---
title: "Create an entitlement"
method: POST
path: "/api/v1/iga/entitlements"
tags: ["accessManagement"]
---

# Create an entitlement

`POST /api/v1/iga/entitlements`

Create a new identity entitlement. Requires app_id and type.
The entitlement can then be associated with policies and granted to users.

## Headers

- `X-Api-Key` string, required
- `X-Workspace-Id` string

## Request body

- object
  - `name` string, required — Name of the entitlement
  - `description` string — Description of the entitlement
  - `app_id` integer, required — ID of the identity resource app this entitlement belongs to
  - `status` 'UNPUBLISHED' | 'PUBLISHED' — Status of the entitlement. Defaults to PUBLISHED if not specified.
  - `provisioning_config` ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfig
    - `provider` 'OKTA' | 'AZURE_AD' | 'MS_INTUNE' | 'JUMPCLOUD' | 'GOOGLE_WORKSPACE' | 'TUEBORA' | 'MANUAL', required — Provisioning provider
    - `type` 'OKTA_GROUP_PROVISIONING' | 'AZURE_GROUP_PROVISIONING' | 'INTUNE_GROUP_PROVISIONING' | 'JUMPCLOUD_GROUP_PROVISIONING' | 'GOOGLE_WORKSPACE_GROUP_PROVISIONING' | 'MANUAL_PROVISIONING', required — Type of provisioning configuration
    - `value` ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValue, required
      - `label` string — Group label/name (for OKTA/AZURE) or Workspace name (for MANUAL)
      - `icon` ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigValueIcon
        - `name` string — Icon name
        - `type` string — Icon type
        - `url` string, nullable — Icon URL (for OKTA/AZURE)
      - `value` string — Group ID (for OKTA/AZURE) or Workspace ID (for MANUAL)
  - `deprovisioning_config` ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig
    - `provider` 'OKTA' | 'AZURE_AD' | 'MS_INTUNE' | 'JUMPCLOUD' | 'GOOGLE_WORKSPACE' | 'TUEBORA' | 'MANUAL', required — Deprovisioning provider
    - `type` 'OKTA_GROUP_DEPROVISIONING' | 'AZURE_GROUP_DEPROVISIONING' | 'INTUNE_GROUP_DEPROVISIONING' | 'JUMPCLOUD_GROUP_DEPROVISIONING' | 'GOOGLE_WORKSPACE_GROUP_DEPROVISIONING' | 'MANUAL_DEPROVISIONING', required — Type of deprovisioning configuration
    - `value` ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValue, required
      - `value` string — Group ID (for OKTA/AZURE) or Workspace ID (for MANUAL)
      - `label` string — Group label/name (for OKTA/AZURE) or Workspace name (for MANUAL)
      - `icon` ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValueIcon
        - `name` string — Icon name
        - `type` string — Icon type
        - `url` string, nullable — Icon URL (for OKTA/AZURE)

## Response `200`

Successful response

- AccessManagementPostapiV1IgaEntitlementsResponse200 — Empty response body

---

[API](https://skmtc.net/atomicwork/apis/atomicwork-public-api.md) · [All operations](https://skmtc.net/atomicwork/apis/atomicwork-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/atomicwork/atomicwork-public-api/revisions/2e7047b35062/schema)