Security Policy

The Security Policy API provides operations to manage security policies for Okta Privileged Access teams. Security policies control which user groups can access resources and any methods they can use to connect. Security policy operations use several nested objects to correctly define a created policy.

See Security policy.

List all security policies
Admin roles:
security_admin

Lists all security policies

SecuritybearerAuth

Request

path Parameters

team_name

required

string

The name of your team

Responses

200

OK

get/v1/teams/{team_name}/security_policy

Request samples

Response samples

200

application/json

{"list": [{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
"name": "An_OPA_Group",
"type": "user_group"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098",
"name": "Foo",
"type": "server"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
],
"security_policy_id": "string"
}
]
}
]
}

Create a security policy
Admin roles:
security_admin

Creates a security policy

SecuritybearerAuth

Request

path Parameters

team_name

required

string

The name of your team

Request Body schema: application/json

active

required

boolean

If true, indicates that the Security Policy is active

description

string

The description of the Security Policy

name

required

string

The name of the Security Policy

required

object

The User Groups associated with the Security Policy. Can include multiple Groups.

Array of objects (NamedObject) <= 40 items

The User Groups associated with the Security Policy. Each User Group is defined in a separate object.

Array (<= 40 items)

id	string The UUID of the object
missing	boolean Boolean value determining if the named object with the given id is valid or not.

required

Array of objects (SecurityPolicyRule) <= 30 items

The rules associated with the Security Policy. A Security Policy can set multiple rules that define privileges available for matching resources.

Array (<= 30 items)

	Array of objects (Conditions) The conditions required before a privilege is made available to the Principals. All conditions must be met.
name required	string The name of the Security Policy rule
override_checkout_duration_in_seconds	integer or null <int64> [ 900 .. 86400 ] Overrides checkout duration provided in the resource settings
required	Array of objects (Privileges) The specific privileges granted to Principals on matching resources.
required	any
resource_type required	string (SecurityPolicyRuleResourceType) The type of resource that Principals are granted privileges to access. Enum: "active_directory_based_resource" "managed_saas_app_based_resource" "okta_app_based_resource" "secret_based_resource" "server_based_resource" "unmanaged_saas_app_based_resource"

type

string (SecurityPolicyType)

The type of the policy. Determines which resource types are allowed in security policy rules.

'default': Any valid resource type is allowed except 'okta_app_based_resource'
'okta_service_account': Only 'okta_app_based_resource' resource type is allowed. Only users with Okta Super Admin role can create policies of this type.

Enum: "default" "okta_service_account"

Responses

200

OK

post/v1/teams/{team_name}/security_policy

Request samples

application/json

{"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
]
}
]
}

Response samples

200

application/json

{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
"name": "An_OPA_Group",
"type": "user_group"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098",
"name": "Foo",
"type": "server"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
],
"security_policy_id": "string"
}
]
}

Retrieve a security policy
Admin roles:
security_admin

Retrieves the specified security policy.

SecuritybearerAuth

Request

path Parameters

team_name required	string The name of your team
security_policy_id required	string The UUID of a security policy

Responses

200

OK

get/v1/teams/{team_name}/security_policy/{security_policy_id}

Request samples

Response samples

200

application/json

{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
"name": "An_OPA_Group",
"type": "user_group"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098",
"name": "Foo",
"type": "server"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
],
"security_policy_id": "string"
}
]
}

Update a security policy
Admin roles:
security_admin

Updates the specified security policy

SecuritybearerAuth

Request

path Parameters

team_name required	string The name of your team
security_policy_id required	string The UUID of a security policy

Request Body schema: application/json

active

required

boolean

If true, indicates that the Security Policy is active

description

string

The description of the Security Policy

name

required

string

The name of the Security Policy

required

object

The User Groups associated with the Security Policy. Can include multiple Groups.

Array of objects (NamedObject) <= 40 items

The User Groups associated with the Security Policy. Each User Group is defined in a separate object.

Array (<= 40 items)

id	string The UUID of the object
missing	boolean Boolean value determining if the named object with the given id is valid or not.

required

Array of objects (SecurityPolicyRule) <= 30 items

The rules associated with the Security Policy. A Security Policy can set multiple rules that define privileges available for matching resources.

Array (<= 30 items)

	Array of objects (Conditions) The conditions required before a privilege is made available to the Principals. All conditions must be met.
name required	string The name of the Security Policy rule
override_checkout_duration_in_seconds	integer or null <int64> [ 900 .. 86400 ] Overrides checkout duration provided in the resource settings
required	Array of objects (Privileges) The specific privileges granted to Principals on matching resources.
required	any
resource_type required	string (SecurityPolicyRuleResourceType) The type of resource that Principals are granted privileges to access. Enum: "active_directory_based_resource" "managed_saas_app_based_resource" "okta_app_based_resource" "secret_based_resource" "server_based_resource" "unmanaged_saas_app_based_resource"

type

string (SecurityPolicyType)

The type of the policy. Determines which resource types are allowed in security policy rules.

'default': Any valid resource type is allowed except 'okta_app_based_resource'
'okta_service_account': Only 'okta_app_based_resource' resource type is allowed. Only users with Okta Super Admin role can create policies of this type.

Enum: "default" "okta_service_account"

Responses

204

No Content

put/v1/teams/{team_name}/security_policy/{security_policy_id}

Request samples

application/json

{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
]
}
]
}

Delete a security policy
Admin roles:
security_admin

Deletes the specified security policy

SecuritybearerAuth

Request

path Parameters

team_name required	string The name of your team
security_policy_id required	string The UUID of a security policy

Responses

204

No Content

delete/v1/teams/{team_name}/security_policy/{security_policy_id}

Request samples

Security Policy

List all security policiesAdmin roles: security_admin

path Parameters

Create a security policyAdmin roles: security_admin

path Parameters

Request Body schema: application/json

Retrieve a security policyAdmin roles: security_admin

path Parameters

Update a security policyAdmin roles: security_admin

path Parameters

Request Body schema: application/json

Delete a security policyAdmin roles: security_admin

path Parameters

List all security policies
Admin roles:
security_admin

Create a security policy
Admin roles:
security_admin

Retrieve a security policy
Admin roles:
security_admin

Update a security policy
Admin roles:
security_admin

Delete a security policy
Admin roles:
security_admin