--- title: "Create Offboarding Task" method: POST path: "/api/v1/task/offboarding" tags: ["Task"] --- # Create Offboarding Task `POST /api/v1/task/offboarding` Create an offboarding task to remove a user's access across applications. ## Request body - C1ApiTaskV1TaskServiceCreateOffboardingRequest — Create an offboarding task. - `description` string — The description of the offboarding request. - `expandMask` C1ApiTaskV1TaskExpandMask — The task expand mask is an array of strings that specifes the related objects the requester wishes to have returned when making a request where the expand mask is part of the input. Use '*' to view all possible responses. - `paths` string[], nullable — A list of paths to expand in the response. May be any combination of "*", "access_review_id", "user_id", "created_by_user_id", "app_id", "app_user_id", "app_entitlement_ids", "step_approver_ids", "approver_ids", "identity_user_id", "insight_ids", "app_user_last_usage", "entitlement_scope_bindings", and "scope_role_resources". - `subjectUserId` string — The ID of the user to offboard. ## Response `200` The TaskServiceCreateOffboardingResponse returns the created offboarding task with optional expanded related objects. - C1ApiTaskV1TaskServiceCreateOffboardingResponse — The TaskServiceCreateOffboardingResponse returns the created offboarding task with optional expanded related objects. - `expanded` object[], nullable — List of serialized related objects. - `@type` string — The type of the serialized message. - `taskView` C1ApiTaskV1TaskView — Contains a task and JSONPATH expressions that describe where in the expanded array related objects are located. This view can be used to display a fully-detailed dashboard of task information. - `accessReviewPath` string — JSONPATH expression indicating the location of the AccessReview object in the expanded array - `appPath` string — JSONPATH expression indicating the location of the App object in the expanded array - `appUserLastUsagePath` string — JSONPATH expression indicating the location of the AppUser last usage timestamp in the expanded array - `appUserPath` string — JSONPATH expression indicating the location of the AppUser object in the expanded array - `approversPath` string — JSONPATH expression indicating the location of the ApproverUsers objects in the expanded array. These are the users who have approved or denied this task. - `createdByUserPath` string — JSONPATH expression indicating the location of the object of the User that created the ticket in the expanded array - `entitlementsPath` string — JSONPATH expression indicating the location of the Entitlements objects in the expanded array - `identityUserPath` string — JSONPATH expression indicating the location of the User object of the User that this task is targeting in the expanded array. This is the user that is the identity when the target of a task is an app user. - `insightsPath` string — JSONPATH expression indicating the location of the Insights objects in the expanded array - `resourceBindingsPath` string — JSONPATH expression indicating the location of the EntitlementScopeBindingList object in the expanded array. - `roleResourcePath` string — JSONPATH expression indicating the location of the role AppResource for a scope-role action task in the expanded array. - `scopeResourcePath` string — JSONPATH expression indicating the location of the scope AppResource for a scope-role action task in the expanded array. - `stepApproversPath` string — JSONPATH expression indicating the location of the StepApproverUsers objects in the expanded array - `task` C1ApiTaskV1Task — A fully-fleged task object. Includes its policy, references to external apps, its type, its processing history, and more. - `actions` string[], nullable — The actions that can be performed on the task by the current user. - `analysisId` string — The ID of the analysis object associated with this task created by an analysis workflow if the analysis feature is enabled for your tenant. - `annotations` object[], nullable — An array of `google.protobuf.Any` annotations with various base64-encoded data. - `@type` string — The type of the serialized message. - `approverIds` string[], nullable — An array of IDs belonging to Identity Users that have approved or denied any step in this task. - `commentCount` integer — The count of comments. - `createdAt` string, date-time - `createdByUserId` string — The ID of the user that is the creator of this task. This may not always match the userId field. - `data` object - `deletedAt` string, date-time - `description` string — The description of the task. This is also known as justification. - `displayName` string — The display name of the task. - `emergencyAccess` boolean — A field indicating whether this task was created using an emergency access flow, or escalated to emergency access. On task creation, it will also use the app entitlement's emergency policy when possible. - `externalRefs` C1ApiTaskV1ExternalRef[], nullable — An array of external references to the task. Historically that has been items like Jira task IDs. This is currently unused, but may come back in the future for integrations. - `externalRefSource` 'UNSPECIFIED' | 'JIRA' — The source of the external reference. - `name` string — The name of the external reference. - `url` string — The URL to the external reference. - `form` C1ApiFormV1Form — A form is a collection of fields to be filled out by a user - `description` string — The description field. - `displayName` string — The displayName field. - `fieldGroups` C1ApiFormV1FieldGroup[], nullable — The fieldGroups field. - `default` boolean — The default field. - `displayName` string — The displayName field. - `fields` string[], nullable — The fields field. - `helpText` string — The helpText field. - `name` string — The name field. - `fieldRelationships` C1ApiFormV1FieldRelationship[], nullable — The fieldRelationships field. - `atLeastOne` C1ApiFormV1AtLeastOne, nullable — The AtLeastOne message. - `dependentOn` C1ApiFormV1DependentOn, nullable — DependentOn means the fields in field_names are only valid if all fields in dependency_field_names are also present - `dependencyFieldNames` string[], nullable — The fields that must be present for the primary field_names to be valid - `fieldNames` string[], nullable — The names of the fields that share this relationship - `mutuallyExclusive` C1ApiFormV1MutuallyExclusive, nullable — The MutuallyExclusive message. - `requiredTogether` C1ApiFormV1RequiredTogether, nullable — The RequiredTogether message. - `fields` C1ApiFormV1Field[], nullable — The fields field. - `adminConfig` C1ApiFormV1AdminProviderConfig, nullable — The AdminProviderConfig message. - `defaultValueCel` string — The defaultValueCel field. - `showToUser` boolean — The showToUser field. - `boolField` C1ApiFormV1BoolField, nullable — The BoolField message. This message contains a oneof named view. Only a single field of the following list may be set at a time: - checkboxField - toggleField - `checkboxField` C1ApiFormV1CheckboxField, nullable — The CheckboxField message. - `defaultValue` boolean — The defaultValue field. - `rules` ValidateBoolRules, nullable — BoolRules describes the constraints applied to `bool` values - … - `toggleField` C1ApiFormV1ToggleField, nullable — The ToggleField message. - `description` string — The description field. - `displayName` string — The displayName field. - `fileField` C1ApiFormV1FileField, nullable — The FileField message. This message contains a oneof named view. Only a single field of the following list may be set at a time: - fileInputField - `acceptedFileTypes` string[], nullable — The acceptedFileTypes field. - `fileInputField` C1ApiFormV1FileInputField, nullable — The FileInputField message. - `maxFileSize` string, int64, nullable — The maxFileSize field. - `int64Field` C1ApiFormV1Int64Field, nullable — The Int64Field message. This message contains a oneof named view. Only a single field of the following list may be set at a time: - numberField - `defaultValue` string, int64, nullable — The defaultValue field. - `numberField` C1ApiFormV1NumberField, nullable — The NumberField message. - … - `placeholder` string — The placeholder field. - `rules` ValidateInt64Rules, nullable — Int64Rules describes the constraints applied to `int64` values - … - `name` string — The name field. - `oauth2Field` C1ApiFormV1Oauth2Field, nullable — The Oauth2Field message. This message contains a oneof named view. Only a single field of the following list may be set at a time: - oauth2FieldView - `oauth2FieldView` C1ApiFormV1Oauth2FieldView, nullable — The Oauth2FieldView message. - `readOnly` boolean — When true, this field is displayed to the user but cannot be edited. - `required` boolean — The required field. - `sharedConfig` C1ApiFormV1SharedProviderConfig, nullable — The SharedProviderConfig message. - `defaultValueCel` string — The defaultValueCel field. - `inputTransformationCel` string — The inputTransformationCel field. - `lockDefaultValues` boolean — The lockDefaultValues field. - `stringField` C1ApiFormV1StringField, nullable — The StringField message. This message contains a oneof named view. Only a single field of the following list may be set at a time: - textField - passwordField - selectField - pickerField - `defaultValue` string — The defaultValue field. - `passwordField` C1ApiFormV1PasswordField, nullable — The PasswordField message. - `pickerField` C1ApiFormV1PickerField, nullable — The PickerField message. This message contains a oneof named type. Only a single field of the following list may be set at a time: - appUserPicker - resourcePicker - c1UserPicker - … - `placeholder` string — The placeholder field. - `rules` ValidateStringRules, nullable — StringRules describe the constraints applied to `string` values This message contains a oneof named well_known. Only a single field of the following list may be set at a time: - email - hostname - ip - ipv4 - ipv6 - uri - uriRef - address - uuid - wellKnownRegex - … - `selectField` C1ApiFormV1SelectField, nullable — The SelectField message. - … - `textField` C1ApiFormV1TextField, nullable — The TextField message. - … - `stringMapField` C1ApiFormV1StringMapField, nullable — The StringMapField message. - `defaultValue` object — The defaultValue field. - `rules` C1ApiFormV1StringMapRules, nullable — The StringMapRules message. - … - `stringSliceField` C1ApiFormV1StringSliceField, nullable — The StringSliceField message. This message contains a oneof named view. Only a single field of the following list may be set at a time: - chipsField - pickerField - `chipsField` C1ApiFormV1ChipsField, nullable — The ChipsField message. - `defaultValues` string[], nullable — The defaultValues field. - `pickerField` C1ApiFormV1PickerField, nullable — The PickerField message. This message contains a oneof named type. Only a single field of the following list may be set at a time: - appUserPicker - resourcePicker - c1UserPicker - … - `placeholder` string — The placeholder field. - `rules` ValidateRepeatedRules, nullable — RepeatedRules describe the constraints applied to `repeated` values - … - `userConfig` C1ApiFormV1UserProviderConfig, nullable — The UserProviderConfig message. - `inputTransformationCel` string — The inputTransformationCel field. - `id` string — The id field. - `id` string — The ID of the task. - `insightIds` string[], nullable — The insightIds field. - `numericId` string, int64 — A human-usable numeric ID of a task which can be included in place of the fully qualified task id in path parmeters (but not search queries). - `origin` 'TASK_ORIGIN_UNSPECIFIED' | 'TASK_ORIGIN_PROFILE_MEMBERSHIP_AUTOMATION' | 'TASK_ORIGIN_SLACK' | 'TASK_ORIGIN_API' | 'TASK_ORIGIN_JIRA' | 'TASK_ORIGIN_COPILOT' | 'TASK_ORIGIN_WEBAPP' | 'TASK_ORIGIN_TIME_REVOKE' | 'TASK_ORIGIN_NON_USAGE_REVOKE' | 'TASK_ORIGIN_PROFILE_MEMBERSHIP_MANUAL' | 'TASK_ORIGIN_PROFILE_MEMBERSHIP' | 'TASK_ORIGIN_AUTOMATION' | 'TASK_ORIGIN_ACCESS_REVIEW' | 'TASK_ORIGIN_CASCADE_DELETE' — The origin field. - `policy` C1ApiPolicyV1PolicyInstance — A policy instance is an object that contains a reference to the policy it was created from, the currently executing step, the next steps, and the history of previously completed steps. - `current` C1ApiPolicyV1PolicyStepInstance — The policy step instance includes a reference to an instance of a policy step that tracks state and has a unique ID. This message contains a oneof named instance. Only a single field of the following list may be set at a time: - approval - provision - accept - reject - wait - form - action - `accept` C1ApiPolicyV1AcceptInstance, nullable — This policy step indicates that a ticket should have an approved outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy. - `acceptMessage` string — An optional message to include in the comments when a task is automatically accepted. - `action` C1ApiPolicyV1ActionInstance, nullable — The ActionInstance message. This message contains a oneof named target_instance. Only a single field of the following list may be set at a time: - automation - batonResourceActionInstance - clientIdApprovalInstance This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - success - denied - error - cancelled - `action` C1ApiPolicyV1Action, nullable — The Action message. This message contains a oneof named target. Only a single field of the following list may be set at a time: - automation - batonResourceAction - clientIdApproval - … - `automation` C1ApiPolicyV1ActionTargetAutomationInstance, nullable — The ActionTargetAutomationInstance message. - … - `batonResourceActionInstance` C1ApiPolicyV1ActionTargetBatonResourceActionInstance, nullable — The ActionTargetBatonResourceActionInstance message. - … - `cancelled` C1ApiPolicyV1ActionOutcomeCancelled, nullable — The ActionOutcomeCancelled message. - … - `clientIdApprovalInstance` C1ApiPolicyV1ActionTargetClientIdApprovalInstance, nullable — ActionTargetClientIdApprovalInstance carries the registration key of the external OAuth client that is being reviewed. - … - `denied` C1ApiPolicyV1ActionOutcomeDenied, nullable — The ActionOutcomeDenied message. - … - `error` C1ApiPolicyV1ActionOutcomeError, nullable — The ActionOutcomeError message. - … - `state` 'ACTION_INSTANCE_STATE_UNSPECIFIED' | 'ACTION_INSTANCE_STATE_INIT' | 'ACTION_INSTANCE_STATE_RUNNING' | 'ACTION_INSTANCE_STATE_DONE' | 'ACTION_INSTANCE_STATE_ERROR' — The current state of the action execution. - `success` C1ApiPolicyV1ActionOutcomeSuccess, nullable — The ActionOutcomeSuccess message. - … - `approval` C1ApiPolicyV1ApprovalInstance, nullable — The approval instance object describes the way a policy step should be approved as well as its outcomes and state. This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - approved - denied - reassigned - restarted - reassignedByError - skipped - `approval` C1ApiPolicyV1Approval, nullable — The Approval message. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - manager - appOwners - group - self - entitlementOwners - expression - webhook - resourceOwners - agent - … - `approved` C1ApiPolicyV1ApprovedAction, nullable — The approved action indicates that the approvalinstance had an outcome of approved. - … - `assignedAt` string, date-time - `denied` C1ApiPolicyV1DeniedAction, nullable — The denied action indicates that the c1.api.policy.v1.ApprovalInstance had an outcome of denied. - … - `escalationInstance` C1ApiPolicyV1EscalationInstance — The EscalationInstance message. This message contains a oneof named escalation_policy. Only a single field of the following list may be set at a time: - replacePolicy - reassignToApprovers - cancelTicket - skipStep - … - `reassigned` C1ApiPolicyV1ReassignedAction, nullable — The ReassignedAction object describes the outcome of a policy step that has been reassigned. - … - `reassignedByError` C1ApiPolicyV1ReassignedByErrorAction, nullable — The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning. - … - `restarted` C1ApiPolicyV1RestartAction, nullable — The restart action describes the outcome of policy steps for when the task was restarted. This can be applied to multiple steps since restart skips all pending next steps. - … - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `state` 'APPROVAL_INSTANCE_STATE_UNSPECIFIED' | 'APPROVAL_INSTANCE_STATE_INIT' | 'APPROVAL_INSTANCE_STATE_SENDING_NOTIFICATIONS' | 'APPROVAL_INSTANCE_STATE_WAITING' | 'APPROVAL_INSTANCE_STATE_DONE' — The state of the approval instance - `form` C1ApiPolicyV1FormInstance, nullable — The FormInstance message. This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - completed - restarted - reassigned - skipped - `completed` C1ApiPolicyV1FormCompletedAction, nullable — The FormCompletedAction message. - … - `data` object - `form` C1ApiFormV1Form — A form is a collection of fields to be filled out by a user - … - `reassigned` C1ApiPolicyV1ReassignedAction, nullable — The ReassignedAction object describes the outcome of a policy step that has been reassigned. - … - `restarted` C1ApiPolicyV1RestartAction, nullable — The restart action describes the outcome of policy steps for when the task was restarted. This can be applied to multiple steps since restart skips all pending next steps. - … - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `state` 'FORM_INSTANCE_STATE_UNSPECIFIED' | 'FORM_INSTANCE_STATE_WAITING' | 'FORM_INSTANCE_STATE_DONE' — The state field. - `id` string — The ID of the PolicyStepInstance. This is required by many action submission endpoints to indicate what step you're approving. - `policyGenerationId` string — The policy generation id refers to the version of the policy that this step was created from. - `provision` C1ApiPolicyV1ProvisionInstance, nullable — A provision instance describes the specific configuration of an executing provision policy step including actions taken and notification id. This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - completed - cancelled - errored - reassignedByError - skipped - `batonActionInvocationId` string — This indicates the account lifecycle action id for this step. - `cancelled` C1ApiPolicyV1CancelledAction, nullable — The outcome of a provision instance that is cancelled. - … - `completed` C1ApiPolicyV1CompletedAction, nullable — The outcome of a provision instance that has been completed succesfully. - … - `errored` C1ApiPolicyV1ErroredAction, nullable — The outcome of a provision instance that has errored. - … - `externalTicketId` string — This indicates the external ticket id for this step. - `externalTicketProvisionerConfigId` string — This indicates the external ticket provisioner config id for this step. - `notificationId` string — This indicates the notification id for this step. - `provision` C1ApiPolicyV1Provision, nullable — The provision step references a provision policy for this step. - … - `reassignedByError` C1ApiPolicyV1ReassignedByErrorAction, nullable — The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning. - … - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `state` 'PROVISION_INSTANCE_STATE_UNSPECIFIED' | 'PROVISION_INSTANCE_STATE_INIT' | 'PROVISION_INSTANCE_STATE_CREATE_CONNECTOR_ACTIONS_FOR_TARGET' | 'PROVISION_INSTANCE_STATE_SENDING_NOTIFICATIONS' | 'PROVISION_INSTANCE_STATE_WAITING' | 'PROVISION_INSTANCE_STATE_WEBHOOK' | 'PROVISION_INSTANCE_STATE_WEBHOOK_WAITING' | 'PROVISION_INSTANCE_STATE_EXTERNAL_TICKET' | 'PROVISION_INSTANCE_STATE_EXTERNAL_TICKET_WAITING' | 'PROVISION_INSTANCE_STATE_ACCOUNT_LIFECYCLE_ACTIONS' | 'PROVISION_INSTANCE_STATE_ACCOUNT_LIFECYCLE_ACTIONS_WAITING' | 'PROVISION_INSTANCE_STATE_DONE' — This property indicates the current state of this step. - `webhookId` string — This indicates the webhook id for this step. - `webhookInstanceId` string — This indicates the webhook instance id for this step. - `reject` C1ApiPolicyV1RejectInstance, nullable — This policy step indicates that a ticket should have a denied outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy. - `rejectMessage` string — An optional message to include in the comments when a task is automatically rejected. - `state` 'POLICY_STEP_STATE_UNSPECIFIED' | 'POLICY_STEP_STATE_ACTIVE' | 'POLICY_STEP_STATE_DONE' — The state of the step, which is either active or done. - `wait` C1ApiPolicyV1WaitInstance, nullable — Used by the policy engine to describe an instantiated wait step. This message contains a oneof named until. Only a single field of the following list may be set at a time: - condition - untilTime This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - succeeded - timedOut - skipped - `commentOnFirstWait` string — The comment to post on first failed check. - `commentOnTimeout` string — The comment to post if we timeout. - `condition` C1ApiPolicyV1WaitConditionInstance, nullable — Used by the policy engine to describe an instantiated condition to wait on. - … - `name` string — The name field. - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `startedWaitingAt` string, date-time - `state` 'WAIT_INSTANCE_STATE_UNSPECIFIED' | 'WAIT_INSTANCE_STATE_WAITING' | 'WAIT_INSTANCE_STATE_COMPLETED' | 'WAIT_INSTANCE_STATE_TIMED_OUT' — The state field. - `succeeded` C1ApiPolicyV1WaitInstanceConditionSucceeded, nullable — The ConditionSucceeded message. - … - `timedOut` C1ApiPolicyV1WaitInstanceConditionTimedOut, nullable — The ConditionTimedOut message. - … - `timeout` string, date-time - `timeoutDuration` string, duration - `untilTime` C1ApiPolicyV1WaitUntilTimeInstance, nullable — The WaitUntilTimeInstance message. - … - `history` C1ApiPolicyV1PolicyStepInstance[], nullable — An array of steps that were previously processed by the ticket with their outcomes set, in order. - `accept` C1ApiPolicyV1AcceptInstance, nullable — This policy step indicates that a ticket should have an approved outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy. - `acceptMessage` string — An optional message to include in the comments when a task is automatically accepted. - `action` C1ApiPolicyV1ActionInstance, nullable — The ActionInstance message. This message contains a oneof named target_instance. Only a single field of the following list may be set at a time: - automation - batonResourceActionInstance - clientIdApprovalInstance This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - success - denied - error - cancelled - `action` C1ApiPolicyV1Action, nullable — The Action message. This message contains a oneof named target. Only a single field of the following list may be set at a time: - automation - batonResourceAction - clientIdApproval - … - `automation` C1ApiPolicyV1ActionTargetAutomationInstance, nullable — The ActionTargetAutomationInstance message. - … - `batonResourceActionInstance` C1ApiPolicyV1ActionTargetBatonResourceActionInstance, nullable — The ActionTargetBatonResourceActionInstance message. - … - `cancelled` C1ApiPolicyV1ActionOutcomeCancelled, nullable — The ActionOutcomeCancelled message. - … - `clientIdApprovalInstance` C1ApiPolicyV1ActionTargetClientIdApprovalInstance, nullable — ActionTargetClientIdApprovalInstance carries the registration key of the external OAuth client that is being reviewed. - … - `denied` C1ApiPolicyV1ActionOutcomeDenied, nullable — The ActionOutcomeDenied message. - … - `error` C1ApiPolicyV1ActionOutcomeError, nullable — The ActionOutcomeError message. - … - `state` 'ACTION_INSTANCE_STATE_UNSPECIFIED' | 'ACTION_INSTANCE_STATE_INIT' | 'ACTION_INSTANCE_STATE_RUNNING' | 'ACTION_INSTANCE_STATE_DONE' | 'ACTION_INSTANCE_STATE_ERROR' — The current state of the action execution. - `success` C1ApiPolicyV1ActionOutcomeSuccess, nullable — The ActionOutcomeSuccess message. - … - `approval` C1ApiPolicyV1ApprovalInstance, nullable — The approval instance object describes the way a policy step should be approved as well as its outcomes and state. This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - approved - denied - reassigned - restarted - reassignedByError - skipped - `approval` C1ApiPolicyV1Approval, nullable — The Approval message. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - manager - appOwners - group - self - entitlementOwners - expression - webhook - resourceOwners - agent - … - `approved` C1ApiPolicyV1ApprovedAction, nullable — The approved action indicates that the approvalinstance had an outcome of approved. - … - `assignedAt` string, date-time - `denied` C1ApiPolicyV1DeniedAction, nullable — The denied action indicates that the c1.api.policy.v1.ApprovalInstance had an outcome of denied. - … - `escalationInstance` C1ApiPolicyV1EscalationInstance — The EscalationInstance message. This message contains a oneof named escalation_policy. Only a single field of the following list may be set at a time: - replacePolicy - reassignToApprovers - cancelTicket - skipStep - … - `reassigned` C1ApiPolicyV1ReassignedAction, nullable — The ReassignedAction object describes the outcome of a policy step that has been reassigned. - … - `reassignedByError` C1ApiPolicyV1ReassignedByErrorAction, nullable — The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning. - … - `restarted` C1ApiPolicyV1RestartAction, nullable — The restart action describes the outcome of policy steps for when the task was restarted. This can be applied to multiple steps since restart skips all pending next steps. - … - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `state` 'APPROVAL_INSTANCE_STATE_UNSPECIFIED' | 'APPROVAL_INSTANCE_STATE_INIT' | 'APPROVAL_INSTANCE_STATE_SENDING_NOTIFICATIONS' | 'APPROVAL_INSTANCE_STATE_WAITING' | 'APPROVAL_INSTANCE_STATE_DONE' — The state of the approval instance - `form` C1ApiPolicyV1FormInstance, nullable — The FormInstance message. This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - completed - restarted - reassigned - skipped - `completed` C1ApiPolicyV1FormCompletedAction, nullable — The FormCompletedAction message. - … - `data` object - `form` C1ApiFormV1Form — A form is a collection of fields to be filled out by a user - … - `reassigned` C1ApiPolicyV1ReassignedAction, nullable — The ReassignedAction object describes the outcome of a policy step that has been reassigned. - … - `restarted` C1ApiPolicyV1RestartAction, nullable — The restart action describes the outcome of policy steps for when the task was restarted. This can be applied to multiple steps since restart skips all pending next steps. - … - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `state` 'FORM_INSTANCE_STATE_UNSPECIFIED' | 'FORM_INSTANCE_STATE_WAITING' | 'FORM_INSTANCE_STATE_DONE' — The state field. - `id` string — The ID of the PolicyStepInstance. This is required by many action submission endpoints to indicate what step you're approving. - `policyGenerationId` string — The policy generation id refers to the version of the policy that this step was created from. - `provision` C1ApiPolicyV1ProvisionInstance, nullable — A provision instance describes the specific configuration of an executing provision policy step including actions taken and notification id. This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - completed - cancelled - errored - reassignedByError - skipped - `batonActionInvocationId` string — This indicates the account lifecycle action id for this step. - `cancelled` C1ApiPolicyV1CancelledAction, nullable — The outcome of a provision instance that is cancelled. - … - `completed` C1ApiPolicyV1CompletedAction, nullable — The outcome of a provision instance that has been completed succesfully. - … - `errored` C1ApiPolicyV1ErroredAction, nullable — The outcome of a provision instance that has errored. - … - `externalTicketId` string — This indicates the external ticket id for this step. - `externalTicketProvisionerConfigId` string — This indicates the external ticket provisioner config id for this step. - `notificationId` string — This indicates the notification id for this step. - `provision` C1ApiPolicyV1Provision, nullable — The provision step references a provision policy for this step. - … - `reassignedByError` C1ApiPolicyV1ReassignedByErrorAction, nullable — The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning. - … - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `state` 'PROVISION_INSTANCE_STATE_UNSPECIFIED' | 'PROVISION_INSTANCE_STATE_INIT' | 'PROVISION_INSTANCE_STATE_CREATE_CONNECTOR_ACTIONS_FOR_TARGET' | 'PROVISION_INSTANCE_STATE_SENDING_NOTIFICATIONS' | 'PROVISION_INSTANCE_STATE_WAITING' | 'PROVISION_INSTANCE_STATE_WEBHOOK' | 'PROVISION_INSTANCE_STATE_WEBHOOK_WAITING' | 'PROVISION_INSTANCE_STATE_EXTERNAL_TICKET' | 'PROVISION_INSTANCE_STATE_EXTERNAL_TICKET_WAITING' | 'PROVISION_INSTANCE_STATE_ACCOUNT_LIFECYCLE_ACTIONS' | 'PROVISION_INSTANCE_STATE_ACCOUNT_LIFECYCLE_ACTIONS_WAITING' | 'PROVISION_INSTANCE_STATE_DONE' — This property indicates the current state of this step. - `webhookId` string — This indicates the webhook id for this step. - `webhookInstanceId` string — This indicates the webhook instance id for this step. - `reject` C1ApiPolicyV1RejectInstance, nullable — This policy step indicates that a ticket should have a denied outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy. - `rejectMessage` string — An optional message to include in the comments when a task is automatically rejected. - `state` 'POLICY_STEP_STATE_UNSPECIFIED' | 'POLICY_STEP_STATE_ACTIVE' | 'POLICY_STEP_STATE_DONE' — The state of the step, which is either active or done. - `wait` C1ApiPolicyV1WaitInstance, nullable — Used by the policy engine to describe an instantiated wait step. This message contains a oneof named until. Only a single field of the following list may be set at a time: - condition - untilTime This message contains a oneof named outcome. Only a single field of the following list may be set at a time: - succeeded - timedOut - skipped - `commentOnFirstWait` string — The comment to post on first failed check. - `commentOnTimeout` string — The comment to post if we timeout. - `condition` C1ApiPolicyV1WaitConditionInstance, nullable — Used by the policy engine to describe an instantiated condition to wait on. - … - `name` string — The name field. - `skipped` C1ApiPolicyV1SkippedAction, nullable — The SkippedAction object describes the outcome of a policy step that has been skipped. - … - `startedWaitingAt` string, date-time - `state` 'WAIT_INSTANCE_STATE_UNSPECIFIED' | 'WAIT_INSTANCE_STATE_WAITING' | 'WAIT_INSTANCE_STATE_COMPLETED' | 'WAIT_INSTANCE_STATE_TIMED_OUT' — The state field. - `succeeded` C1ApiPolicyV1WaitInstanceConditionSucceeded, nullable — The ConditionSucceeded message. - … - `timedOut` C1ApiPolicyV1WaitInstanceConditionTimedOut, nullable — The ConditionTimedOut message. - … - `timeout` string, date-time - `timeoutDuration` string, duration - `untilTime` C1ApiPolicyV1WaitUntilTimeInstance, nullable — The WaitUntilTimeInstance message. - … - `next` C1ApiPolicyV1PolicyStep[], nullable — An array of steps that will be processed by the ticket, in order. - `accept` C1ApiPolicyV1Accept, nullable — This policy step indicates that a ticket should have an approved outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. - `acceptMessage` string — An optional message to include in the comments when a task is automatically accepted. - `action` C1ApiPolicyV1Action, nullable — The Action message. This message contains a oneof named target. Only a single field of the following list may be set at a time: - automation - batonResourceAction - clientIdApproval - `automation` C1ApiPolicyV1ActionTargetAutomation, nullable — ActionTargetAutomation targets automation templates for policy actions. - … - `batonResourceAction` C1ApiPolicyV1ActionTargetBatonResourceAction, nullable — ActionTargetResource targets resource actions for policy actions. - … - `clientIdApproval` C1ApiPolicyV1ActionTargetClientIdApproval, nullable — ActionTargetClientIdApproval targets administrator review of an external OAuth client registration (CIMD or DCR) for policy actions. - `approval` C1ApiPolicyV1Approval, nullable — The Approval message. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users - manager - appOwners - group - self - entitlementOwners - expression - webhook - resourceOwners - agent - `agent` C1ApiPolicyV1AgentApproval, nullable — The agent to assign the task to. - … - `allowDelegation` boolean — Whether ticket delegation is allowed for this step. - `allowReassignment` boolean — Configuration to allow reassignment by reviewers during this step. - `allowedReassignees` string[], nullable — List of users for whom this step can be reassigned. - `appOwners` C1ApiPolicyV1AppOwnerApproval, nullable — App owner approval provides the configuration for an approval step when the app owner is the target. - … - `assigned` boolean — A field indicating whether this step is assigned. - `entitlementOwners` C1ApiPolicyV1EntitlementOwnerApproval, nullable — The entitlement owner approval allows configuration of the approval step when the target approvers are the entitlement owners. - … - `escalation` C1ApiPolicyV1Escalation — The Escalation message. This message contains a oneof named escalation_policy. Only a single field of the following list may be set at a time: - replacePolicy - reassignToApprovers - cancelTicket - skipStep - … - `escalationEnabled` boolean — Whether escalation is enabled for this step. - `expression` C1ApiPolicyV1ExpressionApproval, nullable — The ExpressionApproval message. - … - `group` C1ApiPolicyV1AppGroupApproval, nullable — The AppGroupApproval object provides the configuration for setting a group as the approvers of an approval policy step. - … - `manager` C1ApiPolicyV1ManagerApproval, nullable — The manager approval object provides configuration options for approval when the target of the approval is the manager of the user in the task. - … - `requireApprovalReason` boolean — Configuration to require a reason when approving this step. - `requireDenialReason` boolean — Configuration to require a reason when denying this step. - `requireReassignmentReason` boolean — Configuration to require a reason when reassigning this step. - `requiresStepUpProviderId` string — The ID of a step-up authentication provider that will be required for approvals on this step. If set, approvers must complete the step-up authentication flow before they can approve. - `resourceOwners` C1ApiPolicyV1ResourceOwnerApproval, nullable — The resource owner approval allows configuration of the approval step when the target approvers are the resource owners. - … - `self` C1ApiPolicyV1SelfApproval, nullable — The self approval object describes the configuration of a policy step that needs to be approved by the target of the request. - … - `users` C1ApiPolicyV1UserApproval, nullable — The user approval object describes the approval configuration of a policy step that needs to be approved by a specific list of users. - … - `webhook` C1ApiPolicyV1WebhookApproval, nullable — The WebhookApproval message. - … - `form` C1ApiPolicyV1Form, nullable — The Form message. - `form` C1ApiFormV1Form — A form is a collection of fields to be filled out by a user - … - `provision` C1ApiPolicyV1Provision, nullable — The provision step references a provision policy for this step. - `assigned` boolean — A field indicating whether this step is assigned. - `provisionPolicy` C1ApiPolicyV1ProvisionPolicy — ProvisionPolicy is a oneOf that indicates how a provision step should be processed. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - connector - manual - delegated - webhook - multiStep - externalTicket - unconfigured - action - … - `provisionTarget` C1ApiPolicyV1ProvisionTarget — ProvisionTarget indicates the specific app, app entitlement, and if known, the app user and grant duration of this provision step - … - `reject` C1ApiPolicyV1Reject, nullable — This policy step indicates that a ticket should have a denied outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. - `rejectMessage` string — An optional message to include in the comments when a task is automatically rejected. - `wait` C1ApiPolicyV1Wait, nullable — Define a Wait step for a policy to wait on a condition to be met. This message contains a oneof named until. Only a single field of the following list may be set at a time: - condition - duration - untilTime - `commentOnFirstWait` string — The comment to post on first failed check. - `commentOnTimeout` string — The comment to post if we timeout. - `condition` C1ApiPolicyV1WaitCondition, nullable — The WaitCondition message. - … - `duration` C1ApiPolicyV1WaitDuration, nullable — The WaitDuration message. - … - `name` string — The name of our condition to show on the task details page - `timeoutDuration` string, duration - `untilTime` C1ApiPolicyV1WaitUntilTime, nullable — Waits until a specific time of the day (UTC) - … - `policy` C1ApiPolicyV1Policy — A policy defines a workflow (sequence of steps) that runs when processing access requests, reviews, or revocations. Policies support conditional routing: different conditions can trigger different step sequences, with a baseline fallback. - `annotations` object — Key/value metadata. Up to 16 entries; keys 1-128 chars; values 0-256 chars; URL-safe ASCII. Keys starting with `c1/` are reserved. Updates have PATCH semantics: keys absent from the request are preserved; an empty value deletes the key. Well-known keys: `managed_by`, `iac_workspace`, `iac_resource_address`, `iac_tool_version`. - `createdAt` string, date-time - `deletedAt` string, date-time - `description` string — The description of the Policy. - `displayName` string — The display name of the Policy. - `id` string — The ID of the Policy. - `policySteps` object — A map from string keys to step sequences. One entry is always the baseline, keyed by the lowercased policy_type (e.g., "grant", "revoke", "certify"). Additional entries have opaque keys (UUIDs) and are referenced by the rules array for conditional routing. If no conditional rules are configured, only the baseline entry exists. - `policyType` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_GRANT' | 'POLICY_TYPE_REVOKE' | 'POLICY_TYPE_CERTIFY' | 'POLICY_TYPE_ACCESS_REQUEST' | 'POLICY_TYPE_PROVISION' — The type of this policy (grant, revoke, or certify). The lowercased type name (e.g., "grant") is also the key for the baseline entry in policy_steps. - `postActions` C1ApiPolicyV1PolicyPostActions[], nullable — Ordered actions to execute after the policy completes processing. - `certifyRemediateImmediately` boolean, nullable — Only valid on certify policies. When true, any revocations resulting from the certification are applied immediately when the campaign task closes. This field is part of the `action` oneof. See the documentation for `c1.api.policy.v1.PolicyPostActions` for more details. - `reassignTasksToDelegates` boolean — This field is no longer used. Configure delegate reassignment in the policy step instead. - `rules` C1ApiPolicyV1Rule[], nullable — Ordered conditional routing rules. Evaluated top-to-bottom; the first matching rule selects a step sequence from policy_steps. If no rule matches (or if this array is empty), the baseline entry in policy_steps is used. - `condition` string — A CEL expression that is evaluated against the request context. If it returns true, the step sequence identified by policy_key is used. - `policyKey` string — A key into the policy's policy_steps map identifying which step sequence to execute when this rule's condition matches. - `systemBuiltin` boolean — Whether this policy is a builtin system policy. Builtin system policies cannot be edited. - `updatedAt` string, date-time - `policyGenerationId` string — The policy generation id refers to the current policy's generation ID. This is changed when the policy is changed on a task. - `processing` 'TASK_PROCESSING_TYPE_UNSPECIFIED' | 'TASK_PROCESSING_TYPE_PROCESSING' | 'TASK_PROCESSING_TYPE_WAITING' | 'TASK_PROCESSING_TYPE_DONE' — The processing state of a task as defined by the `processing_enum` - `recommendation` 'INSIGHT_RECOMMENDATION_UNSPECIFIED' | 'INSIGHT_RECOMMENDATION_APPROVE' | 'INSIGHT_RECOMMENDATION_DENY' | 'INSIGHT_RECOMMENDATION_REVIEW' — The recommendation field. - `revocationTargets` C1ApiTaskV1TaskRevocationTarget[], nullable — Ancestor entitlements that will also be revoked when this revoke task is approved. Populated at ticket creation time for inherited grant revocations. - `entitlementRef` C1ApiAppV1AppEntitlementRef — The AppEntitlementRef message. - `appId` string — The appId field. - `id` string — The id field. - `state` 'TASK_STATE_UNSPECIFIED' | 'TASK_STATE_OPEN' | 'TASK_STATE_CLOSED' — The current state of the task as defined by the `state_enum` - `stepApproverIds` string[], nullable — An array of IDs belonging to Identity Users that are allowed to review this step in a task. - `type` C1ApiTaskV1TaskType — Task Type provides configuration for the type of task: certify, grant, or revoke This message contains a oneof named task_type. Only a single field of the following list may be set at a time: - grant - revoke - certify - offboarding - action - finding - `action` C1ApiTaskV1TaskTypeAction, nullable — The TaskTypeAction message. This message contains a oneof named target_object. Only a single field of the following list may be set at a time: - scopeRole - `actionId` string — The ID of the admin-authored action to execute. Empty for synthesized action tickets (e.g. scope-role grants) — those carry dispatch configuration on action_instance and target_object instead. - `actionInstance` C1ApiTaskV1ActionInstance — ActionInstance is the API mirror of the internal immutable snapshot of an Action captured on a TaskTypeAction at ticket-creation time. This message contains a oneof named target_ref. Only a single field of the following list may be set at a time: - connectorActionRef - `connectorActionRef` C1ApiTaskV1ConnectorActionRef, nullable — ConnectorActionRef describes dispatch through a connector's built-in GrantManagerService Grant / Revoke RPC — i.e. the default connector operation, used for synthesized tickets like scope-role requests. - … - `displayName` string — Display label at ticket-creation time. Same value as TaskTypeAction.display_name; repeated here so clients that walk the instance see a self-contained view. - `displayName` string — Display label captured on the action snapshot at ticket-creation time. Stable under admin renames to a referenced Action row and populated for synthesized tickets that have no Action row at all. UI reads this to render the task title without an Action fetch. - `formValues` object - `outcome` 'ACTION_OUTCOME_UNSPECIFIED' | 'ACTION_OUTCOME_SUCCESS' | 'ACTION_OUTCOME_DENIED' | 'ACTION_OUTCOME_ERROR' | 'ACTION_OUTCOME_CANCELLED' — The outcome field. - `outcomeTime` string, date-time - `scopeRole` C1ApiTaskV1ScopeRole, nullable — Scope-role variant of TaskTypeAction.target_object. The UI uses the embedded identifiers to build links and title strings without a separate Action fetch. - `appId` string — The IaaS/sparse-ACL app the (scope, role) pair lives on. - `grantDuration` string, duration - `roleResourceId` string — The roleResourceId field. - `roleResourceTypeId` string — The roleResourceTypeId field. - `scopeResourceId` string — The scopeResourceId field. - `scopeResourceTypeId` string — The scopeResourceTypeId field. - `type` 'TYPE_UNSPECIFIED' | 'TYPE_GRANT' | 'TYPE_WORKFLOW' | 'TYPE_RESOURCE_ACTION' — Flavor of action the ticket represents — mirrors the snapshot's target_ref variant. - `certify` C1ApiTaskV1TaskTypeCertify, nullable — The TaskTypeCertify message indicates that a task is a certify task and all related details. - `accessReviewId` string — The ID of the access review. - `accessReviewSelection` string — The ID of the specific access review object that owns this certify task. This is also set on a revoke task if the revoke task is created from the denied outcome of a certify task. - `appEntitlementId` string — The ID of the app entitlement. - `appId` string — The ID of the app. - `appUserId` string — The ID of the app user. - `identityUserId` string — The ID of the user. - `outcome` 'CERTIFY_OUTCOME_UNSPECIFIED' | 'CERTIFY_OUTCOME_CERTIFIED' | 'CERTIFY_OUTCOME_DECERTIFIED' | 'CERTIFY_OUTCOME_ERROR' | 'CERTIFY_OUTCOME_CANCELLED' | 'CERTIFY_OUTCOME_WAIT_TIMED_OUT' — The outcome of the certification. - `outcomeTime` string, date-time - `finding` C1ApiTaskV1TaskTypeFinding, nullable — The TaskTypeFinding message. - `findingId` string — Reference to the source finding. - `findingType` string — The finding type discriminator. - `outcome` 'FINDING_TASK_OUTCOME_UNSPECIFIED' | 'FINDING_TASK_OUTCOME_REMEDIATED' | 'FINDING_TASK_OUTCOME_RISK_ACCEPTED' | 'FINDING_TASK_OUTCOME_CANCELLED' — The outcome field. - `outcomeTime` string, date-time - `grant` C1ApiTaskV1TaskTypeGrant, nullable — The TaskTypeGrant message indicates that a task is a grant task and all related details. - `appEntitlementId` string — The ID of the app entitlement. - `appId` string — The ID of the app. - `appUserId` string — The ID of the app user. - `grantDuration` string, duration - `identityUserId` string — The ID of the user. - `outcome` 'GRANT_OUTCOME_UNSPECIFIED' | 'GRANT_OUTCOME_GRANTED' | 'GRANT_OUTCOME_DENIED' | 'GRANT_OUTCOME_ERROR' | 'GRANT_OUTCOME_CANCELLED' | 'GRANT_OUTCOME_WAIT_TIMED_OUT' — The outcome of the grant. - `outcomeTime` string, date-time - `source` C1ApiTaskV1TaskGrantSource — The TaskGrantSource message tracks which external URL was the source of the specificed grant ticket. - `conversationId` string — The ID of the conversation that created this ticket - `externalUrl` string — The external url source of the grant ticket. - `integrationId` string — The integration id for the source of tickets. - `isExtension` boolean — Whether the grant task is an extension task. - `requestId` string — the request id for the grant ticket if the source is external - `offboarding` C1ApiTaskV1TaskTypeOffboarding, nullable — The TaskTypeOffboarding message. - `outcome` 'OFFBOARDING_OUTCOME_UNSPECIFIED' | 'OFFBOARDING_OUTCOME_IN_PROGRESS' | 'OFFBOARDING_OUTCOME_DONE' | 'OFFBOARDING_OUTCOME_ERROR' | 'OFFBOARDING_OUTCOME_CANCELLED' — The outcome field. - `outcomeTime` string, date-time - `subjectUserId` string — The subjectUserId field. - `revoke` C1ApiTaskV1TaskTypeRevoke, nullable — The TaskTypeRevoke message indicates that a task is a revoke task and all related details. - `appEntitlementId` string — The ID of the app entitlement. - `appId` string — The ID of the app. - `appUserId` string — The ID of the app user. - `identityUserId` string — The ID of the user. - `outcome` 'REVOKE_OUTCOME_UNSPECIFIED' | 'REVOKE_OUTCOME_REVOKED' | 'REVOKE_OUTCOME_DENIED' | 'REVOKE_OUTCOME_ERROR' | 'REVOKE_OUTCOME_CANCELLED' | 'REVOKE_OUTCOME_WAIT_TIMED_OUT' — The outcome of the revoke. - `outcomeTime` string, date-time - `source` C1ApiTaskV1TaskRevokeSource — The TaskRevokeSource message indicates the source of the revoke task is one of expired, nonUsage, request, or review. This message contains a oneof named origin. Only a single field of the following list may be set at a time: - review - request - expired - nonUsage - `expired` C1ApiTaskV1TaskRevokeSourceExpired, nullable — The TaskRevokeSourceExpired message indicates that the source of the revoke task is due to a grant expiring. - … - `nonUsage` C1ApiTaskV1TaskRevokeSourceNonUsage, nullable — The TaskRevokeSourceNonUsage message indicates that the source of the revoke task is due to the grant not being used. - … - `request` C1ApiTaskV1TaskRevokeSourceRequest, nullable — The TaskRevokeSourceRequest message indicates that the source of the revoke task was a request. - … - `review` C1ApiTaskV1TaskRevokeSourceReview, nullable — The TaskRevokeSourceReview message tracks which access review was the source of the specificed revoke ticket. - … - `updatedAt` string, date-time - `userId` string — The ID of the user that is the target of this task. This may be empty if we're targeting a specific app user that has no known identity user. - `userPath` string — JSONPATH expression indicating the location of the User object in the expanded array. This is the user that is a direct target of the ticket without a specific relationship to a potentially non-existent app user. --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/versions/d391405a35d3/schema)