--- title: "Get group by ID" method: GET path: "/groups/{group_id}" tags: ["groups"] --- # Get group by ID `GET /groups/{group_id}` Returns a `Group` object. ## Path parameters - `group_id` string, uuid, required ## Response `200` The requested `Group`. - Group — # Group Object ### Description The `Group` object is used to represent a group. ### Usage Example Update from the `UPDATE Groups` endpoint. - `group_id` string, uuid, required — The ID of the group. - `app_id` string, uuid — The ID of the group's app. - `name` string — The name of the group. - `description` string — A description of the group. - `admin_owner_id` string, uuid — The ID of the owner of the group. - `group_leader_user_ids` string[] — A list of User IDs for the group leaders of the group - `remote_id` string — The ID of the remote. - `remote_name` string — The name of the remote. - `group_type` 'ACTIVE_DIRECTORY_GROUP' | 'AWS_SSO_GROUP' | 'DATABRICKS_ACCOUNT_GROUP' | 'DUO_GROUP' | 'GIT_HUB_TEAM' | 'GIT_LAB_GROUP' | 'GOOGLE_GROUPS_GROUP' | 'GOOGLE_GROUPS_GKE_GROUP' | 'LDAP_GROUP' | 'OKTA_GROUP' | 'OKTA_GROUP_RULE' | 'TAILSCALE_GROUP' | 'OPAL_GROUP' | 'OPAL_ACCESS_RULE' | 'AZURE_AD_SECURITY_GROUP' | 'AZURE_AD_MICROSOFT_365_GROUP' | 'CONNECTOR_GROUP' | 'SNOWFLAKE_ROLE' | 'WORKDAY_USER_SECURITY_GROUP' | 'PAGERDUTY_ON_CALL_SCHEDULE' | 'INCIDENTIO_ON_CALL_SCHEDULE' | 'ROOTLY_ON_CALL_SCHEDULE' | 'DEVIN_GROUP' | 'GIT_HUB_ENTERPRISE_TEAM' | 'GRAFANA_TEAM' | 'CLICKHOUSE_ROLE' | 'SLACK_USER_GROUP' | 'TWINGATE_GROUP' | 'TWINGATE_GROUP_SYNCED' | 'ZENDESK_GROUP' | 'ZENDESK_ORGANIZATION' | 'HUBSPOT_TEAM' | 'TABLEAU_GROUP' — The type of the group. - `max_duration` integer — The maximum duration for which the group can be requested (in minutes). - `recommended_duration` integer — The recommended duration for which the group should be requested (in minutes). -1 represents an indefinite duration. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `require_manager_approval` boolean — A bool representing whether or not access requests to the group require manager approval. - `require_support_ticket` boolean — A bool representing whether or not access requests to the group require an access ticket. - `require_mfa_to_approve` boolean — A bool representing whether or not to require MFA for reviewers to approve requests for this group. - `require_mfa_to_request` boolean — A bool representing whether or not to require MFA for requesting access to this group. - `auto_approval` boolean — A bool representing whether or not to automatically approve requests to this group. - `request_template_id` string, uuid — The ID of the associated request template. - `configuration_template_id` string, uuid — The ID of the associated configuration template. - `group_binding_id` string, uuid — The ID of the associated group binding. - `is_requestable` boolean — A bool representing whether or not to allow access requests to this group. - `request_configurations` RequestConfiguration[] — A list of request configurations for this group. - `condition` Condition — # Condition Object ### Description The `Condition` object is used to represent a condition. ### Usage Example Used to match request configurations to users in `RequestConfiguration` - `group_ids` string[] — The list of group IDs to match. - `role_remote_ids` string[] — The list of role remote IDs to match. - `allow_requests` boolean, required — A bool representing whether or not to allow requests for this resource. - `auto_approval` boolean, required — A bool representing whether or not to automatically approve requests for this resource. - `require_mfa_to_request` boolean, required — A bool representing whether or not to require MFA for requesting access to this resource. - `max_duration_minutes` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration_minutes` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `require_support_ticket` boolean, required — A bool representing whether or not access requests to the resource require an access ticket. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `request_template_id` string, uuid — The ID of the associated request template. - `reviewer_stages` ReviewerStage[] — The list of reviewer stages for the request configuration. - `require_manager_approval` boolean, required — Whether this reviewer stage should require manager approval. - `require_admin_approval` boolean — Whether this reviewer stage should require admin approval. - `operator` 'AND' | 'OR', required — The operator of the reviewer stage. Admin and manager approval are also treated as reviewers. - `owner_ids` string[], required — The IDs of owners assigned as reviewers for this stage. - `service_user_ids` string[] — The IDs of service users assigned as reviewers for this stage. - `priority` integer, required — The priority of the request configuration. - `request_configuration_list` RequestConfiguration[] — A list of request configurations for this group. Deprecated in favor of `request_configurations`. - `condition` Condition — # Condition Object ### Description The `Condition` object is used to represent a condition. ### Usage Example Used to match request configurations to users in `RequestConfiguration` - `group_ids` string[] — The list of group IDs to match. - `role_remote_ids` string[] — The list of role remote IDs to match. - `allow_requests` boolean, required — A bool representing whether or not to allow requests for this resource. - `auto_approval` boolean, required — A bool representing whether or not to automatically approve requests for this resource. - `require_mfa_to_request` boolean, required — A bool representing whether or not to require MFA for requesting access to this resource. - `max_duration_minutes` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration_minutes` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `require_support_ticket` boolean, required — A bool representing whether or not access requests to the resource require an access ticket. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `request_template_id` string, uuid — The ID of the associated request template. - `reviewer_stages` ReviewerStage[] — The list of reviewer stages for the request configuration. - `require_manager_approval` boolean, required — Whether this reviewer stage should require manager approval. - `require_admin_approval` boolean — Whether this reviewer stage should require admin approval. - `operator` 'AND' | 'OR', required — The operator of the reviewer stage. Admin and manager approval are also treated as reviewers. - `owner_ids` string[], required — The IDs of owners assigned as reviewers for this stage. - `service_user_ids` string[] — The IDs of service users assigned as reviewers for this stage. - `priority` integer, required — The priority of the request configuration. - `metadata` string — JSON metadata about the remote group. Only set for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details. - `remote_info` GroupRemoteInfo — Information that defines the remote group. This replaces the deprecated remote_id and metadata fields. If remote_info is provided, a group will be imported into Opal. For group types that support group creation through Opal, a new group will be created if remote_info is not provided. - `active_directory_group` object — Remote info for Active Directory group. - `group_id` string, required — The id of the Google group. - `tailscale_group` object — Remote info for Tailscale group. - `group_id` string, required — The id of the Tailscale group. - `twingate_group` object — Remote info for Twingate group. - `group_id` string, required — The id of the Twingate group. - `twingate_group_synced` object — Remote info for Twingate synced group. - `group_id` string, required — The id of the Twingate synced group. - `aws_sso_group` object — Remote info for AWS SSO group. - `group_id` string, required — The id of the AWS SSO group. - `databricks_account_group` object — Remote info for Databricks account group. - `group_id` string, required — The id of the Databricks account group. - `connector_group` object — Remote info for Connector group. - `group_id` string, required — The id of the Connector group. - `github_team` object — Remote info for GitHub team. - `team_id` string — The id of the GitHub team. - `team_slug` string, required — The slug of the GitHub team. - `org_name` string — GitHub team's org name, required only for Enterprise - `github_enterprise_team` object — Remote info for GitHub Enterprise team. - `team_slug` string, required — The slug of the GitHub Enterprise team. - `gitlab_group` object — Remote info for Gitlab group. - `group_id` string, required — The id of the Gitlab group. - `google_group` object — Remote info for Google group. - `group_id` string, required — The id of the Google group. - `ldap_group` object — Remote info for LDAP group. - `group_id` string, required — The id of the LDAP group. - `okta_group` object — Remote info for Okta Directory group. - `group_id` string, required — The id of the Okta Directory group. - `duo_group` object — Remote info for Duo Security group. - `group_id` string, required — The id of the Duo Security group. - `azure_ad_security_group` object — Remote info for Microsoft Entra ID Security group. - `group_id` string, required — The id of the Microsoft Entra ID Security group. - `azure_ad_microsoft_365_group` object — Remote info for Microsoft Entra ID Microsoft 365 group. - `group_id` string, required — The id of the Microsoft Entra ID Microsoft 365 group. - `snowflake_role` object — Remote info for Snowflake role. - `role_id` string, required — The id of the Snowflake role. - `okta_group_rule` object — Remote info for Okta Directory group rule. - `rule_id` string, required — The id of the Okta group rule. - `workday_user_security_group` object — Remote info for Workday User Security group. - `group_id` string, required — The id of the Workday User Security group. - `pagerduty_on_call_schedule` object — Remote info for PagerDuty on-call schedule group. - `schedule_id` string, required — The id of the PagerDuty on-call schedule. - `incidentio_on_call_schedule` object — Remote info for Incident.io on-call schedule group. - `schedule_id` string, required — The id of the Incident.io on-call schedule. - `rootly_on_call_schedule` object — Remote info for Rootly on-call schedule group. - `schedule_id` string, required — The id of the Rootly on-call schedule. - `devin_group` object — Remote info for Devin group. - `group_name` string, required — The name of the Devin group. - `clickhouse_role` object — Remote info for ClickHouse role. - `role_id` string, required — The name of the ClickHouse role. - `grafana_team` object — Remote info for Grafana team. - `team_id` string, required — The ID of the team. - `zendesk_group` object — Remote info for Zendesk group. - `group_id` string, required — The ID of the Zendesk group. - `slack_user_group` object — Remote info for Slack user group. - `group_id` string, required — The id of the Slack user group. - `zendesk_organization` object — Remote info for Zendesk organization. - `organization_id` string, required — The ID of the Zendesk organization. - `hubspot_team` object — Remote info for HubSpot team. - `team_id` string, required — The ID of the HubSpot team. - `tableau_group` object — Remote info for Tableau group. - `group_id` string, required — The ID of the Tableau group. - `custom_request_notification` string, nullable — Custom request notification sent to the requester when the request is approved. - `risk_sensitivity` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `risk_sensitivity_override` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `match_remote_name` boolean — A bool representing whether or not the group's name is synced from the end system. When true, the name is overwritten with the remote name on each sync. Defaults to false. - `match_remote_description` boolean — A bool representing whether or not the group's description is synced from the end system. When true, the description is overwritten with the remote description on each sync. Defaults to false. - `last_successful_sync` SyncTask — Represents a sync task that has been completed, either successfully or with errors. - `id` string, uuid, required — The ID of the sync task. - `completed_at` string, date-time, required — The time when the sync task was completed. --- [API](https://skmtc.net/opal/apis/opal-api.md) · [All operations](https://skmtc.net/opal/apis/opal-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/opal/opal-api/versions/13b58df96d40/schema)