Security Policy

The Security Policy API provides operations to manage Security Policies for OPA Teams. Security Policies control which User Groups can access resources and any methods they can use to connect. Security Policy operations use several nested objects to correctly define a created policy.

See Security policy.

List all Security Policies

Lists all Security Policies for the current Security Admin

This endpoint requires the following role: security_admin.

SecuritybearerAuth

Request

path Parameters

team_name

required

string

The name of your Team

Responses

200

OK

get/v1/teams/{team_name}/security_policy

Request samples

Response samples

200

application/json

{"list": [{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
"name": "An_OPA_Group",
"type": "user_group"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098",
"name": "Foo",
"type": "server"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
],
"security_policy_id": "string"
}
]
}
]
}

Create a Security Policy

Creates a Security Policy

This endpoint requires the following role: security_admin.

SecuritybearerAuth

Request

path Parameters

team_name

required

string

The name of your Team

Request Body schema: application/json

active

required

boolean

If true, indicates that the Security Policy is active

description

required

string

The description of the Security Policy

name

required

string

The name of the Security Policy

required

object <= 40

The User Groups associated with the Security Policy. Can include multiple Groups.

Array of objects (NamedObject)

The User Groups associated with the Security Policy. Each User Group is defined in a separate object.

Array

id	string The UUID of the object

required

Array of objects (SecurityPolicyRule) <= 30

The rules associated with the Security Policy. A Security Policy can set multiple rules that define privileges available for matching resources.

Array

	Array of objects (Conditions) The conditions required before a privilege is made available to the Principals. All conditions must be met.
name required	string The name of the Security Policy rule
required	Array of objects (Privileges) The specific privileges granted to Principals on matching resources.
required	object (SecurityPolicyRuleResourceSelectors) The selector that defines resources targeted by this Security policy.
resource_type required	string (SecurityPolicyRuleResourceType) The type of resource that Principals are granted privileges to access. Currently only accepts `server_based_resource`. Value: "server_based_resource"

Responses

200

OK

post/v1/teams/{team_name}/security_policy

Request samples

application/json

{"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
]
}
]
}

Response samples

200

application/json

{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
"name": "An_OPA_Group",
"type": "user_group"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098",
"name": "Foo",
"type": "server"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
],
"security_policy_id": "string"
}
]
}

Retrieve a Security Policy

Retrieves the specified Security Policy

This endpoint requires the following role: security_admin.

SecuritybearerAuth

Request

path Parameters

team_name required	string The name of your Team
security_policy_id required	string The UUID of a Security Policy

Responses

200

OK

get/v1/teams/{team_name}/security_policy/{security_policy_id}

Request samples

Response samples

200

application/json

{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155",
"name": "An_OPA_Group",
"type": "user_group"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098",
"name": "Foo",
"type": "server"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
],
"security_policy_id": "string"
}
]
}

Update a Security Policy

Updates the specified Security Policy

This endpoint requires the following role: security_admin.

SecuritybearerAuth

Request

path Parameters

team_name required	string The name of your Team
security_policy_id required	string The UUID of a Security Policy

Request Body schema: application/json

active

required

boolean

If true, indicates that the Security Policy is active

description

required

string

The description of the Security Policy

name

required

string

The name of the Security Policy

required

object <= 40

The User Groups associated with the Security Policy. Can include multiple Groups.

Array of objects (NamedObject)

The User Groups associated with the Security Policy. Each User Group is defined in a separate object.

Array

id	string The UUID of the object

required

Array of objects (SecurityPolicyRule) <= 30

The rules associated with the Security Policy. A Security Policy can set multiple rules that define privileges available for matching resources.

Array

	Array of objects (Conditions) The conditions required before a privilege is made available to the Principals. All conditions must be met.
name required	string The name of the Security Policy rule
required	Array of objects (Privileges) The specific privileges granted to Principals on matching resources.
required	object (SecurityPolicyRuleResourceSelectors) The selector that defines resources targeted by this Security policy.
resource_type required	string (SecurityPolicyRuleResourceType) The type of resource that Principals are granted privileges to access. Currently only accepts `server_based_resource`. Value: "server_based_resource"

Responses

204

No Content

put/v1/teams/{team_name}/security_policy/{security_policy_id}

Request samples

application/json

{"id": "123-456-789",
"name": "SecurityPolicy1",
"description": "string",
"active": true,
"principals": {"user_groups": [{"id": "6c88b11b-b4ad-436b-a69a-c11dy08q7155"
}
]
},
"rules": [{"name": "Rule1",
"resource_type": "server_based_resource",
"resource_selector": {"selectors": [{"selector_type": "individual_server",
"selector": {"server_id": {"id": "145-321-098"
}
}
}
]
},
"privileges": [{"privilege_type": "password_checkout_ssh",
"privilege_value": {"password_checkout_ssh": true
}
},
{"privilege_type": "principal_account_ssh",
"privilege_value": {"principal_account_ssh": true
}
}
],
"conditions": [{"condition_type": "access_request",
"condition_value": {"request_type_id": "641e0d0d71a122005709ca51",
"request_type_name": "New Test",
"expires_after_seconds": 900
}
},
{"condition_type": "gateway",
"condition_value": {"traffic_forwarding": true,
"session_recording": true
}
},
{"condition_type": "mfa",
"condition_value": {"re_auth_frequency_in_seconds": 3600,
"acr_values": "urn:okta:loa:2fa:any"
}
}
]
}
]
}

Delete a Security Policy

Deletes the specified Security Policy

This endpoint requires the following role: security_admin.

SecuritybearerAuth

Request

path Parameters

team_name required	string The name of your Team
security_policy_id required	string The UUID of a Security Policy

Responses

204

No Content

delete/v1/teams/{team_name}/security_policy/{security_policy_id}

Request samples