The Security Policy API provides operations to manage Security Policies for OPA Teams. Security Policies control which User Groups can access resources and any methods they can use to connect. Security Policy operations use several nested objects to correctly define a created policy.
See Security policy.
Lists all Security Policies for the current Security Admin
This endpoint requires the following role: security_admin
.
OK
{- "list": [
- {
- "id": "123-456-789",
- "name": "SecurityPolicy1",
- "description": "string",
- "active": true,
- "principals": {
- "user_groups": [
- {
- "id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
- "name": "An_OPA_Group",
- "type": "user_group"
}
]
}, - "rules": [
- {
- "name": "Rule1",
- "resource_type": "server_based_resource",
- "resource_selector": {
- "selectors": [
- {
- "selector_type": "individual_server",
- "selector": {
- "server_id": {
- "id": "145-321-098",
- "name": "Foo",
- "type": "server"
}
}
}
]
}, - "privileges": [
- {
- "privilege_type": "password_checkout_ssh",
- "privilege_value": {
- "password_checkout_ssh": true
}
}, - {
- "privilege_type": "principal_account_ssh",
- "privilege_value": {
- "principal_account_ssh": true
}
}
], - "conditions": [
- {
- "condition_type": "access_request",
- "condition_value": {
- "request_type_id": "641e0d0d71a122005709ca51",
- "request_type_name": "New Test",
- "expires_after_seconds": 900
}
}, - {
- "condition_type": "gateway",
- "condition_value": {
- "traffic_forwarding": true,
- "session_recording": true
}
}, - {
- "condition_type": "mfa",
- "condition_value": {
- "re_auth_frequency_in_seconds": 3600,
- "acr_values": "urn:okta:loa:2fa:any"
}
}
], - "security_policy_id": "string"
}
]
}
]
}
Creates a Security Policy
This endpoint requires the following role: security_admin
.
OK
{- "name": "SecurityPolicy1",
- "description": "string",
- "active": true,
- "principals": {
- "user_groups": [
- {
- "id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155"
}
]
}, - "rules": [
- {
- "name": "Rule1",
- "resource_type": "server_based_resource",
- "resource_selector": {
- "selectors": [
- {
- "selector_type": "individual_server",
- "selector": {
- "server_id": {
- "id": "145-321-098"
}
}
}
]
}, - "privileges": [
- {
- "privilege_type": "password_checkout_ssh",
- "privilege_value": {
- "password_checkout_ssh": true
}
}, - {
- "privilege_type": "principal_account_ssh",
- "privilege_value": {
- "principal_account_ssh": true
}
}
], - "conditions": [
- {
- "condition_type": "access_request",
- "condition_value": {
- "request_type_id": "641e0d0d71a122005709ca51",
- "request_type_name": "New Test",
- "expires_after_seconds": 900
}
}, - {
- "condition_type": "gateway",
- "condition_value": {
- "traffic_forwarding": true,
- "session_recording": true
}
}, - {
- "condition_type": "mfa",
- "condition_value": {
- "re_auth_frequency_in_seconds": 3600,
- "acr_values": "urn:okta:loa:2fa:any"
}
}
]
}
]
}
{- "id": "123-456-789",
- "name": "SecurityPolicy1",
- "description": "string",
- "active": true,
- "principals": {
- "user_groups": [
- {
- "id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
- "name": "An_OPA_Group",
- "type": "user_group"
}
]
}, - "rules": [
- {
- "name": "Rule1",
- "resource_type": "server_based_resource",
- "resource_selector": {
- "selectors": [
- {
- "selector_type": "individual_server",
- "selector": {
- "server_id": {
- "id": "145-321-098",
- "name": "Foo",
- "type": "server"
}
}
}
]
}, - "privileges": [
- {
- "privilege_type": "password_checkout_ssh",
- "privilege_value": {
- "password_checkout_ssh": true
}
}, - {
- "privilege_type": "principal_account_ssh",
- "privilege_value": {
- "principal_account_ssh": true
}
}
], - "conditions": [
- {
- "condition_type": "access_request",
- "condition_value": {
- "request_type_id": "641e0d0d71a122005709ca51",
- "request_type_name": "New Test",
- "expires_after_seconds": 900
}
}, - {
- "condition_type": "gateway",
- "condition_value": {
- "traffic_forwarding": true,
- "session_recording": true
}
}, - {
- "condition_type": "mfa",
- "condition_value": {
- "re_auth_frequency_in_seconds": 3600,
- "acr_values": "urn:okta:loa:2fa:any"
}
}
], - "security_policy_id": "string"
}
]
}
Retrieves the specified Security Policy
This endpoint requires the following role: security_admin
.
OK
{- "id": "123-456-789",
- "name": "SecurityPolicy1",
- "description": "string",
- "active": true,
- "principals": {
- "user_groups": [
- {
- "id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
- "name": "An_OPA_Group",
- "type": "user_group"
}
]
}, - "rules": [
- {
- "name": "Rule1",
- "resource_type": "server_based_resource",
- "resource_selector": {
- "selectors": [
- {
- "selector_type": "individual_server",
- "selector": {
- "server_id": {
- "id": "145-321-098",
- "name": "Foo",
- "type": "server"
}
}
}
]
}, - "privileges": [
- {
- "privilege_type": "password_checkout_ssh",
- "privilege_value": {
- "password_checkout_ssh": true
}
}, - {
- "privilege_type": "principal_account_ssh",
- "privilege_value": {
- "principal_account_ssh": true
}
}
], - "conditions": [
- {
- "condition_type": "access_request",
- "condition_value": {
- "request_type_id": "641e0d0d71a122005709ca51",
- "request_type_name": "New Test",
- "expires_after_seconds": 900
}
}, - {
- "condition_type": "gateway",
- "condition_value": {
- "traffic_forwarding": true,
- "session_recording": true
}
}, - {
- "condition_type": "mfa",
- "condition_value": {
- "re_auth_frequency_in_seconds": 3600,
- "acr_values": "urn:okta:loa:2fa:any"
}
}
], - "security_policy_id": "string"
}
]
}
Updates the specified Security Policy
This endpoint requires the following role: security_admin
.
active required | boolean If | ||||||||||
description required | string The description of the Security Policy | ||||||||||
name required | string The name of the Security Policy | ||||||||||
required | object <= 40 The User Groups associated with the Security Policy. Can include multiple Groups. | ||||||||||
required | Array of objects (SecurityPolicyRule) <= 30 The rules associated with the Security Policy. A Security Policy can set multiple rules that define privileges available for matching resources. | ||||||||||
Array
|
No Content
{- "id": "123-456-789",
- "name": "SecurityPolicy1",
- "description": "string",
- "active": true,
- "principals": {
- "user_groups": [
- {
- "id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155"
}
]
}, - "rules": [
- {
- "name": "Rule1",
- "resource_type": "server_based_resource",
- "resource_selector": {
- "selectors": [
- {
- "selector_type": "individual_server",
- "selector": {
- "server_id": {
- "id": "145-321-098"
}
}
}
]
}, - "privileges": [
- {
- "privilege_type": "password_checkout_ssh",
- "privilege_value": {
- "password_checkout_ssh": true
}
}, - {
- "privilege_type": "principal_account_ssh",
- "privilege_value": {
- "principal_account_ssh": true
}
}
], - "conditions": [
- {
- "condition_type": "access_request",
- "condition_value": {
- "request_type_id": "641e0d0d71a122005709ca51",
- "request_type_name": "New Test",
- "expires_after_seconds": 900
}
}, - {
- "condition_type": "gateway",
- "condition_value": {
- "traffic_forwarding": true,
- "session_recording": true
}
}, - {
- "condition_type": "mfa",
- "condition_value": {
- "re_auth_frequency_in_seconds": 3600,
- "acr_values": "urn:okta:loa:2fa:any"
}
}
]
}
]
}