--- title: "Get resource by ID" method: GET path: "/resources/{resource_id}" tags: ["resources"] --- # Get resource by ID `GET /resources/{resource_id}` Retrieves a resource. ## Path parameters - `resource_id` string, uuid, required ## Response `200` The requested resource. - Resource — # Resource Object ### Description The `Resource` object is used to represent a resource. ### Usage Example Update from the `UPDATE Resources` endpoint. - `resource_id` string, uuid, required — The ID of the resource. - `app_id` string, uuid — The ID of the app. - `name` string — The name of the resource. - `description` string — A description of the resource. - `admin_owner_id` string, uuid — The ID of the owner of the resource. - `remote_resource_id` string — The ID of the resource on the remote system. - `remote_resource_name` string — The name of the resource on the remote system. - `resource_type` 'AWS_IAM_ROLE' | 'AWS_EC2_INSTANCE' | 'AWS_EKS_CLUSTER' | 'AWS_RDS_POSTGRES_CLUSTER' | 'AWS_RDS_POSTGRES_INSTANCE' | 'AWS_RDS_MYSQL_CLUSTER' | 'AWS_RDS_MYSQL_INSTANCE' | 'AWS_ACCOUNT' | 'AWS_SSO_PERMISSION_SET' | 'AWS_ORGANIZATIONAL_UNIT' | 'AZURE_MANAGEMENT_GROUP' | 'AZURE_RESOURCE_GROUP' | 'AZURE_SUBSCRIPTION' | 'AZURE_VIRTUAL_MACHINE' | 'AZURE_STORAGE_ACCOUNT' | 'AZURE_STORAGE_CONTAINER' | 'AZURE_SQL_SERVER' | 'AZURE_SQL_MANAGED_INSTANCE' | 'AZURE_SQL_DATABASE' | 'AZURE_SQL_MANAGED_DATABASE' | 'AZURE_USER_ASSIGNED_MANAGED_Identity' | 'AZURE_ENTRA_ID_ROLE' | 'AZURE_ENTERPRISE_APP' | 'CUSTOM' | 'CUSTOM_CONNECTOR' | 'DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL' | 'GCP_ORGANIZATION' | 'GCP_BUCKET' | 'GCP_COMPUTE_INSTANCE' | 'GCP_FOLDER' | 'GCP_GKE_CLUSTER' | 'GCP_PROJECT' | 'GCP_CLOUD_SQL_POSTGRES_INSTANCE' | 'GCP_CLOUD_SQL_MYSQL_INSTANCE' | 'GCP_BIG_QUERY_DATASET' | 'GCP_BIG_QUERY_TABLE' | 'GCP_SERVICE_ACCOUNT' | 'GIT_HUB_REPO' | 'GIT_HUB_ORG_ROLE' | 'GIT_LAB_PROJECT' | 'GOOGLE_WORKSPACE_ROLE' | 'MONGO_INSTANCE' | 'MONGO_ATLAS_INSTANCE' | 'NETSUITE_ROLE' | 'DATADOG_ROLE' | 'OKTA_APP' | 'OKTA_ROLE' | 'OPAL_ROLE' | 'OPAL_SCOPED_ROLE' | 'PAGERDUTY_ROLE' | 'TAILSCALE_SSH' | 'SALESFORCE_PERMISSION_SET' | 'SALESFORCE_PROFILE' | 'SALESFORCE_ROLE' | 'SNOWFLAKE_DATABASE' | 'SNOWFLAKE_SCHEMA' | 'SNOWFLAKE_TABLE' | 'WORKDAY_ROLE' | 'MYSQL_INSTANCE' | 'MARIADB_INSTANCE' | 'POSTGRES_INSTANCE' | 'TELEPORT_ROLE' | 'ILEVEL_ADVANCED_ROLE' | 'DATASTAX_ASTRA_ROLE' | 'COUPA_ROLE' | 'CURSOR_ORGANIZATION' | 'OPENAI_PLATFORM_PROJECT' | 'OPENAI_PLATFORM_SERVICE_ACCOUNT' | 'ANTHROPIC_WORKSPACE' | 'GIT_HUB_ORG' | 'ORACLE_FUSION_ROLE' | 'DEVIN_ORGANIZATION' | 'DEVIN_ROLE' | 'VAULT_SECRET' | 'VAULT_POLICY' | 'VAULT_OIDC_ROLE' | 'GIT_HUB_ENTERPRISE_ROLE' | 'GRAFANA_FOLDER' | 'GRAFANA_DASHBOARD' | 'GRAFANA_BASIC_ROLE' | 'GRAFANA_ROLE' | 'CLICKHOUSE_DATABASE' | 'CLICKHOUSE_TABLE' | 'TWINGATE_RESOURCE' | 'ZENDESK_ROLE' | 'HUBSPOT_ROLE' | 'ALICLOUD_RAM_ROLE' | 'ALICLOUD_ECS_INSTANCE' — The type of the resource. - `max_duration` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `require_manager_approval` boolean — A bool representing whether or not access requests to the resource require manager approval. - `require_support_ticket` boolean — A bool representing whether or not access requests to the resource require an access ticket. - `require_mfa_to_approve` boolean — A bool representing whether or not to require MFA for reviewers to approve requests for this resource. - `require_mfa_to_request` boolean — A bool representing whether or not to require MFA for requesting access to this resource. - `require_mfa_to_connect` boolean — A bool representing whether or not to require MFA to connect to this resource. - `auto_approval` boolean — A bool representing whether or not to automatically approve requests to this resource. - `request_template_id` string, uuid — The ID of the associated request template. - `is_requestable` boolean — A bool representing whether or not to allow access requests to this resource. - `parent_resource_id` string, uuid — The ID of the parent resource. - `configuration_template_id` string, uuid — The ID of the associated configuration template. - `request_configurations` RequestConfiguration[] — A list of configurations for requests to this resource. - `condition` Condition — # Condition Object ### Description The `Condition` object is used to represent a condition. ### Usage Example Used to match request configurations to users in `RequestConfiguration` - `group_ids` string[] — The list of group IDs to match. - `role_remote_ids` string[] — The list of role remote IDs to match. - `allow_requests` boolean, required — A bool representing whether or not to allow requests for this resource. - `auto_approval` boolean, required — A bool representing whether or not to automatically approve requests for this resource. - `require_mfa_to_request` boolean, required — A bool representing whether or not to require MFA for requesting access to this resource. - `max_duration_minutes` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration_minutes` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `require_support_ticket` boolean, required — A bool representing whether or not access requests to the resource require an access ticket. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `request_template_id` string, uuid — The ID of the associated request template. - `reviewer_stages` ReviewerStage[] — The list of reviewer stages for the request configuration. - `require_manager_approval` boolean, required — Whether this reviewer stage should require manager approval. - `require_admin_approval` boolean — Whether this reviewer stage should require admin approval. - `operator` 'AND' | 'OR', required — The operator of the reviewer stage. Admin and manager approval are also treated as reviewers. - `owner_ids` string[], required — The IDs of owners assigned as reviewers for this stage. - `service_user_ids` string[] — The IDs of service users assigned as reviewers for this stage. - `priority` integer, required — The priority of the request configuration. - `request_configuration_list` RequestConfiguration[] — A list of configurations for requests to this resource. Deprecated in favor of `request_configurations`. - `condition` Condition — # Condition Object ### Description The `Condition` object is used to represent a condition. ### Usage Example Used to match request configurations to users in `RequestConfiguration` - `group_ids` string[] — The list of group IDs to match. - `role_remote_ids` string[] — The list of role remote IDs to match. - `allow_requests` boolean, required — A bool representing whether or not to allow requests for this resource. - `auto_approval` boolean, required — A bool representing whether or not to automatically approve requests for this resource. - `require_mfa_to_request` boolean, required — A bool representing whether or not to require MFA for requesting access to this resource. - `max_duration_minutes` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration_minutes` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `require_support_ticket` boolean, required — A bool representing whether or not access requests to the resource require an access ticket. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `request_template_id` string, uuid — The ID of the associated request template. - `reviewer_stages` ReviewerStage[] — The list of reviewer stages for the request configuration. - `require_manager_approval` boolean, required — Whether this reviewer stage should require manager approval. - `require_admin_approval` boolean — Whether this reviewer stage should require admin approval. - `operator` 'AND' | 'OR', required — The operator of the reviewer stage. Admin and manager approval are also treated as reviewers. - `owner_ids` string[], required — The IDs of owners assigned as reviewers for this stage. - `service_user_ids` string[] — The IDs of service users assigned as reviewers for this stage. - `priority` integer, required — The priority of the request configuration. - `ticket_propagation` TicketPropagationConfiguration — Configuration for ticket propagation, when enabled, a ticket will be created for access changes related to the users in this resource. - `enabled_on_grant` boolean, required - `enabled_on_revocation` boolean, required - `ticket_provider` 'JIRA' | 'LINEAR' | 'SERVICE_NOW' — The third party ticketing platform provider. - `ticket_project_id` string - `custom_request_notification` string, nullable — Custom request notification sent upon request approval. - `risk_sensitivity` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `risk_sensitivity_override` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `metadata` string — JSON metadata about the remote resource. Only set for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details. - `remote_info` ResourceRemoteInfo — Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields. - `databricks_account_service_principal` object — Remote info for Databricks account service principal. - `application_id` string, required — The application ID of the service principal. - `resource_id` string, required — The resource ID of the service principal. - `azure_subscription` object — Remote info for Azure subscription. - `resource_id` string, required — The ARM resource ID of the subscription. - `azure_resource_group` object — Remote info for Azure resource group. - `resource_id` string, required — The ARM resource ID of the resource group. - `azure_management_group` object — Remote info for Azure management group. - `resource_id` string, required — The ARM resource ID of the management group. - `azure_virtual_machine` object — Remote info for Azure virtual machine. - `resource_id` string, required — The ARM resource ID of the virtual machine. - `azure_storage_account` object — Remote info for Azure storage account. - `resource_id` string, required — The ARM resource ID of the storage account. - `azure_storage_container` object — Remote info for Azure storage container. - `resource_id` string, required — The ARM resource ID of the storage container. - `azure_sql_server` object — Remote info for Azure SQL server. - `resource_id` string, required — The ARM resource ID of the SQL server. - `azure_sql_database` object — Remote info for Azure SQL database. - `resource_id` string, required — The ARM resource ID of the SQL database. - `azure_sql_managed_instance` object — Remote info for Azure SQL managed instance. - `resource_id` string, required — The ARM resource ID of the SQL managed instance. - `azure_sql_managed_database` object — Remote info for Azure SQL managed database. - `resource_id` string, required — The ARM resource ID of the SQL managed database. - `azure_user_assigned_managed_identity` object — Remote info for Azure user assigned managed identity. - `resource_id` string, required — The ARM resource ID of the user assigned managed identity. - `azure_enterprise_app` object — Remote info for Azure Enterprise App. - `resource_id` string, required — The remote application identifier (service principal or application object ID). - `azure_entra_id_role` object — Remote info for Azure Entra ID role. - `resource_id` string, required — The remote role identifier from Entra (object ID). - `aws_organizational_unit` object — Remote info for AWS organizational unit. - `parent_id` string — The id of the parent organizational unit. - `organizational_unit_id` string, required — The id of the AWS organizational unit that is being created. - `aws_account` object — Remote info for AWS account. - `account_id` string, required — The id of the AWS account. - `organizational_unit_id` string — The id of the AWS organizational unit. Required only if customer has OUs enabled. - `aws_permission_set` object — Remote info for AWS Identity Center permission set. - `arn` string, required — The ARN of the permission set. - `account_id` string, required — The ID of an AWS account to which this permission set is provisioned. - `aws_iam_role` object — Remote info for AWS IAM role. - `arn` string, required — The ARN of the IAM role. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_ec2_instance` object — Remote info for AWS EC2 instance. - `instance_id` string, required — The instanceId of the EC2 instance. - `region` string, required — The region of the EC2 instance. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_rds_cluster` object — Remote info for AWS RDS cluster. - `cluster_id` string, required — The clusterId of the RDS cluster. - `region` string, required — The region of the RDS cluster. - `resource_id` string, required — The resourceId of the RDS cluster. - `account_id` string, required — The id of the AWS account. Required for AWS Organizations. - `database_name` string, required — The name of the database in the RDS cluster. This can be the value of the tag `opal:database-name` or the database name. - `engine` 'MYSQL' | 'POSTGRESQL', required — The database engine for the RDS instance. - `aws_rds_instance` object — Remote info for AWS RDS instance. - `instance_id` string, required — The instanceId of the RDS instance. - `region` string, required — The region of the RDS instance. - `resource_id` string, required — The resourceId of the RDS instance. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_eks_cluster` object — Remote info for AWS EKS cluster. - `arn` string, required — The ARN of the EKS cluster. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `custom_connector` object — Remote info for a custom connector resource. - `remote_resource_id` string, required — The id of the resource in the end system - `can_have_usage_events` boolean, required — A bool representing whether or not the resource can have usage data. - `gcp_organization` object — Remote info for GCP organization. - `organization_id` string, required — The id of the organization. - `gcp_bucket` object — Remote info for GCP bucket. - `bucket_id` string, required — The id of the bucket. - `gcp_compute_instance` object — Remote info for GCP compute instance. - `instance_id` string, required — The id of the instance. - `project_id` string, required — The id of the project the instance is in. - `zone` string, required — The zone the instance is in. - `gcp_big_query_dataset` object — Remote info for GCP BigQuery Dataset. - `project_id` string, required — The id of the project the dataset is in. - `dataset_id` string, required — The id of the dataset. - `gcp_big_query_table` object — Remote info for GCP BigQuery Table. - `project_id` string, required — The id of the project the table is in. - `dataset_id` string, required — The id of the dataset the table is in. - `table_id` string, required — The id of the table. - `gcp_folder` object — Remote info for GCP folder. - `folder_id` string, required — The id of the folder. - `gcp_gke_cluster` object — Remote info for GCP GKE cluster. - `cluster_name` string, required — The name of the GKE cluster. - `gcp_project` object — Remote info for GCP project. - `project_id` string, required — The id of the project. - `gcp_sql_instance` object — Remote info for GCP SQL instance. - `instance_id` string, required — The id of the SQL instance. - `project_id` string, required — The id of the project the instance is in. - `gcp_service_account` object — Remote info for a GCP service account. - `email` string, required — The email of the service account. - `service_account_id` string, required — The id of the service account. - `project_id` string, required — The id of the project the service account is in. - `google_workspace_role` object — Remote info for GCP workspace role. - `role_id` string, required — The id of the role. - `github_repo` object — Remote info for GitHub repository. - `repo_id` string — The id of the repository. - `repo_name` string, required — The name of the repository. - `org_name` string — GitHub repo's org name, required only for Enterprise. - `github_org_role` object — Remote info for GitHub organization role. - `role_id` string, required — The id of the role. - `org_name` string — GitHub org role's org name, required only for Enterprise. - `github_org` object — Remote info for GitHub organization. - `org_name` string, required — The name of the organization. - `github_enterprise_role` object — Remote info for GitHub Enterprise role. - `role_id` string, required — The id of the role. - `gitlab_project` object — Remote info for Gitlab project. - `project_id` string, required — The id of the project. - `okta_app` object — Remote info for Okta directory app. - `app_id` string, required — The id of the app. - `okta_standard_role` object — Remote info for Okta directory standard role. - `role_type` string, required — The type of the standard role. - `okta_custom_role` object — Remote info for Okta directory custom role. - `role_id` string, required — The id of the custom role. - `snowflake_database` object — Remote info for Snowflake database. - `database_name` string, required — The name of the database. - `snowflake_schema` object — Remote info for Snowflake schema. - `database_name` string, required — The name of the database the schema is in. - `schema_name` string, required — The name of the schema. - `snowflake_table` object — Remote info for Snowflake table. - `database_name` string, required — The name of the database the table is in. - `schema_name` string, required — The name of the schema the table is in. - `table_name` string, required — The name of the table. - `ilevel_advanced_role` object — Remote info for iLevel Advanced role. - `role_name` string, required — The name of the role. - `tailscale_ssh` object — Remote info for Tailscale SSH tag. - `tag_name` string, required — The name of the tag. - `twingate_resource` object — Remote info for Twingate resource. - `resource_id` string, required — The id of the Twingate resource. - `pagerduty_role` object — Remote info for Pagerduty role. - `role_name` string, required — The name of the role. - `workday_role` object — Remote info for Workday role. - `role_id` string, required — The id of the role. - `salesforce_permission_set` object — Remote info for Salesforce permission set. - `permission_set_id` string, required — The id of the permission set. - `salesforce_profile` object — Remote info for Salesforce profile. - `profile_id` string, required — The id of the permission set. - `user_license_id` string, required — The id of the user license. - `salesforce_role` object — Remote info for Salesforce role. - `role_id` string, required — The id of the role. - `teleport_role` object — Remote info for Teleport role. - `role_name` string, required — The name role. - `datastax_astra_role` object — Remote info for an Astra role. - `role_id` string, required — The id of the role. - `coupa_role` object — Remote info for Coupa role. - `role_id` string, required — The id of the role. - `cursor_organization` object — Remote info for a Cursor organization. - `org_id` string, required — The id of the organization. - `openai_platform_project` object — Remote info for OpenAI Platform project. - `project_id` string, required — The id of the project. - `openai_platform_service_account` object — Remote info for OpenAI Platform service account. - `project_id` string, required — The id of the project for the service account. - `service_account_id` string, required — The id of the service account. - `anthropic_workspace` object — Remote info for Anthropic workspace. - `workspace_id` string, required — The id of the workspace. - `oracle_fusion_role` object — Remote info for Oracle Fusion role. - `role_id` string, required — The id of the role. - `devin_organization` object — Remote info for Devin organization. - `org_id` string, required — The id of the organization. - `devin_role` object — Remote info for Devin role. - `role_id` string, required — The id of the role. - `netsuite_role` object — Remote info for NetSuite role. - `role_id` string, required — The id of the role. - `datadog_role` object — Remote info for Datadog role. - `role_id` string, required — The id of the role. - `clickhouse_database` object — Remote info for ClickHouse database. - `database_name` string, required — The name of the ClickHouse database. - `clickhouse_table` object — Remote info for ClickHouse table. - `database_name` string, required — The name of the ClickHouse database containing the table. - `table_name` string, required — The name of the ClickHouse table. - `grafana_folder` object — Remote info for Grafana folder. - `folder_uid` string, required — The UID of the Grafana folder. - `grafana_dashboard` object — Remote info for Grafana dashboard. - `dashboard_uid` string, required — The UID of the Grafana dashboard. - `grafana_role` object — Remote info for Grafana role(fixed or custom). - `role_uid` string, required — The UID of the Grafana role. - `zendesk_role` object — Remote info for Zendesk custom role. - `role_id` string, required — The ID of the Zendesk custom role. - `hubspot_role` object — Remote info for HubSpot role. - `role_id` string, required — The ID of the HubSpot role. - `alicloud_ram_role` object — Remote info for AliCloud RAM role. - `role_arn` string, required — The ARN of the AliCloud RAM role. - `alicloud_ecs_instance` object — Remote info for AliCloud ECS instance. - `instance_id` string, required — The ID of the ECS instance. - `ancestor_resource_ids` string[] — List of resource IDs that are ancestors of this resource. - `descendant_resource_ids` string[] — List of resource IDs that are descendants of this resource. - `match_remote_name` boolean — A bool representing whether or not the resource's name is synced from the end system. When true, the name is overwritten with the remote name on each sync. Defaults to false. - `match_remote_description` boolean — A bool representing whether or not the resource's description is synced from the end system. When true, the description is overwritten with the remote description on each sync. Defaults to false. - `last_successful_sync` SyncTask — Represents a sync task that has been completed, either successfully or with errors. - `id` string, uuid, required — The ID of the sync task. - `completed_at` string, date-time, required — The time when the sync task was completed. --- [API](https://skmtc.net/opal/apis/opal-api.md) · [All operations](https://skmtc.net/opal/apis/opal-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/opal/opal-api/versions/13b58df96d40/schema)