Sign in

v5

latestOpenAPI 3.1.02026-07-31151195455.5 KB
groups

Creates an Opal group or imports a remote group.

post/groups

Request body

namestring required

The name of the remote group.

descriptionstring

A description of the remote group.

group_type'ACTIVE_DIRECTORY_GROUP' | 'AWS_SSO_GROUP' | 'DATABRICKS_ACCOUNT_GROUP' | 'DUO_GROUP' | 'GIT_HUB_TEAM' | 'GIT_LAB_GROUP' | 'GOOGLE_GROUPS_GROUP' | 'GOOGLE_GROUPS_GKE_GROUP' | 'LDAP_GROUP' | 'OKTA_GROUP' | 'OKTA_GROUP_RULE' | 'TAILSCALE_GROUP' | 'OPAL_GROUP' | 'OPAL_ACCESS_RULE' | 'AZURE_AD_SECURITY_GROUP' | 'AZURE_AD_MICROSOFT_365_GROUP' | 'CONNECTOR_GROUP' | 'SNOWFLAKE_ROLE' | 'WORKDAY_USER_SECURITY_GROUP' | 'PAGERDUTY_ON_CALL_SCHEDULE' | 'INCIDENTIO_ON_CALL_SCHEDULE' | 'ROOTLY_ON_CALL_SCHEDULE' | 'DEVIN_GROUP' | 'GIT_HUB_ENTERPRISE_TEAM' | 'GRAFANA_TEAM' | 'CLICKHOUSE_ROLE' | 'SLACK_USER_GROUP' | 'TWINGATE_GROUP' | 'TWINGATE_GROUP_SYNCED' | 'ZENDESK_GROUP' | 'ZENDESK_ORGANIZATION' | 'HUBSPOT_TEAM' | 'TABLEAU_GROUP' required

The type of the group.

app_idstring uuid required

The ID of the app for the group.

remote_group_idstring

Deprecated - use remote_info instead. The ID of the group on the remote system. Include only for items linked to remote systems. See this guide for details on how to specify this field.

metadatastring

Deprecated - use remote_info instead.

JSON metadata about the remote group. Include only for items linked to remote systems. See this guide for details on how to specify this field. The required format is dependent on group_type and should have the following schema:

<style type="text/css"> code {max-height:300px !important} </style> 
{
  "$schema": "http://json-schema.org/draft-04/schema#",
  "title": "Group Metadata",
  "properties": {
    "ad_group": {
      "properties": {
        "object_guid": {
          "type": "string"
        }
      },
      "required": ["object_guid"],
      "additionalProperties": false,
      "type": "object",
      "title": "Active Directory Group"
    },
    "duo_group": {
      "properties": {
        "group_id": {
          "type": "string"
        }
      },
      "required": ["group_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "Duo Group"
    },
    "git_hub_team": {
      "properties": {
        "org_name": {
          "type": "string"
        },
        "team_slug": {
          "type": "string"
        }
      },
      "required": ["org_name", "team_slug"],
      "additionalProperties": false,
      "type": "object",
      "title": "GitHub Team"
    },
    "google_groups_group": {
      "properties": {
        "group_id": {
          "type": "string"
        }
      },
      "required": ["group_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "Google Groups Group"
    },
    "ldap_group": {
      "properties": {
        "group_uid": {
          "type": "string"
        }
      },
      "required": ["group_uid"],
      "additionalProperties": false,
      "type": "object",
      "title": "LDAP Group"
    },
    "okta_directory_group": {
      "properties": {
        "group_id": {
          "type": "string"
        }
      },
      "required": ["group_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "Okta Directory Group"
    }
  },
  "additionalProperties": false,
  "minProperties": 1,
  "maxProperties": 1,
  "type": "object"
}
custom_request_notificationstring nullable

Custom request notification sent upon request approval.

risk_sensitivity_override'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE'

Indicates the level of potential impact misuse or unauthorized access may incur.

Example request

{
  "remote_group_id": "00g4fixjd6Bc9w0TT5d7",
  "name": "Engineering Team",
  "description": "Engineering team Okta group.",
  "group_type": "OKTA_GROUP",
  "metadata": "{ \"okta_directory_group\": { \"group_id\": \"00g4bs66kwtpe1g12345\" } }",
  "app_id": "f454d283-ca87-4a8a-bdbb-df212eca5353"
}

Response

The group just created.

group_idstring uuid required

The ID of the group.

app_idstring uuid

The ID of the group's app.

namestring

The name of the group.

descriptionstring

A description of the group.

admin_owner_idstring uuid

The ID of the owner of the group.

group_leader_user_idsstring[]

A list of User IDs for the group leaders of the group

remote_idstring

The ID of the remote.

remote_namestring

The name of the remote.

group_type'ACTIVE_DIRECTORY_GROUP' | 'AWS_SSO_GROUP' | 'DATABRICKS_ACCOUNT_GROUP' | 'DUO_GROUP' | 'GIT_HUB_TEAM' | 'GIT_LAB_GROUP' | 'GOOGLE_GROUPS_GROUP' | 'GOOGLE_GROUPS_GKE_GROUP' | 'LDAP_GROUP' | 'OKTA_GROUP' | 'OKTA_GROUP_RULE' | 'TAILSCALE_GROUP' | 'OPAL_GROUP' | 'OPAL_ACCESS_RULE' | 'AZURE_AD_SECURITY_GROUP' | 'AZURE_AD_MICROSOFT_365_GROUP' | 'CONNECTOR_GROUP' | 'SNOWFLAKE_ROLE' | 'WORKDAY_USER_SECURITY_GROUP' | 'PAGERDUTY_ON_CALL_SCHEDULE' | 'INCIDENTIO_ON_CALL_SCHEDULE' | 'ROOTLY_ON_CALL_SCHEDULE' | 'DEVIN_GROUP' | 'GIT_HUB_ENTERPRISE_TEAM' | 'GRAFANA_TEAM' | 'CLICKHOUSE_ROLE' | 'SLACK_USER_GROUP' | 'TWINGATE_GROUP' | 'TWINGATE_GROUP_SYNCED' | 'ZENDESK_GROUP' | 'ZENDESK_ORGANIZATION' | 'HUBSPOT_TEAM' | 'TABLEAU_GROUP'

The type of the group.

max_durationinteger

The maximum duration for which the group can be requested (in minutes).

recommended_durationinteger

The recommended duration for which the group should be requested (in minutes). -1 represents an indefinite duration.

extensions_duration_in_minutesinteger

The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.

require_manager_approvalboolean

A bool representing whether or not access requests to the group require manager approval.

require_support_ticketboolean

A bool representing whether or not access requests to the group require an access ticket.

require_mfa_to_approveboolean

A bool representing whether or not to require MFA for reviewers to approve requests for this group.

require_mfa_to_requestboolean

A bool representing whether or not to require MFA for requesting access to this group.

auto_approvalboolean

A bool representing whether or not to automatically approve requests to this group.

request_template_idstring uuid

The ID of the associated request template.

configuration_template_idstring uuid

The ID of the associated configuration template.

group_binding_idstring uuid

The ID of the associated group binding.

is_requestableboolean

A bool representing whether or not to allow access requests to this group.

metadatastring

JSON metadata about the remote group. Only set for items linked to remote systems. See this guide for details.

custom_request_notificationstring nullable

Custom request notification sent to the requester when the request is approved.

risk_sensitivity'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE'

Indicates the level of potential impact misuse or unauthorized access may incur.

risk_sensitivity_override'UNKNOWN' | 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'NONE'

Indicates the level of potential impact misuse or unauthorized access may incur.

Example response

{
  "group_id": "f454d283-ca87-4a8a-bdbb-df212eca5353",
  "app_id": "b5a5ca27-0ea3-4d86-9199-2126d57d1fbd",
  "name": "Payments Production Admin",
  "description": "This group represents Active Directory group \"Payments Production Admin\". We use this AD group to facilitate staging deployments and qualifying new releases.",
  "admin_owner_id": "7c86c85d-0651-43e2-a748-d69d658418e8",
  "group_leader_user_ids": [
    "7c86c85d-0651-43e2-a748-d69d658418e8"
  ],
  "remote_id": "037m2jsg218b2wb",
  "remote_name": "Finance Team",
  "group_type": "ACTIVE_DIRECTORY_GROUP",
  "max_duration": 120,
  "recommended_duration": 60,
  "extensions_duration_in_minutes": 60,
  "require_manager_approval": false,
  "require_support_ticket": false,
  "require_mfa_to_approve": false,
  "require_mfa_to_request": false,
  "auto_approval": false,
  "is_requestable": true
}