IAM Governance Bundles

The IAM Governance Bundle API provides operations for managing governance entitlement bundles, including roles and resources associated with the bundles, for the Admin Console. For details on governance bundles for the Admin Console, see Govern Okta admin roles and Entitlement Management.

List all governance bundles
OAuth 2.0 scopes:
  • okta.roles.read

Lists all governance bundles for the Admin Console in your org

Request
query Parameters
after
string

The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.

limit
integer [ 1 .. 200 ]
Default: 20

A limit on the number of objects to return

Responses
200

OK

403

Forbidden

429

Too Many Requests

get/api/v1/iam/governance/bundles
Request samples
Response samples
application/json
{}

Create a governance bundle
OAuth 2.0 scopes:
  • okta.roles.manage

Creates a governance bundle of entitlements for the Admin Console

Request
Request Body schema: application/json
required
description
string

Description of the governance bundle

Array of objects (IAMBundleEntitlement)

List of entitlements to include in the governance bundle

Array
resourceSets
Array of strings

List of resource set IDs for the custom role

role
string

The role

targets
Array of strings

List of target resource IDs to scope the entitlement with the role

name
string

Name of the governance bundle

Responses
200

Success

400

Bad Request

403

Forbidden

429

Too Many Requests

post/api/v1/iam/governance/bundles
Request samples
application/json
{
  • "name": "Group admin bundle",
  • "description": "Group bundle for administrative access",
  • "entitlements": {
    • "role": "GROUP_MEMBERSHIP_ADMIN"
    }
}
Response samples
application/json
{}

Retrieve a governance bundle
OAuth 2.0 scopes:
  • okta.roles.read

Retrieves a governance bundle for the Admin Console

Request
path Parameters
bundleId
required
string

The id of a bundle

Example: enbllojq9J9J105DL1d6
Responses
200

OK

400

Bad Request

403

Forbidden

429

Too Many Requests

get/api/v1/iam/governance/bundles/{bundleId}
Request samples
Response samples
application/json
{}

Replace a governance bundle
OAuth 2.0 scopes:
  • okta.roles.manage

Replaces the properties of a governance bundle for the Admin Console

Request
path Parameters
bundleId
required
string

The id of a bundle

Example: enbllojq9J9J105DL1d6
Request Body schema: application/json
required
description
string

Description of the governance bundle

Array of objects (IAMBundleEntitlement)

List of entitlements to include in the governance bundle

Array
resourceSets
Array of strings

List of resource set IDs for the custom role

role
string

The role

targets
Array of strings

List of target resource IDs to scope the entitlement with the role

name
string

Name of the governance bundle

Responses
200

Success

400

Bad Request

403

Forbidden

429

Too Many Requests

put/api/v1/iam/governance/bundles/{bundleId}
Request samples
application/json
{
  • "name": "Group admin bundle",
  • "description": "Group bundle for administrative access",
  • "entitlements": {
    • "role": "GROUP_MEMBERSHIP_ADMIN"
    }
}
Response samples
application/json
{}

Delete a governance bundle
OAuth 2.0 scopes:
  • okta.roles.manage

Deletes an Admin Console governance bundle

Request
path Parameters
bundleId
required
string

The id of a bundle

Example: enbllojq9J9J105DL1d6
Responses
204

No Content

403

Forbidden

429

Too Many Requests

delete/api/v1/iam/governance/bundles/{bundleId}
Request samples
Response samples
application/json
{
  • "errorCode": "E0000006",
  • "errorSummary": "You do not have permission to perform the requested action",
  • "errorLink": "E0000006",
  • "errorId": "sampleNUSD_8fdkFd8fs8SDBK",
  • "errorCauses": [ ]
}

List all entitlements for a governance bundle
OAuth 2.0 scopes:
  • okta.roles.read

Lists all entitlements specific to a governance bundle

Request
path Parameters
bundleId
required
string

The id of a bundle

Example: enbllojq9J9J105DL1d6
query Parameters
after
string

The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.

limit
integer [ 1 .. 200 ]
Default: 20

A limit on the number of objects to return

Responses
200

OK

403

Forbidden

429

Too Many Requests

get/api/v1/iam/governance/bundles/{bundleId}/entitlements
Request samples
Response samples
application/json
{}

List all values for a governance bundle entitlement
OAuth 2.0 scopes:
  • okta.roles.read

Lists all entitlement values that are specific to a governance bundle entitlement

Request
path Parameters
bundleId
required
string

The id of a bundle

Example: enbllojq9J9J105DL1d6
entitlementId
required
string

The id of a bundle entitlement

Example: ent4rg7fltWSgrlDT8g6
query Parameters
after
string

The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.

limit
integer [ 1 .. 200 ]
Default: 20

A limit on the number of objects to return

Responses
200

OK

403

Forbidden

429

Too Many Requests

get/api/v1/iam/governance/bundles/{bundleId}/entitlements/{entitlementId}/values
Request samples
Response samples
application/json
{}

Retrieve the Admin Console opt-in status
OAuth 2.0 scopes:
  • okta.roles.read

Retrieves the entitlement management opt-in status for the Admin Console

Responses
200

OK

403

Forbidden

429

Too Many Requests

get/api/v1/iam/governance/optIn
Request samples
Response samples
application/json
{}

Opt in the Admin Console to entitlement management
OAuth 2.0 scopes:
  • okta.roles.manage

Opts in the Admin Console to entitlement management

Responses
200

Success

403

Forbidden

429

Too Many Requests

post/api/v1/iam/governance/optIn
Request samples
Response samples
application/json
{}

Opt out the Admin Console from entitlement management
OAuth 2.0 scopes:
  • okta.roles.manage

Opts out the Admin Console from entitlement management

Responses
200

Success

403

Forbidden

429

Too Many Requests

post/api/v1/iam/governance/optOut
Request samples
Response samples
application/json
{}