--- title: "Run an ad-hoc OpalQuery" method: POST path: "/queries/run" tags: ["opal-queries"] --- # Run an ad-hoc OpalQuery `POST /queries/run` Runs an ad-hoc OpalQuery and returns the results. Supports NODE queries (users, resources, groups) and ACCESS_PATH queries (principal-to-entitlement access edges). This endpoint is only available to our OpalQuery beta group. Please contact Opal support if you'd like to be added to the beta. ## Request body - union — Request body for running an ad-hoc OpalQuery. The `type` field determines which query schema applies. - OpalNodeQuery — Request body for a NODE-type OpalQuery. Returns entities (users, resources, groups) matching the given filters. - `type` 'NODE', required - `query` OpalNodeQueryBody — The filter body for a NODE-type OpalQuery. - `nodeFilters` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `accessFilters` AccessRelationshipFilters — Filters the returned nodes by the access edges connected to them. When `isAccessibleBy` and `hasAccessTo` are provided, the returned nodes must satisfy both edge constraints simultaneously. - `isAccessibleBy` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `hasAccessTo` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `first` integer — Maximum number of results to return. Defaults to 200. - `after` string — Cursor from a previous response to fetch the next page of results. - OpalAccessPathQuery — Request body for an ACCESS_PATH-type OpalQuery. Returns principal-to- entitlement access paths matching the given edge filters. - `type` 'ACCESS_PATH', required - `query` OpalAccessPathQueryBody — Edge-query filters for an ACCESS_PATH OpalQuery. At least one of principalFilter or entitlementFilter is required. - `principalFilter` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `entitlementFilter` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `principalAccessFilters` AccessRelationshipFilters — Filters the returned nodes by the access edges connected to them. When `isAccessibleBy` and `hasAccessTo` are provided, the returned nodes must satisfy both edge constraints simultaneously. - `isAccessibleBy` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `hasAccessTo` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `entitlementAccessFilters` AccessRelationshipFilters — Filters the returned nodes by the access edges connected to them. When `isAccessibleBy` and `hasAccessTo` are provided, the returned nodes must satisfy both edge constraints simultaneously. - `isAccessibleBy` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `hasAccessTo` AccessEntityFilters — Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf. - `entityTypes` string[] — Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery. - `entityItemTypes` EntityItemTypeEnum[] — Filter by entity item types. - `entityName` EntityNameFilter — Filters entities by name using a string match strategy. - `stringMatchType` 'CONTAINS' | 'EQUALS' | 'STARTS_WITH' | 'ENDS_WITH', required — How to match a string value against entity names. - `string` string, required — The string value to match against the entity name. - `entityTag` EntityTagFilter — Filters entities by a tag key/value pair, optionally scoped to a connection. - `key` string, required — The tag key to filter by. - `value` string — The tag value to filter by. If omitted, matches any value for the given key. - `connectionId` string, uuid — If specified, filters by tags associated with this connection. - `hrIdpStatus` IdpStatusFilter — Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. "IDP status is NOT active"), so it still returns only users rather than sweeping in groups/resources. - `statuses` UserHrIdpStatusEnum[] — Match users whose HR/IDP status is one of these values. - `not` boolean — Invert the match within the user domain (e.g. "IDP status is NOT active"). - `entityAdminOwner` EntityAdminFilter — Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them. - `ownerIDs` string[], required — The owner (group) UUIDs to match entities against. - `not` boolean — Invert the match — return resources/groups NOT owned by the given owners. - `entityIDs` string[] — Filter by specific entity UUIDs. - `importedFromApp` string[] — Filter by app IDs from which returned nodes will be imported from. - `roleRemoteIds` string[] — Filter by role remote IDs. Can only be applied within a hasAccessTo clause. - `roleNames` string[] — Filter by role display names (e.g. "Admin", "Read"). Can only be applied within a hasAccessTo clause. - `allOf` AccessEntityFilters[] — A list of nested filters that must all match (logical AND). Each item has the same shape as this object — scalar fields like `entityTypes` or `entityTag`, and can further nest `allOf`, `anyOf`, or `not`. - `anyOf` AccessEntityFilters[] — A list of nested filters where at least one must match (logical OR). Each item has the same shape as this object. - `not` object — Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: ["RESOURCE"]}}` to exclude resources. - `accessLevelRemoteIds` string[] — Filter by access-level remote IDs on the terminal edge. - `accessLevelNames` string[] — Filter by access-level display names on the terminal edge. - `edgeFilter` OpalAccessPathEdgeFilter — Constraints on the access path edges themselves. - `directOnly` boolean — When true, only return direct (depth-1) principal-to-entitlement edges. - `accessDurationType` 'EXPIRING_ONLY' | 'PERMANENT_ONLY' — Constrain results by whether the terminal access expires. - `first` integer — Maximum number of results to return. Defaults to 200. - `after` string — Opaque cursor from a previous ACCESS_PATH response to fetch the next page of results. - `includeCount` boolean — When true, populate totalCount in the response. Defaults to false. ## Response `200` The results of the OpalQuery. - union — Paginated results of an OpalQuery. The `type` field discriminates which result schema applies and mirrors the `type` field on the request. - OpalNodeQueryResults — Paginated results of a NODE-type OpalQuery — one edge per matched entity (user, resource, or group). - `type` 'NODE', required - `edges` OpalQueryResultEdge[], required — List of matched entities. - `node` OpalQueryResultNode, required — A matched entity from an OpalQuery result. - `id` string, uuid, required — The entity's unique identifier. - `name` string, required — The display name of the entity. - `entityType` 'USER' | 'GROUP' | 'RESOURCE', required — The top-level entity type. - `entityItemType` 'USER' | 'SERVICE_USER' | 'ACTIVE_DIRECTORY_GROUP' | 'AWS_SSO_GROUP' | 'DUO_GROUP' | 'GIT_HUB_TEAM' | 'GIT_LAB_GROUP' | 'GOOGLE_GROUPS_GROUP' | 'GOOGLE_GROUPS_GKE_GROUP' | 'LDAP_GROUP' | 'OKTA_GROUP' | 'OKTA_GROUP_RULE' | 'TAILSCALE_GROUP' | 'TWINGATE_GROUP' | 'TWINGATE_GROUP_SYNCED' | 'OPAL_GROUP' | 'OPAL_ACCESS_RULE' | 'AZURE_AD_SECURITY_GROUP' | 'AZURE_AD_MICROSOFT_365_GROUP' | 'CONNECTOR_GROUP' | 'SNOWFLAKE_ROLE' | 'WORKDAY_USER_SECURITY_GROUP' | 'DATABRICKS_ACCOUNT_GROUP' | 'AWS_IAM_ROLE' | 'AWS_EC2_INSTANCE' | 'AWS_EKS_CLUSTER' | 'AWS_RDS_POSTGRES_INSTANCE' | 'AWS_RDS_POSTGRES_CLUSTER' | 'AWS_RDS_MYSQL_INSTANCE' | 'AWS_RDS_MYSQL_CLUSTER' | 'AWS_ACCOUNT' | 'AWS_SSO_PERMISSION_SET' | 'AZURE_MANAGEMENT_GROUP' | 'AZURE_RESOURCE_GROUP' | 'AZURE_SUBSCRIPTION' | 'AZURE_VIRTUAL_MACHINE' | 'AZURE_STORAGE_ACCOUNT' | 'AZURE_STORAGE_CONTAINER' | 'AZURE_SQL_SERVER' | 'AZURE_SQL_MANAGED_INSTANCE' | 'AZURE_SQL_DATABASE' | 'AZURE_SQL_MANAGED_DATABASE' | 'AZURE_USER_ASSIGNED_MANAGED_Identity' | 'AZURE_ENTRA_ID_ROLE' | 'AZURE_ENTERPRISE_APP' | 'CUSTOM' | 'CUSTOM_CONNECTOR' | 'GCP_ORGANIZATION' | 'GCP_BUCKET' | 'GCP_COMPUTE_INSTANCE' | 'GCP_BIG_QUERY_DATASET' | 'GCP_BIG_QUERY_TABLE' | 'GCP_FOLDER' | 'GCP_GKE_CLUSTER' | 'GCP_PROJECT' | 'GCP_CLOUD_SQL_POSTGRES_INSTANCE' | 'GCP_CLOUD_SQL_MYSQL_INSTANCE' | 'GCP_SERVICE_ACCOUNT' | 'GIT_HUB_REPO' | 'GIT_HUB_ORG_ROLE' | 'GIT_LAB_PROJECT' | 'GOOGLE_WORKSPACE_ROLE' | 'MONGO_INSTANCE' | 'MONGO_ATLAS_INSTANCE' | 'OKTA_APP' | 'OKTA_ROLE' | 'OPAL_ROLE' | 'OPAL_SCOPED_ROLE' | 'PAGERDUTY_ROLE' | 'TAILSCALE_SSH' | 'TWINGATE_RESOURCE' | 'SALESFORCE_PERMISSION_SET' | 'SALESFORCE_PROFILE' | 'SALESFORCE_ROLE' | 'SNOWFLAKE_DATABASE' | 'SNOWFLAKE_SCHEMA' | 'SNOWFLAKE_TABLE' | 'WORKDAY_ROLE' | 'MYSQL_INSTANCE' | 'MARIADB_INSTANCE' | 'POSTGRES_INSTANCE' | 'TELEPORT_ROLE' | 'DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL' | 'ILEVEL_ADVANCED_ROLE', required — Granular subtype of an entity. - `cursor` string, required — Opaque cursor for this entity, used for pagination. - `pageInfo` PageInfo, required - `hasNextPage` boolean, required — Whether there are more items after the end cursor - `endCursor` string, required — The cursor to continue pagination forwards - `hasPreviousPage` boolean, required — Whether there are more items before the start cursor - `startCursor` string, required — The cursor to continue pagination backwards - OpalAccessPathQueryResults — Paginated results of an ACCESS_PATH-type OpalQuery — one edge per matched principal-to-entitlement access path. - `type` 'ACCESS_PATH', required - `edges` OpalAccessPathResultEdge[], required — List of matched access paths. - `node` OpalAccessPathResultNode, required — A matched access path from an ACCESS_PATH OpalQuery. - `principalId` string, uuid, required — The principal entity ID. - `entitlementId` string, uuid, required — The entitlement entity ID. - `accessLevelRemoteId` string, nullable — Remote ID of the terminal access level. - `accessLevelName` string, nullable — Display name of the terminal access level. - `expiration` string, date-time, nullable — Expiration of the terminal access, if any. - `depth` integer, required — Number of hops from principal to entitlement (path length - 1). - `path` string[], required — Entity IDs along the path from principal to entitlement. - `cursor` string, required — Opaque cursor for this path, used for pagination. - `pageInfo` PageInfo, required - `hasNextPage` boolean, required — Whether there are more items after the end cursor - `endCursor` string, required — The cursor to continue pagination forwards - `hasPreviousPage` boolean, required — Whether there are more items before the start cursor - `startCursor` string, required — The cursor to continue pagination backwards - `totalCount` integer, nullable — Exact total number of matching paths when includeCount was true on the request; otherwise null. --- [API](https://skmtc.net/opal/apis/opal-api.md) · [All operations](https://skmtc.net/opal/apis/opal-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/opal/opal-api/revisions/13b58df96d40/schema)