--- title: "POST /resources" method: POST path: "/resources" tags: ["resources"] --- # POST /resources `POST /resources` Creates a resource. See [here](https://docs.opal.dev/reference/end-system-objects) for details about importing resources. ## Request body - CreateResourceInfo — # CreateResourceInfo Object ### Description The `CreateResourceInfo` object is used to store creation info for a resource. ### Usage Example Use in the `POST Resources` endpoint. - `name` string, required — The name of the remote resource. - `description` string — A description of the remote resource. - `resource_type` 'AWS_IAM_ROLE' | 'AWS_EC2_INSTANCE' | 'AWS_EKS_CLUSTER' | 'AWS_RDS_POSTGRES_CLUSTER' | 'AWS_RDS_POSTGRES_INSTANCE' | 'AWS_RDS_MYSQL_CLUSTER' | 'AWS_RDS_MYSQL_INSTANCE' | 'AWS_ACCOUNT' | 'AWS_SSO_PERMISSION_SET' | 'AWS_ORGANIZATIONAL_UNIT' | 'AZURE_MANAGEMENT_GROUP' | 'AZURE_RESOURCE_GROUP' | 'AZURE_SUBSCRIPTION' | 'AZURE_VIRTUAL_MACHINE' | 'AZURE_STORAGE_ACCOUNT' | 'AZURE_STORAGE_CONTAINER' | 'AZURE_SQL_SERVER' | 'AZURE_SQL_MANAGED_INSTANCE' | 'AZURE_SQL_DATABASE' | 'AZURE_SQL_MANAGED_DATABASE' | 'AZURE_USER_ASSIGNED_MANAGED_Identity' | 'AZURE_ENTRA_ID_ROLE' | 'AZURE_ENTERPRISE_APP' | 'CUSTOM' | 'CUSTOM_CONNECTOR' | 'DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL' | 'GCP_ORGANIZATION' | 'GCP_BUCKET' | 'GCP_COMPUTE_INSTANCE' | 'GCP_FOLDER' | 'GCP_GKE_CLUSTER' | 'GCP_PROJECT' | 'GCP_CLOUD_SQL_POSTGRES_INSTANCE' | 'GCP_CLOUD_SQL_MYSQL_INSTANCE' | 'GCP_BIG_QUERY_DATASET' | 'GCP_BIG_QUERY_TABLE' | 'GCP_SERVICE_ACCOUNT' | 'GIT_HUB_REPO' | 'GIT_HUB_ORG_ROLE' | 'GIT_LAB_PROJECT' | 'GOOGLE_WORKSPACE_ROLE' | 'MONGO_INSTANCE' | 'MONGO_ATLAS_INSTANCE' | 'NETSUITE_ROLE' | 'DATADOG_ROLE' | 'OKTA_APP' | 'OKTA_ROLE' | 'OPAL_ROLE' | 'OPAL_SCOPED_ROLE' | 'PAGERDUTY_ROLE' | 'TAILSCALE_SSH' | 'SALESFORCE_PERMISSION_SET' | 'SALESFORCE_PROFILE' | 'SALESFORCE_ROLE' | 'SNOWFLAKE_DATABASE' | 'SNOWFLAKE_SCHEMA' | 'SNOWFLAKE_TABLE' | 'WORKDAY_ROLE' | 'MYSQL_INSTANCE' | 'MARIADB_INSTANCE' | 'POSTGRES_INSTANCE' | 'TELEPORT_ROLE' | 'ILEVEL_ADVANCED_ROLE' | 'DATASTAX_ASTRA_ROLE' | 'COUPA_ROLE' | 'CURSOR_ORGANIZATION' | 'OPENAI_PLATFORM_PROJECT' | 'OPENAI_PLATFORM_SERVICE_ACCOUNT' | 'ANTHROPIC_WORKSPACE' | 'GIT_HUB_ORG' | 'ORACLE_FUSION_ROLE' | 'DEVIN_ORGANIZATION' | 'DEVIN_ROLE' | 'VAULT_SECRET' | 'VAULT_POLICY' | 'VAULT_OIDC_ROLE' | 'GIT_HUB_ENTERPRISE_ROLE' | 'GRAFANA_FOLDER' | 'GRAFANA_DASHBOARD' | 'GRAFANA_BASIC_ROLE' | 'GRAFANA_ROLE' | 'CLICKHOUSE_DATABASE' | 'CLICKHOUSE_TABLE' | 'TWINGATE_RESOURCE' | 'ZENDESK_ROLE' | 'HUBSPOT_ROLE' | 'ALICLOUD_RAM_ROLE' | 'ALICLOUD_ECS_INSTANCE', required — The type of the resource. - `app_id` string, uuid, required — The ID of the app for the resource. - `remote_info` ResourceRemoteInfo — Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields. - `databricks_account_service_principal` object — Remote info for Databricks account service principal. - `application_id` string, required — The application ID of the service principal. - `resource_id` string, required — The resource ID of the service principal. - `azure_subscription` object — Remote info for Azure subscription. - `resource_id` string, required — The ARM resource ID of the subscription. - `azure_resource_group` object — Remote info for Azure resource group. - `resource_id` string, required — The ARM resource ID of the resource group. - `azure_management_group` object — Remote info for Azure management group. - `resource_id` string, required — The ARM resource ID of the management group. - `azure_virtual_machine` object — Remote info for Azure virtual machine. - `resource_id` string, required — The ARM resource ID of the virtual machine. - `azure_storage_account` object — Remote info for Azure storage account. - `resource_id` string, required — The ARM resource ID of the storage account. - `azure_storage_container` object — Remote info for Azure storage container. - `resource_id` string, required — The ARM resource ID of the storage container. - `azure_sql_server` object — Remote info for Azure SQL server. - `resource_id` string, required — The ARM resource ID of the SQL server. - `azure_sql_database` object — Remote info for Azure SQL database. - `resource_id` string, required — The ARM resource ID of the SQL database. - `azure_sql_managed_instance` object — Remote info for Azure SQL managed instance. - `resource_id` string, required — The ARM resource ID of the SQL managed instance. - `azure_sql_managed_database` object — Remote info for Azure SQL managed database. - `resource_id` string, required — The ARM resource ID of the SQL managed database. - `azure_user_assigned_managed_identity` object — Remote info for Azure user assigned managed identity. - `resource_id` string, required — The ARM resource ID of the user assigned managed identity. - `azure_enterprise_app` object — Remote info for Azure Enterprise App. - `resource_id` string, required — The remote application identifier (service principal or application object ID). - `azure_entra_id_role` object — Remote info for Azure Entra ID role. - `resource_id` string, required — The remote role identifier from Entra (object ID). - `aws_organizational_unit` object — Remote info for AWS organizational unit. - `parent_id` string — The id of the parent organizational unit. - `organizational_unit_id` string, required — The id of the AWS organizational unit that is being created. - `aws_account` object — Remote info for AWS account. - `account_id` string, required — The id of the AWS account. - `organizational_unit_id` string — The id of the AWS organizational unit. Required only if customer has OUs enabled. - `aws_permission_set` object — Remote info for AWS Identity Center permission set. - `arn` string, required — The ARN of the permission set. - `account_id` string, required — The ID of an AWS account to which this permission set is provisioned. - `aws_iam_role` object — Remote info for AWS IAM role. - `arn` string, required — The ARN of the IAM role. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_ec2_instance` object — Remote info for AWS EC2 instance. - `instance_id` string, required — The instanceId of the EC2 instance. - `region` string, required — The region of the EC2 instance. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_rds_cluster` object — Remote info for AWS RDS cluster. - `cluster_id` string, required — The clusterId of the RDS cluster. - `region` string, required — The region of the RDS cluster. - `resource_id` string, required — The resourceId of the RDS cluster. - `account_id` string, required — The id of the AWS account. Required for AWS Organizations. - `database_name` string, required — The name of the database in the RDS cluster. This can be the value of the tag `opal:database-name` or the database name. - `engine` 'MYSQL' | 'POSTGRESQL', required — The database engine for the RDS instance. - `aws_rds_instance` object — Remote info for AWS RDS instance. - `instance_id` string, required — The instanceId of the RDS instance. - `region` string, required — The region of the RDS instance. - `resource_id` string, required — The resourceId of the RDS instance. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_eks_cluster` object — Remote info for AWS EKS cluster. - `arn` string, required — The ARN of the EKS cluster. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `custom_connector` object — Remote info for a custom connector resource. - `remote_resource_id` string, required — The id of the resource in the end system - `can_have_usage_events` boolean, required — A bool representing whether or not the resource can have usage data. - `gcp_organization` object — Remote info for GCP organization. - `organization_id` string, required — The id of the organization. - `gcp_bucket` object — Remote info for GCP bucket. - `bucket_id` string, required — The id of the bucket. - `gcp_compute_instance` object — Remote info for GCP compute instance. - `instance_id` string, required — The id of the instance. - `project_id` string, required — The id of the project the instance is in. - `zone` string, required — The zone the instance is in. - `gcp_big_query_dataset` object — Remote info for GCP BigQuery Dataset. - `project_id` string, required — The id of the project the dataset is in. - `dataset_id` string, required — The id of the dataset. - `gcp_big_query_table` object — Remote info for GCP BigQuery Table. - `project_id` string, required — The id of the project the table is in. - `dataset_id` string, required — The id of the dataset the table is in. - `table_id` string, required — The id of the table. - `gcp_folder` object — Remote info for GCP folder. - `folder_id` string, required — The id of the folder. - `gcp_gke_cluster` object — Remote info for GCP GKE cluster. - `cluster_name` string, required — The name of the GKE cluster. - `gcp_project` object — Remote info for GCP project. - `project_id` string, required — The id of the project. - `gcp_sql_instance` object — Remote info for GCP SQL instance. - `instance_id` string, required — The id of the SQL instance. - `project_id` string, required — The id of the project the instance is in. - `gcp_service_account` object — Remote info for a GCP service account. - `email` string, required — The email of the service account. - `service_account_id` string, required — The id of the service account. - `project_id` string, required — The id of the project the service account is in. - `google_workspace_role` object — Remote info for GCP workspace role. - `role_id` string, required — The id of the role. - `github_repo` object — Remote info for GitHub repository. - `repo_id` string — The id of the repository. - `repo_name` string, required — The name of the repository. - `org_name` string — GitHub repo's org name, required only for Enterprise. - `github_org_role` object — Remote info for GitHub organization role. - `role_id` string, required — The id of the role. - `org_name` string — GitHub org role's org name, required only for Enterprise. - `github_org` object — Remote info for GitHub organization. - `org_name` string, required — The name of the organization. - `github_enterprise_role` object — Remote info for GitHub Enterprise role. - `role_id` string, required — The id of the role. - `gitlab_project` object — Remote info for Gitlab project. - `project_id` string, required — The id of the project. - `okta_app` object — Remote info for Okta directory app. - `app_id` string, required — The id of the app. - `okta_standard_role` object — Remote info for Okta directory standard role. - `role_type` string, required — The type of the standard role. - `okta_custom_role` object — Remote info for Okta directory custom role. - `role_id` string, required — The id of the custom role. - `snowflake_database` object — Remote info for Snowflake database. - `database_name` string, required — The name of the database. - `snowflake_schema` object — Remote info for Snowflake schema. - `database_name` string, required — The name of the database the schema is in. - `schema_name` string, required — The name of the schema. - `snowflake_table` object — Remote info for Snowflake table. - `database_name` string, required — The name of the database the table is in. - `schema_name` string, required — The name of the schema the table is in. - `table_name` string, required — The name of the table. - `ilevel_advanced_role` object — Remote info for iLevel Advanced role. - `role_name` string, required — The name of the role. - `tailscale_ssh` object — Remote info for Tailscale SSH tag. - `tag_name` string, required — The name of the tag. - `twingate_resource` object — Remote info for Twingate resource. - `resource_id` string, required — The id of the Twingate resource. - `pagerduty_role` object — Remote info for Pagerduty role. - `role_name` string, required — The name of the role. - `workday_role` object — Remote info for Workday role. - `role_id` string, required — The id of the role. - `salesforce_permission_set` object — Remote info for Salesforce permission set. - `permission_set_id` string, required — The id of the permission set. - `salesforce_profile` object — Remote info for Salesforce profile. - `profile_id` string, required — The id of the permission set. - `user_license_id` string, required — The id of the user license. - `salesforce_role` object — Remote info for Salesforce role. - `role_id` string, required — The id of the role. - `teleport_role` object — Remote info for Teleport role. - `role_name` string, required — The name role. - `datastax_astra_role` object — Remote info for an Astra role. - `role_id` string, required — The id of the role. - `coupa_role` object — Remote info for Coupa role. - `role_id` string, required — The id of the role. - `cursor_organization` object — Remote info for a Cursor organization. - `org_id` string, required — The id of the organization. - `openai_platform_project` object — Remote info for OpenAI Platform project. - `project_id` string, required — The id of the project. - `openai_platform_service_account` object — Remote info for OpenAI Platform service account. - `project_id` string, required — The id of the project for the service account. - `service_account_id` string, required — The id of the service account. - `anthropic_workspace` object — Remote info for Anthropic workspace. - `workspace_id` string, required — The id of the workspace. - `oracle_fusion_role` object — Remote info for Oracle Fusion role. - `role_id` string, required — The id of the role. - `devin_organization` object — Remote info for Devin organization. - `org_id` string, required — The id of the organization. - `devin_role` object — Remote info for Devin role. - `role_id` string, required — The id of the role. - `netsuite_role` object — Remote info for NetSuite role. - `role_id` string, required — The id of the role. - `datadog_role` object — Remote info for Datadog role. - `role_id` string, required — The id of the role. - `clickhouse_database` object — Remote info for ClickHouse database. - `database_name` string, required — The name of the ClickHouse database. - `clickhouse_table` object — Remote info for ClickHouse table. - `database_name` string, required — The name of the ClickHouse database containing the table. - `table_name` string, required — The name of the ClickHouse table. - `grafana_folder` object — Remote info for Grafana folder. - `folder_uid` string, required — The UID of the Grafana folder. - `grafana_dashboard` object — Remote info for Grafana dashboard. - `dashboard_uid` string, required — The UID of the Grafana dashboard. - `grafana_role` object — Remote info for Grafana role(fixed or custom). - `role_uid` string, required — The UID of the Grafana role. - `zendesk_role` object — Remote info for Zendesk custom role. - `role_id` string, required — The ID of the Zendesk custom role. - `hubspot_role` object — Remote info for HubSpot role. - `role_id` string, required — The ID of the HubSpot role. - `alicloud_ram_role` object — Remote info for AliCloud RAM role. - `role_arn` string, required — The ARN of the AliCloud RAM role. - `alicloud_ecs_instance` object — Remote info for AliCloud ECS instance. - `instance_id` string, required — The ID of the ECS instance. - `remote_resource_id` string — Deprecated - use remote_info instead. The ID of the resource on the remote system. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field. - `metadata` string — Deprecated - use remote_info instead. JSON metadata about the remote resource. Include only for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details on how to specify this field. The required format is dependent on resource_type and should have the following schema: ```json { "$schema": "http://json-schema.org/draft-04/schema#", "title": "Resource Metadata", "properties": { "aws_ec2_instance": { "properties": { "instance_id": { "type": "string" }, "region": { "type": "string" } }, "required": ["instance_id", "region"], "additionalProperties": false, "type": "object", "title": "AWS EC2 Instance" }, "aws_eks_cluster": { "properties": { "cluster_name": { "type": "string" }, "cluster_region": { "type": "string" }, "cluster_arn": { "type": "string" } }, "required": ["cluster_name", "cluster_region", "cluster_arn"], "additionalProperties": false, "type": "object", "title": "AWS EKS Cluster" }, "aws_rds_instance": { "properties": { "instance_id": { "type": "string" }, "engine": { "type": "string" }, "region": { "type": "string" }, "resource_id": { "type": "string" }, "database_name": { "type": "string" } }, "required": [ "instance_id", "engine", "region", "resource_id", "database_name" ], "additionalProperties": false, "type": "object", "title": "AWS RDS Instance" }, "aws_role": { "properties": { "arn": { "type": "string" }, "name": { "type": "string" } }, "required": ["arn", "name"], "additionalProperties": false, "type": "object", "title": "AWS Role" }, "gcp_bucket": { "properties": { "bucket_id": { "type": "string" } }, "required": ["bucket_id"], "additionalProperties": false, "type": "object", "title": "GCP Bucket" }, "gcp_compute_instance": { "properties": { "instance_id": { "type": "string" }, "project_id": { "type": "string" }, "zone": { "type": "string" } }, "required": ["instance_id", "project_id", "zone"], "additionalProperties": false, "type": "object", "title": "GCP Compute Instance" }, "gcp_folder": { "properties": { "folder_id": { "type": "string" } }, "required": ["folder_id"], "additionalProperties": false, "type": "object", "title": "GCP Folder" }, "gcp_gke_cluster": { "properties": { "cluster_name": { "type": "string" } }, "required": ["cluster_name"], "additionalProperties": false, "type": "object", "title": "GCP GKE Cluster" }, "gcp_project": { "properties": { "project_id": { "type": "string" } }, "required": ["project_id"], "additionalProperties": false, "type": "object", "title": "GCP Project" }, "gcp_sql_instance": { "properties": { "instance_id": { "type": "string" }, "project_id": { "type": "string" } }, "required": ["instance_id", "project_id"], "additionalProperties": false, "type": "object", "title": "GCP SQL Instance" }, "git_hub_repo": { "properties": { "org_name": { "type": "string" }, "repo_name": { "type": "string" } }, "required": ["org_name", "repo_name"], "additionalProperties": false, "type": "object", "title": "GitHub Repo" }, "okta_directory_app": { "properties": { "app_id": { "type": "string" }, "logo_url": { "type": "string" } }, "required": ["app_id", "logo_url"], "additionalProperties": false, "type": "object", "title": "Okta Directory App" }, "okta_directory_role": { "properties": { "role_type": { "type": "string" }, "role_id": { "type": "string" } }, "required": ["role_type", "role_id"], "additionalProperties": false, "type": "object", "title": "Okta Directory Role" }, "salesforce_profile": { "properties": { "user_license": { "type": "string" } }, "required": ["user_license"], "additionalProperties": false, "type": "object", "title": "Salesforce Profile" } }, "additionalProperties": false, "minProperties": 1, "maxProperties": 1, "type": "object" } ``` - `custom_request_notification` string, nullable — Custom request notification sent upon request approval. - `risk_sensitivity_override` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `match_remote_name` boolean — A bool representing whether or not the resource's name should be synced from the end system. When true, the name is overwritten with the remote name on each sync, so a `name` provided together with this field set to true will be replaced at the next sync. Defaults to false. - `match_remote_description` boolean — A bool representing whether or not the resource's description should be synced from the end system. When true, the description is overwritten with the remote description on each sync, so a `description` provided together with this field set to true will be replaced at the next sync. Defaults to false. ## Response `200` The resource just created. - Resource — # Resource Object ### Description The `Resource` object is used to represent a resource. ### Usage Example Update from the `UPDATE Resources` endpoint. - `resource_id` string, uuid, required — The ID of the resource. - `app_id` string, uuid — The ID of the app. - `name` string — The name of the resource. - `description` string — A description of the resource. - `admin_owner_id` string, uuid — The ID of the owner of the resource. - `remote_resource_id` string — The ID of the resource on the remote system. - `remote_resource_name` string — The name of the resource on the remote system. - `resource_type` 'AWS_IAM_ROLE' | 'AWS_EC2_INSTANCE' | 'AWS_EKS_CLUSTER' | 'AWS_RDS_POSTGRES_CLUSTER' | 'AWS_RDS_POSTGRES_INSTANCE' | 'AWS_RDS_MYSQL_CLUSTER' | 'AWS_RDS_MYSQL_INSTANCE' | 'AWS_ACCOUNT' | 'AWS_SSO_PERMISSION_SET' | 'AWS_ORGANIZATIONAL_UNIT' | 'AZURE_MANAGEMENT_GROUP' | 'AZURE_RESOURCE_GROUP' | 'AZURE_SUBSCRIPTION' | 'AZURE_VIRTUAL_MACHINE' | 'AZURE_STORAGE_ACCOUNT' | 'AZURE_STORAGE_CONTAINER' | 'AZURE_SQL_SERVER' | 'AZURE_SQL_MANAGED_INSTANCE' | 'AZURE_SQL_DATABASE' | 'AZURE_SQL_MANAGED_DATABASE' | 'AZURE_USER_ASSIGNED_MANAGED_Identity' | 'AZURE_ENTRA_ID_ROLE' | 'AZURE_ENTERPRISE_APP' | 'CUSTOM' | 'CUSTOM_CONNECTOR' | 'DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL' | 'GCP_ORGANIZATION' | 'GCP_BUCKET' | 'GCP_COMPUTE_INSTANCE' | 'GCP_FOLDER' | 'GCP_GKE_CLUSTER' | 'GCP_PROJECT' | 'GCP_CLOUD_SQL_POSTGRES_INSTANCE' | 'GCP_CLOUD_SQL_MYSQL_INSTANCE' | 'GCP_BIG_QUERY_DATASET' | 'GCP_BIG_QUERY_TABLE' | 'GCP_SERVICE_ACCOUNT' | 'GIT_HUB_REPO' | 'GIT_HUB_ORG_ROLE' | 'GIT_LAB_PROJECT' | 'GOOGLE_WORKSPACE_ROLE' | 'MONGO_INSTANCE' | 'MONGO_ATLAS_INSTANCE' | 'NETSUITE_ROLE' | 'DATADOG_ROLE' | 'OKTA_APP' | 'OKTA_ROLE' | 'OPAL_ROLE' | 'OPAL_SCOPED_ROLE' | 'PAGERDUTY_ROLE' | 'TAILSCALE_SSH' | 'SALESFORCE_PERMISSION_SET' | 'SALESFORCE_PROFILE' | 'SALESFORCE_ROLE' | 'SNOWFLAKE_DATABASE' | 'SNOWFLAKE_SCHEMA' | 'SNOWFLAKE_TABLE' | 'WORKDAY_ROLE' | 'MYSQL_INSTANCE' | 'MARIADB_INSTANCE' | 'POSTGRES_INSTANCE' | 'TELEPORT_ROLE' | 'ILEVEL_ADVANCED_ROLE' | 'DATASTAX_ASTRA_ROLE' | 'COUPA_ROLE' | 'CURSOR_ORGANIZATION' | 'OPENAI_PLATFORM_PROJECT' | 'OPENAI_PLATFORM_SERVICE_ACCOUNT' | 'ANTHROPIC_WORKSPACE' | 'GIT_HUB_ORG' | 'ORACLE_FUSION_ROLE' | 'DEVIN_ORGANIZATION' | 'DEVIN_ROLE' | 'VAULT_SECRET' | 'VAULT_POLICY' | 'VAULT_OIDC_ROLE' | 'GIT_HUB_ENTERPRISE_ROLE' | 'GRAFANA_FOLDER' | 'GRAFANA_DASHBOARD' | 'GRAFANA_BASIC_ROLE' | 'GRAFANA_ROLE' | 'CLICKHOUSE_DATABASE' | 'CLICKHOUSE_TABLE' | 'TWINGATE_RESOURCE' | 'ZENDESK_ROLE' | 'HUBSPOT_ROLE' | 'ALICLOUD_RAM_ROLE' | 'ALICLOUD_ECS_INSTANCE' — The type of the resource. - `max_duration` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `require_manager_approval` boolean — A bool representing whether or not access requests to the resource require manager approval. - `require_support_ticket` boolean — A bool representing whether or not access requests to the resource require an access ticket. - `require_mfa_to_approve` boolean — A bool representing whether or not to require MFA for reviewers to approve requests for this resource. - `require_mfa_to_request` boolean — A bool representing whether or not to require MFA for requesting access to this resource. - `require_mfa_to_connect` boolean — A bool representing whether or not to require MFA to connect to this resource. - `auto_approval` boolean — A bool representing whether or not to automatically approve requests to this resource. - `request_template_id` string, uuid — The ID of the associated request template. - `is_requestable` boolean — A bool representing whether or not to allow access requests to this resource. - `parent_resource_id` string, uuid — The ID of the parent resource. - `configuration_template_id` string, uuid — The ID of the associated configuration template. - `request_configurations` RequestConfiguration[] — A list of configurations for requests to this resource. - `condition` Condition — # Condition Object ### Description The `Condition` object is used to represent a condition. ### Usage Example Used to match request configurations to users in `RequestConfiguration` - `group_ids` string[] — The list of group IDs to match. - `role_remote_ids` string[] — The list of role remote IDs to match. - `allow_requests` boolean, required — A bool representing whether or not to allow requests for this resource. - `auto_approval` boolean, required — A bool representing whether or not to automatically approve requests for this resource. - `require_mfa_to_request` boolean, required — A bool representing whether or not to require MFA for requesting access to this resource. - `max_duration_minutes` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration_minutes` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `require_support_ticket` boolean, required — A bool representing whether or not access requests to the resource require an access ticket. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `request_template_id` string, uuid — The ID of the associated request template. - `reviewer_stages` ReviewerStage[] — The list of reviewer stages for the request configuration. - `require_manager_approval` boolean, required — Whether this reviewer stage should require manager approval. - `require_admin_approval` boolean — Whether this reviewer stage should require admin approval. - `operator` 'AND' | 'OR', required — The operator of the reviewer stage. Admin and manager approval are also treated as reviewers. - `owner_ids` string[], required — The IDs of owners assigned as reviewers for this stage. - `service_user_ids` string[] — The IDs of service users assigned as reviewers for this stage. - `priority` integer, required — The priority of the request configuration. - `request_configuration_list` RequestConfiguration[] — A list of configurations for requests to this resource. Deprecated in favor of `request_configurations`. - `condition` Condition — # Condition Object ### Description The `Condition` object is used to represent a condition. ### Usage Example Used to match request configurations to users in `RequestConfiguration` - `group_ids` string[] — The list of group IDs to match. - `role_remote_ids` string[] — The list of role remote IDs to match. - `allow_requests` boolean, required — A bool representing whether or not to allow requests for this resource. - `auto_approval` boolean, required — A bool representing whether or not to automatically approve requests for this resource. - `require_mfa_to_request` boolean, required — A bool representing whether or not to require MFA for requesting access to this resource. - `max_duration_minutes` integer — The maximum duration for which the resource can be requested (in minutes). - `recommended_duration_minutes` integer — The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration. - `require_support_ticket` boolean, required — A bool representing whether or not access requests to the resource require an access ticket. - `extensions_duration_in_minutes` integer — The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration. - `request_template_id` string, uuid — The ID of the associated request template. - `reviewer_stages` ReviewerStage[] — The list of reviewer stages for the request configuration. - `require_manager_approval` boolean, required — Whether this reviewer stage should require manager approval. - `require_admin_approval` boolean — Whether this reviewer stage should require admin approval. - `operator` 'AND' | 'OR', required — The operator of the reviewer stage. Admin and manager approval are also treated as reviewers. - `owner_ids` string[], required — The IDs of owners assigned as reviewers for this stage. - `service_user_ids` string[] — The IDs of service users assigned as reviewers for this stage. - `priority` integer, required — The priority of the request configuration. - `ticket_propagation` TicketPropagationConfiguration — Configuration for ticket propagation, when enabled, a ticket will be created for access changes related to the users in this resource. - `enabled_on_grant` boolean, required - `enabled_on_revocation` boolean, required - `ticket_provider` 'JIRA' | 'LINEAR' | 'SERVICE_NOW' — The third party ticketing platform provider. - `ticket_project_id` string - `custom_request_notification` string, nullable — Custom request notification sent upon request approval. - `risk_sensitivity` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `risk_sensitivity_override` 'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE' — Indicates the level of potential impact misuse or unauthorized access may incur. - `metadata` string — JSON metadata about the remote resource. Only set for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details. - `remote_info` ResourceRemoteInfo — Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields. - `databricks_account_service_principal` object — Remote info for Databricks account service principal. - `application_id` string, required — The application ID of the service principal. - `resource_id` string, required — The resource ID of the service principal. - `azure_subscription` object — Remote info for Azure subscription. - `resource_id` string, required — The ARM resource ID of the subscription. - `azure_resource_group` object — Remote info for Azure resource group. - `resource_id` string, required — The ARM resource ID of the resource group. - `azure_management_group` object — Remote info for Azure management group. - `resource_id` string, required — The ARM resource ID of the management group. - `azure_virtual_machine` object — Remote info for Azure virtual machine. - `resource_id` string, required — The ARM resource ID of the virtual machine. - `azure_storage_account` object — Remote info for Azure storage account. - `resource_id` string, required — The ARM resource ID of the storage account. - `azure_storage_container` object — Remote info for Azure storage container. - `resource_id` string, required — The ARM resource ID of the storage container. - `azure_sql_server` object — Remote info for Azure SQL server. - `resource_id` string, required — The ARM resource ID of the SQL server. - `azure_sql_database` object — Remote info for Azure SQL database. - `resource_id` string, required — The ARM resource ID of the SQL database. - `azure_sql_managed_instance` object — Remote info for Azure SQL managed instance. - `resource_id` string, required — The ARM resource ID of the SQL managed instance. - `azure_sql_managed_database` object — Remote info for Azure SQL managed database. - `resource_id` string, required — The ARM resource ID of the SQL managed database. - `azure_user_assigned_managed_identity` object — Remote info for Azure user assigned managed identity. - `resource_id` string, required — The ARM resource ID of the user assigned managed identity. - `azure_enterprise_app` object — Remote info for Azure Enterprise App. - `resource_id` string, required — The remote application identifier (service principal or application object ID). - `azure_entra_id_role` object — Remote info for Azure Entra ID role. - `resource_id` string, required — The remote role identifier from Entra (object ID). - `aws_organizational_unit` object — Remote info for AWS organizational unit. - `parent_id` string — The id of the parent organizational unit. - `organizational_unit_id` string, required — The id of the AWS organizational unit that is being created. - `aws_account` object — Remote info for AWS account. - `account_id` string, required — The id of the AWS account. - `organizational_unit_id` string — The id of the AWS organizational unit. Required only if customer has OUs enabled. - `aws_permission_set` object — Remote info for AWS Identity Center permission set. - `arn` string, required — The ARN of the permission set. - `account_id` string, required — The ID of an AWS account to which this permission set is provisioned. - `aws_iam_role` object — Remote info for AWS IAM role. - `arn` string, required — The ARN of the IAM role. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_ec2_instance` object — Remote info for AWS EC2 instance. - `instance_id` string, required — The instanceId of the EC2 instance. - `region` string, required — The region of the EC2 instance. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_rds_cluster` object — Remote info for AWS RDS cluster. - `cluster_id` string, required — The clusterId of the RDS cluster. - `region` string, required — The region of the RDS cluster. - `resource_id` string, required — The resourceId of the RDS cluster. - `account_id` string, required — The id of the AWS account. Required for AWS Organizations. - `database_name` string, required — The name of the database in the RDS cluster. This can be the value of the tag `opal:database-name` or the database name. - `engine` 'MYSQL' | 'POSTGRESQL', required — The database engine for the RDS instance. - `aws_rds_instance` object — Remote info for AWS RDS instance. - `instance_id` string, required — The instanceId of the RDS instance. - `region` string, required — The region of the RDS instance. - `resource_id` string, required — The resourceId of the RDS instance. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `aws_eks_cluster` object — Remote info for AWS EKS cluster. - `arn` string, required — The ARN of the EKS cluster. - `account_id` string — The id of the AWS account. Required for AWS Organizations. - `custom_connector` object — Remote info for a custom connector resource. - `remote_resource_id` string, required — The id of the resource in the end system - `can_have_usage_events` boolean, required — A bool representing whether or not the resource can have usage data. - `gcp_organization` object — Remote info for GCP organization. - `organization_id` string, required — The id of the organization. - `gcp_bucket` object — Remote info for GCP bucket. - `bucket_id` string, required — The id of the bucket. - `gcp_compute_instance` object — Remote info for GCP compute instance. - `instance_id` string, required — The id of the instance. - `project_id` string, required — The id of the project the instance is in. - `zone` string, required — The zone the instance is in. - `gcp_big_query_dataset` object — Remote info for GCP BigQuery Dataset. - `project_id` string, required — The id of the project the dataset is in. - `dataset_id` string, required — The id of the dataset. - `gcp_big_query_table` object — Remote info for GCP BigQuery Table. - `project_id` string, required — The id of the project the table is in. - `dataset_id` string, required — The id of the dataset the table is in. - `table_id` string, required — The id of the table. - `gcp_folder` object — Remote info for GCP folder. - `folder_id` string, required — The id of the folder. - `gcp_gke_cluster` object — Remote info for GCP GKE cluster. - `cluster_name` string, required — The name of the GKE cluster. - `gcp_project` object — Remote info for GCP project. - `project_id` string, required — The id of the project. - `gcp_sql_instance` object — Remote info for GCP SQL instance. - `instance_id` string, required — The id of the SQL instance. - `project_id` string, required — The id of the project the instance is in. - `gcp_service_account` object — Remote info for a GCP service account. - `email` string, required — The email of the service account. - `service_account_id` string, required — The id of the service account. - `project_id` string, required — The id of the project the service account is in. - `google_workspace_role` object — Remote info for GCP workspace role. - `role_id` string, required — The id of the role. - `github_repo` object — Remote info for GitHub repository. - `repo_id` string — The id of the repository. - `repo_name` string, required — The name of the repository. - `org_name` string — GitHub repo's org name, required only for Enterprise. - `github_org_role` object — Remote info for GitHub organization role. - `role_id` string, required — The id of the role. - `org_name` string — GitHub org role's org name, required only for Enterprise. - `github_org` object — Remote info for GitHub organization. - `org_name` string, required — The name of the organization. - `github_enterprise_role` object — Remote info for GitHub Enterprise role. - `role_id` string, required — The id of the role. - `gitlab_project` object — Remote info for Gitlab project. - `project_id` string, required — The id of the project. - `okta_app` object — Remote info for Okta directory app. - `app_id` string, required — The id of the app. - `okta_standard_role` object — Remote info for Okta directory standard role. - `role_type` string, required — The type of the standard role. - `okta_custom_role` object — Remote info for Okta directory custom role. - `role_id` string, required — The id of the custom role. - `snowflake_database` object — Remote info for Snowflake database. - `database_name` string, required — The name of the database. - `snowflake_schema` object — Remote info for Snowflake schema. - `database_name` string, required — The name of the database the schema is in. - `schema_name` string, required — The name of the schema. - `snowflake_table` object — Remote info for Snowflake table. - `database_name` string, required — The name of the database the table is in. - `schema_name` string, required — The name of the schema the table is in. - `table_name` string, required — The name of the table. - `ilevel_advanced_role` object — Remote info for iLevel Advanced role. - `role_name` string, required — The name of the role. - `tailscale_ssh` object — Remote info for Tailscale SSH tag. - `tag_name` string, required — The name of the tag. - `twingate_resource` object — Remote info for Twingate resource. - `resource_id` string, required — The id of the Twingate resource. - `pagerduty_role` object — Remote info for Pagerduty role. - `role_name` string, required — The name of the role. - `workday_role` object — Remote info for Workday role. - `role_id` string, required — The id of the role. - `salesforce_permission_set` object — Remote info for Salesforce permission set. - `permission_set_id` string, required — The id of the permission set. - `salesforce_profile` object — Remote info for Salesforce profile. - `profile_id` string, required — The id of the permission set. - `user_license_id` string, required — The id of the user license. - `salesforce_role` object — Remote info for Salesforce role. - `role_id` string, required — The id of the role. - `teleport_role` object — Remote info for Teleport role. - `role_name` string, required — The name role. - `datastax_astra_role` object — Remote info for an Astra role. - `role_id` string, required — The id of the role. - `coupa_role` object — Remote info for Coupa role. - `role_id` string, required — The id of the role. - `cursor_organization` object — Remote info for a Cursor organization. - `org_id` string, required — The id of the organization. - `openai_platform_project` object — Remote info for OpenAI Platform project. - `project_id` string, required — The id of the project. - `openai_platform_service_account` object — Remote info for OpenAI Platform service account. - `project_id` string, required — The id of the project for the service account. - `service_account_id` string, required — The id of the service account. - `anthropic_workspace` object — Remote info for Anthropic workspace. - `workspace_id` string, required — The id of the workspace. - `oracle_fusion_role` object — Remote info for Oracle Fusion role. - `role_id` string, required — The id of the role. - `devin_organization` object — Remote info for Devin organization. - `org_id` string, required — The id of the organization. - `devin_role` object — Remote info for Devin role. - `role_id` string, required — The id of the role. - `netsuite_role` object — Remote info for NetSuite role. - `role_id` string, required — The id of the role. - `datadog_role` object — Remote info for Datadog role. - `role_id` string, required — The id of the role. - `clickhouse_database` object — Remote info for ClickHouse database. - `database_name` string, required — The name of the ClickHouse database. - `clickhouse_table` object — Remote info for ClickHouse table. - `database_name` string, required — The name of the ClickHouse database containing the table. - `table_name` string, required — The name of the ClickHouse table. - `grafana_folder` object — Remote info for Grafana folder. - `folder_uid` string, required — The UID of the Grafana folder. - `grafana_dashboard` object — Remote info for Grafana dashboard. - `dashboard_uid` string, required — The UID of the Grafana dashboard. - `grafana_role` object — Remote info for Grafana role(fixed or custom). - `role_uid` string, required — The UID of the Grafana role. - `zendesk_role` object — Remote info for Zendesk custom role. - `role_id` string, required — The ID of the Zendesk custom role. - `hubspot_role` object — Remote info for HubSpot role. - `role_id` string, required — The ID of the HubSpot role. - `alicloud_ram_role` object — Remote info for AliCloud RAM role. - `role_arn` string, required — The ARN of the AliCloud RAM role. - `alicloud_ecs_instance` object — Remote info for AliCloud ECS instance. - `instance_id` string, required — The ID of the ECS instance. - `ancestor_resource_ids` string[] — List of resource IDs that are ancestors of this resource. - `descendant_resource_ids` string[] — List of resource IDs that are descendants of this resource. - `match_remote_name` boolean — A bool representing whether or not the resource's name is synced from the end system. When true, the name is overwritten with the remote name on each sync. Defaults to false. - `match_remote_description` boolean — A bool representing whether or not the resource's description is synced from the end system. When true, the description is overwritten with the remote description on each sync. Defaults to false. - `last_successful_sync` SyncTask — Represents a sync task that has been completed, either successfully or with errors. - `id` string, uuid, required — The ID of the sync task. - `completed_at` string, date-time, required — The time when the sync task was completed. --- [API](https://skmtc.net/opal/apis/opal-api.md) · [All operations](https://skmtc.net/opal/apis/opal-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/opal/opal-api/versions/13b58df96d40/schema)