Resource Owners

The Resource Owners API allows you to manage assigning owners to resources in your Okta Identity Governance (OIG) org. You can drive automation and simplify OIG configuration by assigning owners to resources, such as apps, groups, and entitlements. For example, resource owners are automatically assign as reviewers for access certifications or requests that are scoped with specific owner-assigned resources.

Configure the resource owners
Beta
OAuth 2.0 scopes:
  • okta.governance.resourceOwner.manage
Admin roles:
  • SUPER_ADMIN
Permissions:
  • okta.apps.manage
  • okta.users.read
  • okta.groups.read

Configures the owners for resources

Request
Request Body schema: application/json
required
resourceOrns
required
Array of strings <okta-resource-orn> [ 1 .. 10 ] items

The resources to assign owners

principalOrns
Array of strings <okta-principal-orn> [ 0 .. 5 ] items

Owners of the resource. If no owners are provided (empty list), then all current owners are removed.

Responses
200

Resource owners success response

400

A request failed validation

401

When authentication fails

403

When authorization fails

429

When the rate limit has been exceeded

500

When there is a server fault due to an unexpected error

post/governance/api/v1/resource-owners
Request samples
application/json
{
  • "principalOrns": [
    • "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00u10sfroCwbHQO4a0g",
    • "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00u6yl0Q065H4BCPR0g4"
    ],
  • "resourceOrns": [
    • "orn:okta:governance:00o11edPwGqbUrsDm0g4:entitlement-bundles:enbogpaj3XUzcM62u1d6"
    ]
}
Response samples
application/json
{
  • "data": [
    • {
      • "parentResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
      • "resource": {
        },
      • "principals": []
      }
    ]
}

List all resources with owners
Beta
OAuth 2.0 scopes:
  • okta.governance.resourceOwner.read
Admin roles:
  • SUPER_ADMIN
Permissions:
  • okta.apps.read
  • okta.users.read
  • okta.groups.read

Lists all resources with assigned owners for an app (the parent resource).

For this request, you must specifiy the filter query parameter with a parentResourceOrn filter expression. This method returns all the resources, such as entitlements or entitlement bundles, that have owners assigned.

Request
query Parameters
after
string

The pagination cursor that points to the last record of the previous request.

Example: after=00u68w6vzKLultXS97g6
filter
required
string <scim-filter>

A filter expression that returns entries based on the following properties and supported operators:

  • parentResourceOrn: supports eq (required)
  • resource.orn: supports eq
  • resource.type: supports eq
  • resource.profile.name: supports sw and co (both parentResourceOrn and resource.type filters are required for resource.profile.name filtering)

Note: Query parameter percent encoding is required. See Special characters.

Examples:
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.orn eq "orn:okta:governance:00o11edPwGqbUrsDm0g4:entitlement-bundles:enbogpaj3XUzcM62u1d6"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles" AND resource.profile.name sw "License"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles" AND resource.profile.name co "License"
include
Array of strings

Adds additional properties in the response

Items Value: Description
parent_resource_owner

If the parent resource has an owner assigned, then the parent resource is included in the data array response.

Examples:
Query param: ?include=parent_resource_owner
include=parent_resource_owner
limit
integer [ 1 .. 200 ]
Default: 20

The maximum number of records returned in a response

Responses
200

Resource owners list success response

400

A request failed validation

401

When authentication fails

403

When authorization fails

429

When the rate limit has been exceeded

500

When there is a server fault due to an unexpected error

get/governance/api/v1/resource-owners
Request samples 
Response samples 
application/json
{
  • "data": [
    • {
      • "parentResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
      • "resource": {
        },
      • "principals": []
      },
    • {
      • "parentResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
      • "resource": {
        },
      • "principals": [
        ]
      },
    • {
      • "parentResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
      • "resource": {
        },
      • "principals": [
        ]
      }
    ],
  • "_links": {
    • "self": {
      • "href": "https://myorg.okta.com/governance/api/v1/resource-owners?limit=20&filter=parentResourceOrn eq \"orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ\""
      }
    },
  • "metadata": {
    • "total": 10
    }
}
Update a resource owner
Beta
OAuth 2.0 scopes: 
  • okta.governance.resourceOwner.manage
Admin roles: 
  • SUPER_ADMIN
Permissions: 
  • okta.apps.manage
  • okta.users.read
  • okta.groups.read
Updates a resource owner.


Request 
Request Body schema: application/json
required
required
Array of objects  [ 1 .. 5 ] items 
 
resourceOrn
required
string <okta-resource-orn> 
The ID of the resource in ORN format. 
The resource can be an app, an entitlement value, or an entitlement bundle.
See supported resources.


 
Responses 
204
Resource owners success patch response


400
A request failed validation


401
When authentication fails


403
When authorization fails


429
When the rate limit has been exceeded


500
When there is a server fault due to an unexpected error


patch/governance/api/v1/resource-owners
Request samples 
application/json
{
  • "resourceOrn": "orn:okta:governance:00o11edPwGqbUrsDm0g4:entitlement-bundles:enbogpaj3XUzcM62u1d6",
  • "data": [
    • {
      • "op": "REMOVE",
      • "path": "/principalOrn",
      • "value": "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00u20sfroCwbHQO4a0g"
      },
    • {
      • "op": "REMOVE",
      • "path": "/principalOrn",
      • "value": "orn:okta:directory:00o11edPwGqbUrsDm0g4:users:00u10sfroCwbHQO4a0g"
      }
    ]
}
Response samples 
application/json
{
  • "errorCode": "string",
  • "errorId": "string",
  • "errorSummary": "string",
  • "errorLink": "string",
  • "errorCauses": [
    • {
      • "errorSummary": "string",
      • "reason": "string",
      • "location": "string",
      • "locationType": "string",
      • "domain": "string"
      }
    ]
}
List all resources without owners
Beta
OAuth 2.0 scopes: 
  • okta.governance.resourceOwner.read
Admin roles: 
  • SUPER_ADMIN
Permissions: 
  • okta.apps.read
Lists all resources without assigned owners for an app (the parent resource).


For this request, you must specifiy the filter query parameter with a parentResourceOrn filter expression.
This method returns all the resources for an app, such as entitlements or entitlement bundles, that don't have owners assigned.


Request 
query Parameters
after
string
The pagination cursor that points to the last record of the previous request.


 
 Example:  after=00u68w6vzKLultXS97g6
filter
required
string <scim-filter> 
A filter expression that returns entries based on the following properties and supported operators:


    

  • parentResourceOrn: supports eq (required)
    • 

  • resource.type: supports eq
    • 

  • resource.profile.*:  supports sw and co (both parentResourceOrn and resource.type filters are required for resource.profile.* filtering)
    • 





Note: Query parameter percent encoding is required. See Special characters.




  Examples: 
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles" AND resource.profile.name sw "License"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-bundles" AND resource.profile.name co "License"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-values AND resource.profile.parent.id eq "esp2lr1lavoGDYw5U8g6"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-values" AND resource.profile.parent.id eq "esp2lr1lavoGDYw5U8g6" AND resource.profile.name sw "License"
filter=parentResourceOrn eq "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ" AND resource.type eq "entitlement-values" AND resource.profile.parent.id eq "esp2lr1lavoGDYw5U8g6" AND resource.profile.name co "License"
limit
integer  [ 1 .. 200 ] 
 Default:  20
The maximum number of records returned in a response


 
Responses 
200
Resource owners catalog resources success response


400
A request failed validation


401
When authentication fails


403
When authorization fails


429
When the rate limit has been exceeded


500
When there is a server fault due to an unexpected error


get/governance/api/v1/resource-owners/catalog/resources
Request samples 
Response samples 
application/json
{
  • "parentResourceOrn": "orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ",
  • "data": [
    • {
      • "id": "enbogpaj3XUzcM62u1d6",
      • "type": "entitlement-bundles",
      • "orn": "orn:okta:governance:00o11edPwGqbUrsDm0g4:entitlement-bundles:enbogpaj3XUzcM62u1d6",
      • "profile": {
        }
      },
    • {
      • "id": "enb1spaj3XUzcM62u1d6",
      • "type": "entitlement-bundles",
      • "orn": "orn:okta:governance:00o11edPwGqbUrsDm0g4:entitlement-bundles:enb1spaj3XUzcM62u1d6",
      • "profile": {
        }
      }
    ],
  • "_links": {
    • "self": {
      • "href": "https://myorg.okta.com/governance/api/v1/resource-owners/catalog/resources?limit=20&filter=parentResourceOrn eq \"orn:okta:idp:00o11edPwGqbUrsDm0g4:apps:salesforce:0oafxqCAJWWGELFTYASJ\" AND resource.type eq \"entitlement-bundles\""
      }
    }
}