be a ONE_OFF or a RECURRING campaign.
You can't provide both in the campaign definition.
An array of Okta specific resource id for which access is being reviewed.
Reviewer settings for the access certification campaign
Settings for email notifications to be sent to the reviewers at different stages of a campaign. All properties are optional.
Specifies the action to be taken after a reviewer makes a decision to APPROVE or REVOKE the access, or if the campaign was CLOSED and there was no response from the reviewer
Indicates the minimum required SKU to manage the campaign
- https://subdomain.okta.comhttps://subdomain.okta.com/governance/api/v1/campaigns
This flow creates a resource campaign for all users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used.
curl -i -X POST \
https://subdomain.okta.com/governance/api/v1/campaigns \
-H 'Content-Type: application/json' \
-d '{
"campaignType": "RESOURCE",
"description": "Group Campaign | User Reviewer Expression",
"name": "Group Campaign | User Reviewer Expression",
"status": "ACTIVE",
"scheduleSettings": {
"startDate": "2024-10-04T13:43:40.000Z",
"timeZone": "America/New_York",
"durationInDays": 30,
"type": "ONE_OFF"
},
"resourceSettings": {
"targetTypes": [
"GROUP"
],
"targetResources": [
{
"resourceType": "GROUP",
"resourceId": "00gg2gzn7m1Aw2zAs1d7"
}
]
},
"principalScopeSettings": {
"type": "USERS"
},
"reviewerSettings": {
"selfReviewDisabled": true,
"justificationRequired": true,
"reviewerScopeExpression": "user.profile.reviewerId",
"type": "REVIEWER_EXPRESSION",
"fallBackReviewerId": "00u3tm6uw9Cx4Sn8H1d7",
"reviewerId": "00u3tm6uw9Cx4Sn8H1d7",
"bulkDecisionDisabled": true
},
"notificationSettings": {
"notifyReviewPeriodEnd": true,
"notifyReviewerWhenOverdue": false,
"notifyReviewerDuringMidpointOfReview": true,
"remindersReviewerBeforeCampaignCloseInSecs": [
86400
],
"notifyReviewerWhenReviewAssigned": true,
"notifyReviewerAtCampaignEnd": true
},
"remediationSettings": {
"accessRevoked": "DENY",
"accessApproved": "NO_ACTION",
"noResponse": "NO_ACTION"
},
"reportingSettings": {
"createReportingPackageEnabled": true
}
}'A successful campaign create response
The id of the Okta user who created the resource
The ISO 8601 formatted date and time when the resource was created
The ISO 8601 formatted date and time when the object was last updated
The id of the Okta user who last updated the object
Name of the campaign. Maintain some uniqueness when naming the campaign as it helps to identify and filter for campaigns when needed.
Identifies the campaign as a resource (RESOURCE) or an identity (USER) campaign
| Enum Value | Description |
|---|---|
| RESOURCE | Certify access to resources in a campaign |
| USER | Certify access for an identity (user or AI agent) in a campaign |
Scheduler specific settings.
A campaign can be a ONE_OFF or a RECURRING campaign.
You can't provide both in the campaign definition.
An array of Okta specific resource id for which access is being reviewed.
Reviewer settings for the access certification campaign
Settings for email notifications to be sent to the reviewers at different stages of a campaign. All properties are optional.
Specifies the action to be taken after a reviewer makes a decision to APPROVE or REVOKE the access, or if the campaign was CLOSED and there was no response from the reviewer
ID of the recurring campaign if this campaign was created as part of a recurring schedule.
Reporting properties for processing post-completed campaigns
The status of the campaign
| Enum Value | Description |
|---|---|
| SCHEDULED | The campaign is scheduled to launch at a future time. |
| LAUNCHING | The campaign is in the process of launching. |
| ACTIVE | The campaign is currently active and running. |
| COMPLETED | The campaign has completed its execution. |
| DELETED | The campaign has been deleted and is no longer available. |
| ERROR | An error occurred during the campaign's execution. |
| STAGING_ELIGIBLE | The campaign is eligible for staging. A campaign is eligible for staging between one and seven days before its scheduled start date. |
| STAGING_IN_PROGRESS | The campaign is currently being staged. |
| STAGING_READY | The campaign has been successfully staged and is ready for launch. |
| STAGING_FAILED | The staging process for the campaign has failed. |
| STAGING_OUTDATED | The staging information for the campaign is outdated and must be restaged. This typically happens when an admin modifies resource, user, or reviewer configurations while the campaign is in the |
The response from a flow that creates a resource campaign for all users assigned to a specific Okta group. A specific user is assigned as the reviewer based on an Okta Expression. If this user isn't resolved, a specific fallback reviewer is used.
{ "_links": { "launchCampaign": { … }, "endCampaign": { … }, "reviews": { … }, "self": { … } }, "id": "icindtwi8SY3MVP1M1d6", "createdBy": "00u4oll01llSoXHEw1d7", "created": "2024-10-04T13:43:35Z", "lastUpdated": "2024-10-04T13:43:35Z", "lastUpdatedBy": "00u4oll01llSoXHEw1d7", "name": "Group Campaign | User Reviewer Expression", "description": "Group Campaign | User Reviewer Expression", "campaignType": "RESOURCE", "scheduleSettings": { "type": "ONE_OFF", "startDate": "2024-10-04T09:43:40-04:00", "durationInDays": 30, "timeZone": "America/New_York", "endDate": "2024-11-03T08:43:40-05:00" }, "resourceSettings": { "targetTypes": [ … ], "targetResources": [ … ] }, "principalScopeSettings": { "type": "USERS", "excludedUserIds": [], "userIds": [], "groupIds": [], "includeOnlyActiveUsers": false }, "reviewerSettings": { "type": "REVIEWER_EXPRESSION", "reviewerScopeExpression": "user.profile.reviewerId", "fallBackReviewerId": "00u3tm6uw9Cx4Sn8H1d7", "selfReviewDisabled": true, "justificationRequired": true, "bulkDecisionDisabled": false }, "notificationSettings": { "notifyReviewerWhenReviewAssigned": true, "notifyReviewerAtCampaignEnd": true, "remindersReviewerBeforeCampaignCloseInSecs": [ … ], "notifyReviewerWhenOverdue": false, "notifyReviewerDuringMidpointOfReview": true, "notifyReviewPeriodEnd": true }, "remediationSettings": { "accessApproved": "NO_ACTION", "accessRevoked": "DENY", "noResponse": "NO_ACTION" }, "status": "SCHEDULED" }