Ends a stopped campaign, setting ended_at and ended_by_user_id,
applying pending access changes, and queuing report generation.
Returns 400 unless the campaign is started and stopped and not already
ended.
The ID of the user who ended the campaign, if ended.
Example:
"32acc112-21ff-4669-91c2-21e27683eaa1"
Was this page helpful?
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Opal Security Docs","colors":{"primary":"#0C7997","light":"#EDFCFC","dark":"#074055"},"logo":{"light":"https://mintcdn.com/opalsecurity/FBbZyeMPZrA69UcV/logo/logo-dark.svg?fit=max\u0026auto=format\u0026n=FBbZyeMPZrA69UcV\u0026q=85\u0026s=93a4bd75f157f9f0ab43cdf4d715b5cd","dark":"https://mintcdn.com/opalsecurity/FBbZyeMPZrA69UcV/logo/logo-light.svg?fit=max\u0026auto=format\u0026n=FBbZyeMPZrA69UcV\u0026q=85\u0026s=1774b545e4f1c5cad647f5194f7b26d9"},"favicon":{"light":"https://mintcdn.com/opalsecurity/DRAwGKUXMxLRQouh/logo/icon-opal-black.svg?fit=max\u0026auto=format\u0026n=DRAwGKUXMxLRQouh\u0026q=85\u0026s=9c8bd1204b6b5b83542c2ab5be549858","dark":"https://mintcdn.com/opalsecurity/DRAwGKUXMxLRQouh/logo/icon-opal-white.svg?fit=max\u0026auto=format\u0026n=DRAwGKUXMxLRQouh\u0026q=85\u0026s=73b53b4ceab6ae0b00e30b2042a6020a"},"icons":{"library":"lucide"},"styling":{"eyebrows":"breadcrumbs","latex":false},"integrations":{"ga4":{"measurementId":"G-1PPPM1WF6D"}},"errors":{"404":{"redirect":false,"title":"Page can't be found","description":"Sorry! This page might have been moved, or the link might be broken. Go back to our documentation via https://docs.opal.dev/docs/welcome."}},"metadata":{"timestamp":true},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"opalsecurity","hasAudioNarration":false,"actualSubdomain":"opalsecurity","customDomains":["docs.opal.dev"],"gitSource":{"type":"github","owner":"opalsecurity","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"feedback":{"thumbs":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6aee6f7eac73cbd8b43f4e43","clientVersion":"0.0.4088","searchFilterCounts":[{"language":"default","tag":"API Reference","count":217},{"language":"default","tag":"Opal API","count":212},{"language":"default","tag":"Documentation","count":100},{"language":"default","tag":"Integrations","count":100},{"language":"default","tag":"Entitlement Management","count":67},{"language":"default","tag":"resources","count":34},{"language":"default","tag":"groups","count":32},{"language":"default","tag":"Getting Started","count":25},{"language":"default","tag":"Access Management","count":22},{"language":"default","tag":"Infrastructure","count":22}]},"assistantConfig":{"enableStarterQuestions":true,"enableContextualStarterQuestions":true,"deflection":{"enabled":true,"email":"support@opal.dev","showHelpButton":true}},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/campaigns/end-campaign","slug":"/api-reference/campaigns/end-campaign","pageMetadata":{"title":"End campaign","description":"Ends a stopped campaign, setting `ended_at` and `ended_by_user_id`,\napplying pending access changes, and queuing report generation.\nReturns 400 unless the campaign is started and stopped and not already\nended.\n","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/end","href":"/api-reference/campaigns/end-campaign","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n code: \"code\",\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_components.p, {\n children: [\"Ends a stopped campaign, setting \", _jsx(_components.code, {\n children: \"ended_at\"\n }), \" and \", _jsx(_components.code, {\n children: \"ended_by_user_id\"\n }), \",\\napplying pending access changes, and queuing report generation.\\nReturns 400 unless the campaign is started and stopped and not already\\nended.\"]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"End campaign","description":"Ends a stopped campaign, setting `ended_at` and `ended_by_user_id`,\napplying pending access changes, and queuing report generation.\nReturns 400 unless the campaign is started and stopped and not already\nended.\n","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/end","href":"/api-reference/campaigns/end-campaign","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/opalsecurity/d0e14c3cf9bbd682/changelog-scraper.js"],"openApiReferenceData":{"operation":{"summary":"End campaign","description":"Ends a stopped campaign, setting `ended_at` and `ended_by_user_id`,\napplying pending access changes, and queuing report generation.\nReturns 400 unless the campaign is started and stopped and not already\nended.\n","operationId":"endCampaign","parameters":["8048e4a0-9df2-4f16-b360-4d3e08c47a8f"],"responses":{"200":"db8ee2cf-bbc9-422d-b59f-9e4a94ef68ce"},"security":["f0cde43f-b137-4c6d-9744-91f087afdb27"],"tags":["campaigns"],"method":"post","type":"path","servers":["f85a627a-9b27-47c2-b1f2-a8103668072e"],"path":"/campaigns/{campaign_id}/end","baseUrlOptions":["https://api.opal.dev/v1"],"title":"End campaign","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"8048e4a0-9df2-4f16-b360-4d3e08c47a8f":{"description":"The ID of the campaign.","example":"f454d283-ca87-4a8a-bdbb-df212eca5353","explode":true,"in":"path","name":"campaign_id","required":true,"schema":{"type":"string","format":"uuid","isRequired":true,"description":"The ID of the campaign.","uniqueKey":"","typeLabel":"string\u003cuuid>"},"style":"simple"}},"responses":{"db8ee2cf-bbc9-422d-b59f-9e4a94ef68ce":{"content":{"application/json":{"schema":{"description":"An access review campaign.","example":{"campaign_id":"f454d283-ca87-4a8a-bdbb-df212eca5353","name":"Q3 Access Review","status":"DRAFT","is_template":false,"created_at":"2026-07-01T00:00:00.000Z","updated_at":"2026-07-01T00:00:00.000Z","created_by_user_id":"32acc112-21ff-4669-91c2-21e27683eaa1","configuration":null,"started_at":null,"started_by_user_id":null,"stopped_at":null,"stopped_by_user_id":null,"ended_at":null,"ended_by_user_id":null},"properties":{"campaign_id":{"description":"The ID of the campaign.","example":"f454d283-ca87-4a8a-bdbb-df212eca5353","format":"uuid","type":"string","isRequired":true,"uniqueKey":"campaign_id","typeLabel":"string\u003cuuid>"},"name":{"description":"The name of the campaign.","example":"Q3 Access Review","type":"string","isRequired":true,"uniqueKey":"name","typeLabel":"string"},"status":{"description":"The current status of a campaign.","enum":["DRAFT","ONGOING","COMPLETED","STOPPED","ENDED"],"example":"ONGOING","type":"string","isRequired":true,"uniqueKey":"status","typeLabel":"enum\u003cstring>"},"is_template":{"description":"Whether this campaign is a recurring schedule template. Templates spawn draft campaigns on schedule rather than being reviewed directly.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"is_template","typeLabel":"boolean"},"created_at":{"description":"The creation time of the campaign.","example":"2026-07-01T00:00:00.000Z","format":"date-time","type":"string","isRequired":true,"uniqueKey":"created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"description":"The last updated time of the campaign.","example":"2026-07-01T00:00:00.000Z","format":"date-time","type":"string","isRequired":true,"uniqueKey":"updated_at","typeLabel":"string\u003cdate-time>"},"created_by_user_id":{"description":"The ID of the user who created the campaign.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"string","isRequired":true,"uniqueKey":"created_by_user_id","typeLabel":"string\u003cuuid>"},"configuration":{"oneOf":[{"type":"object","description":"The campaign's configuration, if set.","required":["configuration_id","created_at","updated_at","reviewer_assignment_policy","allow_self_review","send_reviewer_assignment_notification","allow_reviewer_reassignment","allow_reviewers_to_reduce_expiration","timezone","revoke_on","reminder_include_manager","require_reason_on_denial","auto_stop_when_complete","hide_ai_suggestions","group_asset_visibility_policy","is_template"],"example":{"configuration_id":"39a4d283-ca87-4a8a-bdbb-df212eca5fdb","created_at":"2026-07-01T00:00:00.000Z","updated_at":"2026-07-01T00:00:00.000Z","query":null,"reviewer_assignment_policy":"MANUALLY","allow_self_review":false,"send_reviewer_assignment_notification":true,"allow_reviewer_reassignment":false,"start_date":null,"end_date":"2026-09-30T00:00:00.000Z","timezone":"America/Los_Angeles","revoke_on":"END","reminder_schedule":[7,3,1],"reminder_include_manager":true,"require_reason_on_denial":false,"auto_stop_when_complete":false,"hide_ai_suggestions":false,"custom_start_message":null,"group_asset_visibility_policy":"STRICT","is_template":false,"cron_expression":null,"next_scheduled_run":null,"last_scheduled_run":null,"recurring_duration_days":null},"properties":{"configuration_id":{"description":"The ID of the campaign configuration.","example":"39a4d283-ca87-4a8a-bdbb-df212eca5fdb","format":"uuid","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.configuration_id","typeLabel":"string\u003cuuid>"},"created_at":{"description":"The creation time of the configuration.","example":"2026-07-01T00:00:00.000Z","format":"date-time","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.created_at","typeLabel":"string\u003cdate-time>"},"updated_at":{"description":"The last updated time of the configuration.","example":"2026-07-01T00:00:00.000Z","format":"date-time","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.updated_at","typeLabel":"string\u003cdate-time>"},"reviewer_assignment_policy":{"description":"A policy for auto-assigning reviewers. If auto-assignment is on, specific assignments can still be manually adjusted after the access review is started. Default is Manually. BY_OWNING_TEAM_ADMIN assigns reviews to resource admins in round-robin fashion. BY_OWNING_TEAM_ADMIN_ALL assigns reviews to all resource admins. BY_APPROVERS assigns reviews to resource approvers in round-robin fashion. BY_APPROVERS_ALL assigns reviews to all resource approvers. BY_SELF assigns each item to the reviewed principal themselves.","enum":["MANUALLY","BY_OWNING_TEAM_ADMIN","BY_OWNING_TEAM_ADMIN_ALL","BY_MANAGER","BY_APPROVERS","BY_APPROVERS_ALL","BY_SELF"],"example":"MANUALLY","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.reviewer_assignment_policy","typeLabel":"enum\u003cstring>"},"allow_self_review":{"description":"Whether reviewers can review their own access.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.allow_self_review","typeLabel":"boolean"},"send_reviewer_assignment_notification":{"description":"Whether to notify reviewers upon assignment.","example":true,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.send_reviewer_assignment_notification","typeLabel":"boolean"},"allow_reviewer_reassignment":{"description":"Whether reviewers may reassign their reviews to another user.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.allow_reviewer_reassignment","typeLabel":"boolean"},"allow_reviewers_to_reduce_expiration":{"description":"Whether reviewers can shorten an item's access expiration. They cannot extend it.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.allow_reviewers_to_reduce_expiration","typeLabel":"boolean"},"timezone":{"description":"IANA timezone used to interpret campaign deadlines (e.g. America/Los_Angeles).","example":"America/Los_Angeles","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.timezone","typeLabel":"string"},"revoke_on":{"description":"When access decisions take effect during a campaign.","enum":["ACTION","END","NONE"],"example":"END","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.revoke_on","typeLabel":"enum\u003cstring>"},"reminder_include_manager":{"description":"Whether to include the reviewer's manager in reminders.","example":true,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.reminder_include_manager","typeLabel":"boolean"},"require_reason_on_denial":{"description":"Whether reviewers must provide a reason when denying (revoking) access.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.require_reason_on_denial","typeLabel":"boolean"},"auto_stop_when_complete":{"description":"Whether the campaign stops automatically once every review item is complete. Stopping locks further reviews so admins can review the decisions or end the campaign to generate the report.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.auto_stop_when_complete","typeLabel":"boolean"},"hide_ai_suggestions":{"description":"Whether AI suggestions are hidden from reviewers.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.hide_ai_suggestions","typeLabel":"boolean"},"group_asset_visibility_policy":{"description":"Controls what group assets reviewers can see during the campaign.","enum":["STRICT","VIEW_VISIBLE_AND_ASSIGNED","VIEW_ALL"],"example":"STRICT","type":"string","isRequired":true,"uniqueKey":"configuration.oneOf.0.group_asset_visibility_policy","typeLabel":"enum\u003cstring>"},"is_template":{"description":"Whether this configuration is a recurring schedule template.","example":false,"type":"boolean","isRequired":true,"uniqueKey":"configuration.oneOf.0.is_template","typeLabel":"boolean"},"query":{"oneOf":[{"type":"object","description":"Access-path query defining the scope of access to review. Uses the same principalFilter / entitlementFilter shape as ACCESS OpalQuery.","properties":{"principalFilter":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityName.string","typeLabel":"string"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter.not","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalFilter","typeLabel":"object"},"entitlementFilter":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityName.string","typeLabel":"string"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter.not","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementFilter","typeLabel":"object"},"principalAccessFilters":{"type":"object","description":"Advanced access filter on the principal side of each path. Restricts results to principals that additionally satisfy these access-edge constraints: `hasAccessTo` keeps only principals that also have access to a matching entity; `isAccessibleBy` keeps only principals that are also accessible by a matching entity. Only takes effect when `principalFilter` is also supplied (it refines that filter); on its own it has no effect.\n","properties":{"isAccessibleBy":{"type":"object","description":"Inbound-edge filter. The returned node must be accessible by at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityName.string","typeLabel":"string"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy.not","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.isAccessibleBy","typeLabel":"object"},"hasAccessTo":{"type":"object","description":"Outbound-edge filter. The returned node must have access to at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityName.string","typeLabel":"string"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo.not","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters.hasAccessTo","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.principalAccessFilters","typeLabel":"object"},"entitlementAccessFilters":{"type":"object","description":"Advanced access filter on the entitlement side of each path. Restricts results to entitlements that additionally satisfy these access-edge constraints: `hasAccessTo` keeps only entitlements that also have access to a matching entity; `isAccessibleBy` keeps only entitlements that are also accessible by a matching entity. Only takes effect when `entitlementFilter` is also supplied (it refines that filter); on its own it has no effect.\n","properties":{"isAccessibleBy":{"type":"object","description":"Inbound-edge filter. The returned node must be accessible by at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityName.string","typeLabel":"string"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy.not","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.isAccessibleBy","typeLabel":"object"},"hasAccessTo":{"type":"object","description":"Outbound-edge filter. The returned node must have access to at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityName.string","typeLabel":"string"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo.not","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters.hasAccessTo","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.entitlementAccessFilters","typeLabel":"object"},"accessLevelRemoteIds":{"type":"array","description":"Filter by access-level remote IDs on the terminal edge.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.accessLevelRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.accessLevelRemoteIds","typeLabel":"string[]"},"accessLevelNames":{"type":"array","description":"Filter by access-level display names on the terminal edge.","items":{"type":"string","uniqueKey":"configuration.oneOf.0.query.oneOf.0.accessLevelNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.accessLevelNames","typeLabel":"string[]"},"edgeFilter":{"type":"object","description":"Constraints on the access path edges themselves.","properties":{"directOnly":{"type":"boolean","description":"When true, only return direct (depth-1) principal-to-entitlement edges.","example":true,"uniqueKey":"configuration.oneOf.0.query.oneOf.0.edgeFilter.directOnly","typeLabel":"boolean"},"accessDurationType":{"type":"string","description":"Constrain results by whether the terminal access expires.","enum":["EXPIRING_ONLY","PERMANENT_ONLY"],"example":"EXPIRING_ONLY","uniqueKey":"configuration.oneOf.0.query.oneOf.0.edgeFilter.accessDurationType","typeLabel":"enum\u003cstring>"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0.edgeFilter","typeLabel":"object"}},"uniqueKey":"configuration.oneOf.0.query.oneOf.0","typeLabel":"object"},{"type":"null","uniqueKey":"configuration.oneOf.0.query.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.query","typeLabel":"object | null"},"start_date":{"oneOf":[{"description":"Scheduled start date of the campaign.","example":"2026-07-02T00:00:00.000Z","format":"date-time","type":"string","uniqueKey":"configuration.oneOf.0.start_date.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"Scheduled start date of the campaign.","example":"2026-07-02T00:00:00.000Z","format":"date-time","type":"null","uniqueKey":"configuration.oneOf.0.start_date.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.start_date","typeLabel":"string\u003cdate-time> | null"},"end_date":{"oneOf":[{"description":"Scheduled end date of the campaign.","example":"2026-09-30T00:00:00.000Z","format":"date-time","type":"string","uniqueKey":"configuration.oneOf.0.end_date.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"Scheduled end date of the campaign.","example":"2026-09-30T00:00:00.000Z","format":"date-time","type":"null","uniqueKey":"configuration.oneOf.0.end_date.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.end_date","typeLabel":"string\u003cdate-time> | null"},"reminder_schedule":{"description":"Days before end date to send reminder notifications.","example":[7,3,1],"items":{"type":"integer","uniqueKey":"configuration.oneOf.0.reminder_schedule.items.[INDEX]","typeLabel":"integer"},"type":"array","uniqueKey":"configuration.oneOf.0.reminder_schedule","typeLabel":"integer[]"},"custom_start_message":{"oneOf":[{"description":"Optional custom message included when notifying reviewers that the campaign started.","example":"Please complete your reviews by Friday.","type":"string","uniqueKey":"configuration.oneOf.0.custom_start_message.oneOf.0","typeLabel":"string"},{"description":"Optional custom message included when notifying reviewers that the campaign started.","example":"Please complete your reviews by Friday.","type":"null","uniqueKey":"configuration.oneOf.0.custom_start_message.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.custom_start_message","typeLabel":"string | null"},"cron_expression":{"oneOf":[{"description":"Cron expression driving the recurring schedule. Null for one-off campaigns.","example":"0 9 1 * *","type":"string","uniqueKey":"configuration.oneOf.0.cron_expression.oneOf.0","typeLabel":"string"},{"description":"Cron expression driving the recurring schedule. Null for one-off campaigns.","example":"0 9 1 * *","type":"null","uniqueKey":"configuration.oneOf.0.cron_expression.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.cron_expression","typeLabel":"string | null"},"next_scheduled_run":{"oneOf":[{"description":"Next time a draft will be generated from this template.","example":"2026-08-01T16:00:00.000Z","format":"date-time","type":"string","uniqueKey":"configuration.oneOf.0.next_scheduled_run.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"Next time a draft will be generated from this template.","example":"2026-08-01T16:00:00.000Z","format":"date-time","type":"null","uniqueKey":"configuration.oneOf.0.next_scheduled_run.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.next_scheduled_run","typeLabel":"string\u003cdate-time> | null"},"last_scheduled_run":{"oneOf":[{"description":"Most recent time a draft was generated from this template.","example":"2026-07-01T16:00:00.000Z","format":"date-time","type":"string","uniqueKey":"configuration.oneOf.0.last_scheduled_run.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"Most recent time a draft was generated from this template.","example":"2026-07-01T16:00:00.000Z","format":"date-time","type":"null","uniqueKey":"configuration.oneOf.0.last_scheduled_run.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.last_scheduled_run","typeLabel":"string\u003cdate-time> | null"},"recurring_duration_days":{"oneOf":[{"description":"Deadline window in days applied to each draft generated from this template.","example":14,"type":"integer","uniqueKey":"configuration.oneOf.0.recurring_duration_days.oneOf.0","typeLabel":"integer"},{"description":"Deadline window in days applied to each draft generated from this template.","example":14,"type":"null","uniqueKey":"configuration.oneOf.0.recurring_duration_days.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration.oneOf.0.recurring_duration_days","typeLabel":"integer | null"}},"uniqueKey":"configuration.oneOf.0","typeLabel":"object"},{"type":"null","uniqueKey":"configuration.oneOf.1","typeLabel":"null"}],"uniqueKey":"configuration","typeLabel":"object | null"},"started_at":{"oneOf":[{"description":"The time the campaign was started, if started.","example":"2026-07-02T00:00:00.000Z","format":"date-time","type":"string","uniqueKey":"started_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"The time the campaign was started, if started.","example":"2026-07-02T00:00:00.000Z","format":"date-time","type":"null","uniqueKey":"started_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"started_at","typeLabel":"string\u003cdate-time> | null"},"started_by_user_id":{"oneOf":[{"description":"The ID of the user who started the campaign, if started.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"string","uniqueKey":"started_by_user_id.oneOf.0","typeLabel":"string\u003cuuid>"},{"description":"The ID of the user who started the campaign, if started.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"null","uniqueKey":"started_by_user_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"started_by_user_id","typeLabel":"string\u003cuuid> | null"},"stopped_at":{"oneOf":[{"description":"The time the campaign was manually stopped, if stopped.","example":"2026-07-10T00:00:00.000Z","format":"date-time","type":"string","uniqueKey":"stopped_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"The time the campaign was manually stopped, if stopped.","example":"2026-07-10T00:00:00.000Z","format":"date-time","type":"null","uniqueKey":"stopped_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"stopped_at","typeLabel":"string\u003cdate-time> | null"},"stopped_by_user_id":{"oneOf":[{"description":"The ID of the user who stopped the campaign, if stopped.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"string","uniqueKey":"stopped_by_user_id.oneOf.0","typeLabel":"string\u003cuuid>"},{"description":"The ID of the user who stopped the campaign, if stopped.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"null","uniqueKey":"stopped_by_user_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"stopped_by_user_id","typeLabel":"string\u003cuuid> | null"},"ended_at":{"oneOf":[{"description":"The time the campaign reached its scheduled end, if ended.","example":"2026-07-14T00:00:00.000Z","format":"date-time","type":"string","uniqueKey":"ended_at.oneOf.0","typeLabel":"string\u003cdate-time>"},{"description":"The time the campaign reached its scheduled end, if ended.","example":"2026-07-14T00:00:00.000Z","format":"date-time","type":"null","uniqueKey":"ended_at.oneOf.1","typeLabel":"null"}],"uniqueKey":"ended_at","typeLabel":"string\u003cdate-time> | null"},"ended_by_user_id":{"oneOf":[{"description":"The ID of the user who ended the campaign, if ended.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"string","uniqueKey":"ended_by_user_id.oneOf.0","typeLabel":"string\u003cuuid>"},{"description":"The ID of the user who ended the campaign, if ended.","example":"32acc112-21ff-4669-91c2-21e27683eaa1","format":"uuid","type":"null","uniqueKey":"ended_by_user_id.oneOf.1","typeLabel":"null"}],"uniqueKey":"ended_by_user_id","typeLabel":"string\u003cuuid> | null"}},"required":["campaign_id","name","status","is_template","created_at","updated_at","created_by_user_id"],"type":"object","uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"campaign_id":"f454d283-ca87-4a8a-bdbb-df212eca5353","name":"Q3 Access Review","status":"DRAFT","is_template":false,"created_at":"2026-07-01T00:00:00.000Z","updated_at":"2026-07-01T00:00:00.000Z","created_by_user_id":"32acc112-21ff-4669-91c2-21e27683eaa1","configuration":null,"started_at":null,"started_by_user_id":null,"stopped_at":null,"stopped_by_user_id":null,"ended_at":null,"ended_by_user_id":null}}},"exampleType":"generated"}},"description":"The ended `Campaign`.","exampleType":"generated"}},"security":{"f0cde43f-b137-4c6d-9744-91f087afdb27":{"BearerAuth":{"scheme":"bearer","type":"http","scopes":[],"schemeName":"BearerAuth"}}},"servers":{"f85a627a-9b27-47c2-b1f2-a8103668072e":{"description":"Production","url":"https://api.opal.dev/v1"}},"schemas":{"4d448cf0-4a30-4a5b-b23b-b0496b080693":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"]}},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string"}},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true}}},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring."}}},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection."}}},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string"},"example":["Critical"],"isRequired":true}}},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string"}},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\")."}}},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid"},"isRequired":true},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners."}}},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid"}},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid"}},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string"}},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string"}},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"}},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"4d448cf0-4a30-4a5b-b23b-b0496b080693"}},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters"}}}},"processedSecurityOptions":[{"schemes":[{"scheme":{"scheme":"bearer","type":"http","scopes":[],"schemeName":"BearerAuth"},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"Bearer authentication header of the form `Bearer \u003ctoken>`, where `\u003ctoken>` is your auth token.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"BearerAuth","name":"Authorization"}],"title":"BearerAuth"}]},"originalFileLocation":"https://app.opal.dev/openapi.yaml"},"subdomain":"opalsecurity","siteName":"Opal Security Docs","title":"End campaign - Opal Security Docs","contextualStarterQuestions":[],"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"originalFileLocation":"api-reference/campaigns/end-campaign.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Ends a stopped campaign, setting ended_at and ended_by_user_id, applying pending access changes, and queuing report generation. Returns 400 unless the campaign is started and stopped and not already ended.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Opal Security Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"End campaign - Opal Security Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Ends a stopped campaign, setting ended_at and ended_by_user_id, applying pending access changes, and queuing report generation. Returns 400 unless the campaign is started and stopped and not already ended.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Opal Security Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.opal.dev/api-reference/campaigns/end-campaign\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://opalsecurity.mintlify.site/_mintlify/api/og/v2?division=campaigns\u0026amp;title=End+campaign\u0026amp;description=Ends+a+stopped+campaign%2C+setting+%60ended_at%60+and+%60ended_by_user_id%60%2C%0Aapplying+pending+access+changes%2C+and+queuing+report+generation.%0AReturns+400+unless+the+campa\u0026amp;theme=287ef1256bbb1bf2a61f3fd2\u0026amp;signature=e1249adb989ed3888f051bac9692bbfab42318dc3f38511d3ec16108a7570188\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"End campaign - Opal Security Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Ends a stopped campaign, setting ended_at and ended_by_user_id, applying pending access changes, and queuing report generation. Returns 400 unless the campaign is started and stopped and not already ended.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://opalsecurity.mintlify.site/_mintlify/api/og/v2?division=campaigns\u0026amp;title=End+campaign\u0026amp;description=Ends+a+stopped+campaign%2C+setting+%60ended_at%60+and+%60ended_by_user_id%60%2C%0Aapplying+pending+access+changes%2C+and+queuing+report+generation.%0AReturns+400+unless+the+campa\u0026amp;theme=287ef1256bbb1bf2a61f3fd2\u0026amp;signature=e1249adb989ed3888f051bac9692bbfab42318dc3f38511d3ec16108a7570188\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Opal Security Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0C7997\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.opal.dev/api-reference/campaigns/end-campaign\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/campaigns/end-campaign.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.opal.dev/#organization\",\"name\":\"Opal Security Docs\",\"url\":\"https://docs.opal.dev\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/opalsecurity/FBbZyeMPZrA69UcV/logo/logo-dark.svg?fit=max\u0026auto=format\u0026n=FBbZyeMPZrA69UcV\u0026q=85\u0026s=93a4bd75f157f9f0ab43cdf4d715b5cd\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.opal.dev#website\",\"name\":\"Opal Security Docs\",\"url\":\"https://docs.opal.dev\",\"publisher\":{\"@id\":\"https://docs.opal.dev/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign#webpage\",\"url\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign\",\"name\":\"End campaign\",\"description\":\"Ends a stopped campaign, setting ended_at and ended_by_user_id, applying pending access changes, and queuing report generation. Returns 400 unless the campaign is started and stopped and not already ended.\",\"isPartOf\":{\"@id\":\"https://docs.opal.dev#website\"},\"breadcrumb\":{\"@id\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Opal API\",\"item\":\"https://docs.opal.dev/api-reference/agent-activity/report-agent-activity\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"campaigns\",\"item\":\"https://docs.opal.dev/api-reference/campaigns/get-campaigns\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"End campaign\",\"item\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign#apireference\",\"headline\":\"End campaign\",\"name\":\"End campaign\",\"description\":\"Ends a stopped campaign, setting ended_at and ended_by_user_id, applying pending access changes, and queuing report generation. Returns 400 unless the campaign is started and stopped and not already ended.\",\"url\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign\",\"mainEntityOfPage\":{\"@id\":\"https://docs.opal.dev/api-reference/campaigns/end-campaign#webpage\"},\"publisher\":{\"@id\":\"https://docs.opal.dev/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.opal.dev#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Opal Security Docs\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Opal Security Docs","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":"/docs/welcome"}]},{"tab":"Integrations","pages":[{"title":"Integrations","href":"/integrations/overview"}]},{"tab":"API Reference","groups":[{"group":"API Concepts","pages":[{"title":"Authentication","href":"/reference/authentication"},{"title":"Pagination","href":"/reference/pagination"},{"title":"Identifying End System Objects","href":"/reference/end-system-objects"},{"title":"Opal API Rate Limits","href":"/reference/opal-api-rate-limits"}]},{"group":"SDKs","pages":[{"title":"Overview","href":"/reference/opal-sdks"}]},{"group":"Opal API","pages":[{"group":"agent-activity","pages":[{"title":"Report agent activity","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /agent-activity","href":"/api-reference/agent-activity/report-agent-activity"},{"title":"Get agent activity client settings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /agent-activity/client-settings","href":"/api-reference/agent-activity/get-agent-activity-client-settings"},{"title":"Report MCP server configuration","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /agent-activity/mcp-config","href":"/api-reference/agent-activity/report-mcp-server-configuration"},{"title":"Anthropic inference hook verdict","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /inference-hooks/anthropic","href":"/api-reference/agent-activity/anthropic-inference-hook-verdict"},{"title":"Get the agent kill switch","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /agent-kill-switch","href":"/api-reference/agent-activity/get-the-agent-kill-switch"},{"title":"Set the agent kill switch","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /agent-kill-switch","href":"/api-reference/agent-activity/set-the-agent-kill-switch"}]},{"group":"apps","pages":[{"title":"Get apps","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /apps","href":"/api-reference/apps/get-apps"},{"title":"Create app","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /apps","href":"/api-reference/apps/create-app"},{"title":"Get app by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /apps/{app_id}","href":"/api-reference/apps/get-app-by-id"},{"title":"Update app","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /apps/{app_id}","href":"/api-reference/apps/update-app"},{"title":"Delete app","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /apps/{app_id}","href":"/api-reference/apps/delete-app"},{"title":"Get app visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /apps/{app_id}/visibility","href":"/api-reference/apps/get-app-visibility"},{"title":"Set app visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /apps/{app_id}/visibility","href":"/api-reference/apps/set-app-visibility"},{"title":"Get sync errors","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /sync_errors","href":"/api-reference/apps/get-sync_errors"}]},{"group":"bundles","pages":[{"title":"Get bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles","href":"/api-reference/bundles/get-bundles"},{"title":"Post bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /bundles","href":"/api-reference/bundles/post-bundles"},{"title":"Get bundle by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}","href":"/api-reference/bundles/get-bundle-by-id"},{"title":"Put bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /bundles/{bundle_id}","href":"/api-reference/bundles/put-bundles"},{"title":"Delete bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /bundles/{bundle_id}","href":"/api-reference/bundles/delete-bundles"},{"title":"Get bundles resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}/resources","href":"/api-reference/bundles/get-bundles-resources"},{"title":"Post bundles resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /bundles/{bundle_id}/resources","href":"/api-reference/bundles/post-bundles-resources"},{"title":"Delete bundles resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /bundles/{bundle_id}/resources/{resource_id}","href":"/api-reference/bundles/delete-bundles-resources"},{"title":"Get bundles groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}/groups","href":"/api-reference/bundles/get-bundles-groups"},{"title":"Post bundles groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /bundles/{bundle_id}/groups","href":"/api-reference/bundles/post-bundles-groups"},{"title":"Delete bundles groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /bundles/{bundle_id}/groups/{group_id}","href":"/api-reference/bundles/delete-bundles-groups"},{"title":"Get bundles visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}/visibility","href":"/api-reference/bundles/get-bundles-visibility"},{"title":"Put bundles visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /bundles/{bundle_id}/visibility","href":"/api-reference/bundles/put-bundles-visibility"}]},{"group":"campaigns","pages":[{"title":"Get campaigns","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns","href":"/api-reference/campaigns/get-campaigns"},{"title":"Post campaigns","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns","href":"/api-reference/campaigns/post-campaigns"},{"title":"Get campaign by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns/{campaign_id}","href":"/api-reference/campaigns/get-campaign-by-id"},{"title":"Update campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /campaigns/{campaign_id}","href":"/api-reference/campaigns/update-campaign"},{"title":"Start campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/start","href":"/api-reference/campaigns/start-campaign"},{"title":"Stop campaign","description":"Stops an ongoing campaign immediately, setting `stopped_at` and\n`stopped_by_user_id`. Returns 400 if the campaign has not started or\nhas already stopped.\n","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/stop","href":"/api-reference/campaigns/stop-campaign"},{"title":"End campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/end","href":"/api-reference/campaigns/end-campaign"},{"title":"List campaign items","description":"Returns a paginated list of review items for a campaign — the same rows\nshown on the admin Reviews tab. Status is derived using the same rules\nas the UI Status column. Soft-deleted role assignments are still\nreturned with `is_target_deleted: true`.\n","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns/{campaign_id}/items","href":"/api-reference/campaigns/list-campaign-items"},{"title":"Update campaign item reviewers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/item-reviewers","href":"/api-reference/campaigns/update-campaign-item-reviewers"},{"title":"Submit campaign item review decisions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/reviews","href":"/api-reference/campaigns/submit-campaign-item-review-decisions"},{"title":"List viewer campaign items","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns/{campaign_id}/viewer-items","href":"/api-reference/campaigns/list-viewer-campaign-items"}]},{"group":"configuration-templates","pages":[{"title":"Get configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /configuration-templates","href":"/api-reference/configuration-templates/get-configuration-templates"},{"title":"Put configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /configuration-templates","href":"/api-reference/configuration-templates/put-configuration-templates"},{"title":"Post configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /configuration-templates","href":"/api-reference/configuration-templates/post-configuration-templates"},{"title":"Delete configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /configuration-templates/{configuration_template_id}","href":"/api-reference/configuration-templates/delete-configuration-templates"}]},{"group":"event-streams","pages":[{"title":"Get event streams","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /event-streams","href":"/api-reference/event-streams/get-event-streams"},{"title":"Create event stream","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /event-streams","href":"/api-reference/event-streams/create-event-stream"},{"title":"Update event stream","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /event-streams/{event_stream_id}","href":"/api-reference/event-streams/update-event-stream"},{"title":"Delete event stream","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /event-streams/{event_stream_id}","href":"/api-reference/event-streams/delete-event-stream"}]},{"group":"events","pages":[{"title":"Get events","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /events","href":"/api-reference/events/get-events"},{"title":"Get event by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /events/{event_id}","href":"/api-reference/events/get-event-by-id"}]},{"group":"groups","pages":[{"title":"Get groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups","href":"/api-reference/groups/get-groups"},{"title":"Put groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups","href":"/api-reference/groups/put-groups"},{"title":"Post groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups","href":"/api-reference/groups/post-groups"},{"title":"Get group by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}","href":"/api-reference/groups/get-group-by-id"},{"title":"Delete groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /groups/{group_id}","href":"/api-reference/groups/delete-groups"},{"title":"Get the ID of the configuration template linked to a group","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/configuration-template","href":"/api-reference/groups/get-the-id-of-the-configuration-template-linked-to-a-group"},{"title":"Set the ID of the configuration template linked to a group","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/configuration-template","href":"/api-reference/groups/set-the-id-of-the-configuration-template-linked-to-a-group"},{"title":"Get groups message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/message-channels","href":"/api-reference/groups/get-groups-message-channels"},{"title":"Put groups message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/message-channels","href":"/api-reference/groups/put-groups-message-channels"},{"title":"Get groups on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/on-call-schedules","href":"/api-reference/groups/get-groups-on-call-schedules"},{"title":"Put groups on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/on-call-schedules","href":"/api-reference/groups/put-groups-on-call-schedules"},{"title":"Get group access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/access_levels","href":"/api-reference/groups/get-group-access-levels"},{"title":"Get groups resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/resources","href":"/api-reference/groups/get-groups-resources"},{"title":"Put groups resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/resources","href":"/api-reference/groups/put-groups-resources"},{"title":"Get member groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/groups","href":"/api-reference/groups/get-member-groups"},{"title":"Get nested groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/containing-groups","href":"/api-reference/groups/get-nested-groups"},{"title":"Post groups containing groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups/{group_id}/containing-groups","href":"/api-reference/groups/post-groups-containing-groups"},{"title":"Get nested group by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/containing-groups/{containing_group_id}","href":"/api-reference/groups/get-nested-group-by-id"},{"title":"Delete groups containing groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /groups/{group_id}/containing-groups/{containing_group_id}","href":"/api-reference/groups/delete-groups-containing-groups"},{"title":"Post groups resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups/{group_id}/resources/{resource_id}","href":"/api-reference/groups/post-groups-resources"},{"title":"Get groups visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/visibility","href":"/api-reference/groups/get-groups-visibility"},{"title":"Put groups visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/visibility","href":"/api-reference/groups/put-groups-visibility"},{"title":"Get groups reviewers","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/reviewers","href":"/api-reference/groups/get-groups-reviewers"},{"title":"Put groups reviewers","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/reviewers","href":"/api-reference/groups/put-groups-reviewers"},{"title":"Get groups reviewer stages","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/reviewer-stages","href":"/api-reference/groups/get-groups-reviewer-stages"},{"title":"Put groups reviewer stages","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/reviewer-stages","href":"/api-reference/groups/put-groups-reviewer-stages"},{"title":"Get groups tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/tags","href":"/api-reference/groups/get-groups-tags"},{"title":"Get groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/users","href":"/api-reference/groups/get-groups-users"},{"title":"Put groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/users/{user_id}","href":"/api-reference/groups/put-groups-users"},{"title":"Post groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups/{group_id}/users/{user_id}","href":"/api-reference/groups/post-groups-users"},{"title":"Delete groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /groups/{group_id}/users/{user_id}","href":"/api-reference/groups/delete-groups-users"},{"title":"Get groupsusers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/users/{user_id}","href":"/api-reference/groups/get-groupsusers"}]},{"group":"group-bindings","pages":[{"title":"Get group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /group-bindings","href":"/api-reference/group-bindings/get-group-bindings"},{"title":"Put group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /group-bindings","href":"/api-reference/group-bindings/put-group-bindings"},{"title":"Post group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /group-bindings","href":"/api-reference/group-bindings/post-group-bindings"},{"title":"Get group binding by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /group-bindings/{group_binding_id}","href":"/api-reference/group-bindings/get-group-binding-by-id"},{"title":"Delete group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /group-bindings/{group_binding_id}","href":"/api-reference/group-bindings/delete-group-bindings"}]},{"group":"idp-group-mappings","pages":[{"title":"Get idp group mappings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /idp-group-mappings/{app_resource_id}","href":"/api-reference/idp-group-mappings/get-idp-group-mappings"},{"title":"Put idp group mappings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /idp-group-mappings/{app_resource_id}","href":"/api-reference/idp-group-mappings/put-idp-group-mappings"},{"title":"Get idp group mappings groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /idp-group-mappings/{app_resource_id}/groups/{group_id}","href":"/api-reference/idp-group-mappings/get-idp-group-mappings-groups"},{"title":"Post idp group mappings groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /idp-group-mappings/{app_resource_id}/groups/{group_id}","href":"/api-reference/idp-group-mappings/post-idp-group-mappings-groups"},{"title":"Delete idp group mappings groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /idp-group-mappings/{app_resource_id}/groups/{group_id}","href":"/api-reference/idp-group-mappings/delete-idp-group-mappings-groups"}]},{"group":"opal-scripts","pages":[{"title":"List OpalScripts","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /opal-scripts","href":"/api-reference/opal-scripts/list-opalscripts"},{"title":"Create OpalScript","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /opal-scripts","href":"/api-reference/opal-scripts/create-opalscript"},{"title":"Get OpalScript by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /opal-scripts/{opal_script_id}","href":"/api-reference/opal-scripts/get-opalscript-by-id"},{"title":"Update OpalScript","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /opal-scripts/{opal_script_id}","href":"/api-reference/opal-scripts/update-opalscript"},{"title":"Delete OpalScript","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /opal-scripts/{opal_script_id}","href":"/api-reference/opal-scripts/delete-opalscript"},{"title":"Get OpalScript by name","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /opal-scripts/name/{opal_script_name}","href":"/api-reference/opal-scripts/get-opalscript-by-name"}]},{"group":"owners","pages":[{"title":"Get owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners","href":"/api-reference/owners/get-owners"},{"title":"Put owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /owners","href":"/api-reference/owners/put-owners"},{"title":"Post owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /owners","href":"/api-reference/owners/post-owners"},{"title":"Get owner by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners/{owner_id}","href":"/api-reference/owners/get-owner-by-id"},{"title":"Delete owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /owners/{owner_id}","href":"/api-reference/owners/delete-owners"},{"title":"Get ownersname","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners/name/{owner_name}","href":"/api-reference/owners/get-ownersname"},{"title":"Get owners users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners/{owner_id}/users","href":"/api-reference/owners/get-owners-users"},{"title":"Put owners users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /owners/{owner_id}/users","href":"/api-reference/owners/put-owners-users"}]},{"group":"request-templates","pages":[{"title":"Get request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /request-templates","href":"/api-reference/request-templates/get-request-templates"},{"title":"Put request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /request-templates","href":"/api-reference/request-templates/put-request-templates"},{"title":"Post request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /request-templates","href":"/api-reference/request-templates/post-request-templates"},{"title":"Get request templates 1","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /request-templates/{request_template_id}","href":"/api-reference/request-templates/get-request-templates-1"},{"title":"Delete request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /request-templates/{request_template_id}","href":"/api-reference/request-templates/delete-request-templates"}]},{"group":"requests","pages":[{"title":"Get requests","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests","href":"/api-reference/requests/get-requests"},{"title":"Post requests","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests","href":"/api-reference/requests/post-requests"},{"title":"Get requests via Relay","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests/relay","href":"/api-reference/requests/get-requests-via-relay"},{"title":"Get request by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests/{id}","href":"/api-reference/requests/get-request-by-id"},{"title":"Post requests approve","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/approve","href":"/api-reference/requests/post-requests-approve"},{"title":"Post requests deny","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/deny","href":"/api-reference/requests/post-requests-deny"},{"title":"Cancel request","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/cancel","href":"/api-reference/requests/cancel-request"},{"title":"Escalate request to skip-manager","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/escalate","href":"/api-reference/requests/escalate-request-to-skip-manager"},{"title":"Send request reminder","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/remind","href":"/api-reference/requests/send-request-reminder"},{"title":"Send reminder to a reviewer","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/reviewers/{reviewer_id}/remind","href":"/api-reference/requests/send-reminder-to-a-reviewer"},{"title":"Get requests comments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests/{id}/comments","href":"/api-reference/requests/get-requests-comments"},{"title":"Post requests comments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/comments","href":"/api-reference/requests/post-requests-comments"}]},{"group":"role-assignments","pages":[{"title":"List role assignments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /role-assignments","href":"/api-reference/role-assignments/list-role-assignments"},{"title":"Add role assignments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /role-assignments","href":"/api-reference/role-assignments/add-role-assignments"},{"title":"Remove role assignments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /role-assignments","href":"/api-reference/role-assignments/remove-role-assignments"}]},{"group":"resources","pages":[{"title":"Get resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources","href":"/api-reference/resources/get-resources"},{"title":"Put resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources","href":"/api-reference/resources/put-resources"},{"title":"Post resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources","href":"/api-reference/resources/post-resources"},{"title":"Get resource by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}","href":"/api-reference/resources/get-resource-by-id"},{"title":"Delete resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}","href":"/api-reference/resources/delete-resources"},{"title":"Get the ID of the configuration template linked to a resource","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/configuration-template","href":"/api-reference/resources/get-the-id-of-the-configuration-template-linked-to-a-resource"},{"title":"Set the ID of the configuration template linked to a resource","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/configuration-template","href":"/api-reference/resources/set-the-id-of-the-configuration-template-linked-to-a-resource"},{"title":"Get resources message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/message-channels","href":"/api-reference/resources/get-resources-message-channels"},{"title":"Put resources message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/message-channels","href":"/api-reference/resources/put-resources-message-channels"},{"title":"Get resources visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/visibility","href":"/api-reference/resources/get-resources-visibility"},{"title":"Put resources visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/visibility","href":"/api-reference/resources/put-resources-visibility"},{"title":"Get resources reviewers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/reviewers","href":"/api-reference/resources/get-resources-reviewers"},{"title":"Put resources reviewers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/reviewers","href":"/api-reference/resources/put-resources-reviewers"},{"title":"Get resources reviewer stages","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/reviewer-stages","href":"/api-reference/resources/get-resources-reviewer-stages"},{"title":"Put resources reviewer stages","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/reviewer-stages","href":"/api-reference/resources/put-resources-reviewer-stages"},{"title":"Get resources non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/non-human-identities","href":"/api-reference/resources/get-resources-non-human-identities"},{"title":"Get resource users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/users","href":"/api-reference/resources/get-resource-users"},{"title":"Post resources non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources/{resource_id}/non-human-identities/{non_human_identity_id}","href":"/api-reference/resources/post-resources-non-human-identities"},{"title":"Delete resources non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}/non-human-identities/{non_human_identity_id}","href":"/api-reference/resources/delete-resources-non-human-identities"},{"title":"Get resource user","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/get-resource-user"},{"title":"Put resources users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/put-resources-users"},{"title":"Post resources users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/post-resources-users"},{"title":"Delete resources users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/delete-resources-users"},{"title":"Get resource user access status ","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resource-user-access-status/{resource_id}/{user_id}","href":"/api-reference/resources/get-resource-user-access-status-"},{"title":"Get resources tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/tags","href":"/api-reference/resources/get-resources-tags"},{"title":"Get resources scoped role permissions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/scoped-role-permissions","href":"/api-reference/resources/get-resources-scoped-role-permissions"},{"title":"Put resources scoped role permissions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/scoped-role-permissions","href":"/api-reference/resources/put-resources-scoped-role-permissions"},{"title":"Get resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/custom-access-levels","href":"/api-reference/resources/get-resources-custom-access-levels"},{"title":"Post resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources/{resource_id}/custom-access-levels","href":"/api-reference/resources/post-resources-custom-access-levels"},{"title":"Delete resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}/custom-access-levels/{access_level_remote_id}","href":"/api-reference/resources/delete-resources-custom-access-levels"},{"title":"Patch resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml patch /resources/{resource_id}/custom-access-levels/{access_level_remote_id}","href":"/api-reference/resources/patch-resources-custom-access-levels"},{"title":"Get resourcesusers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/users/{user_id}","href":"/api-reference/resources/get-resourcesusers"},{"title":"Get resources groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/groups","href":"/api-reference/resources/get-resources-groups"},{"title":"Get resource access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/access_levels","href":"/api-reference/resources/get-resource-access-levels"}]},{"group":"non-human-identities","pages":[{"title":"Get non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /non-human-identities","href":"/api-reference/non-human-identities/get-non-human-identities"}]},{"group":"paladin","pages":[{"title":"Create Paladin","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /paladin","href":"/api-reference/paladin/create-paladin"},{"title":"Get Paladin by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /paladin/{paladin_id}","href":"/api-reference/paladin/get-paladin-by-id"},{"title":"Update Paladin","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /paladin/{paladin_id}","href":"/api-reference/paladin/update-paladin"},{"title":"Delete Paladin","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /paladin/{paladin_id}","href":"/api-reference/paladin/delete-paladin"},{"title":"Get Paladins by name","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /paladin/name/{paladin_name}","href":"/api-reference/paladin/get-paladins-by-name"},{"title":"List Paladin context sources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /paladin/{paladin_id}/context-sources","href":"/api-reference/paladin/list-paladin-context-sources"},{"title":"Add a Paladin context source","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /paladin/{paladin_id}/context-sources","href":"/api-reference/paladin/add-a-paladin-context-source"},{"title":"Remove a Paladin context source","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /paladin/{paladin_id}/context-sources/{context_source_id}","href":"/api-reference/paladin/remove-a-paladin-context-source"}]},{"group":"service-users","pages":[{"title":"Create service user","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /service-users","href":"/api-reference/service-users/create-service-user"}]},{"group":"sessions","pages":[{"title":"Get sessions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /sessions","href":"/api-reference/sessions/get-sessions"}]},{"group":"users","pages":[{"title":"Get user","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /user","href":"/api-reference/users/get-user"},{"title":"Get users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users","href":"/api-reference/users/get-users"},{"title":"Post users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /users","href":"/api-reference/users/post-users"},{"title":"Get user by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/{user_id}","href":"/api-reference/users/get-user-by-id"},{"title":"Delete users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /users/{user_id}","href":"/api-reference/users/delete-users"},{"title":"Patch users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml patch /users/{user_id}","href":"/api-reference/users/patch-users"},{"title":"Reset a user's Opal MFA","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /users/{user_id}/mfa/reset","href":"/api-reference/users/reset-a-users-opal-mfa"},{"title":"Revoke all of a user's access","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /users/{user_id}/revoke-all","href":"/api-reference/users/revoke-all-of-a-users-access"},{"title":"Get usersremote users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/remote_users","href":"/api-reference/users/get-usersremote_users"},{"title":"Get userswhoami","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/whoami","href":"/api-reference/users/get-userswhoami"},{"title":"Get users tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/{user_id}/tags","href":"/api-reference/users/get-users-tags"}]},{"group":"access-rules","pages":[{"title":"Get access rules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /access-rules","href":"/api-reference/access-rules/get-access-rules"},{"title":"Post access rules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /access-rules","href":"/api-reference/access-rules/post-access-rules"},{"title":"Get access rules 1","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /access-rules/{access_rule_id}","href":"/api-reference/access-rules/get-access-rules-1"},{"title":"Put access rules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /access-rules/{access_rule_id}","href":"/api-reference/access-rules/put-access-rules"}]},{"group":"tags","pages":[{"title":"Get tag by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tag/{tag_id}","href":"/api-reference/tags/get-tag-by-id"},{"title":"Delete tag","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tag/{tag_id}","href":"/api-reference/tags/delete-tag"},{"title":"Get tag","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tag","href":"/api-reference/tags/get-tag"},{"title":"Post tag","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tag","href":"/api-reference/tags/post-tag"},{"title":"Get tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tags","href":"/api-reference/tags/get-tags"},{"title":"Post tags users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tags/{tag_id}/users/{user_id}","href":"/api-reference/tags/post-tags-users"},{"title":"Delete tags users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tags/{tag_id}/users/{user_id}","href":"/api-reference/tags/delete-tags-users"},{"title":"Post tags groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tags/{tag_id}/groups/{group_id}","href":"/api-reference/tags/post-tags-groups"},{"title":"Delete tags groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tags/{tag_id}/groups/{group_id}","href":"/api-reference/tags/delete-tags-groups"},{"title":"Post tags resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tags/{tag_id}/resources/{resource_id}","href":"/api-reference/tags/post-tags-resources"},{"title":"Delete tags resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tags/{tag_id}/resources/{resource_id}","href":"/api-reference/tags/delete-tags-resources"}]},{"group":"message-channels","pages":[{"title":"Get message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /message-channels","href":"/api-reference/message-channels/get-message-channels"},{"title":"Post message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /message-channels","href":"/api-reference/message-channels/post-message-channels"},{"title":"Get message channel by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /message-channels/{message_channel_id}","href":"/api-reference/message-channels/get-message-channel-by-id"}]},{"group":"on-call-schedules","pages":[{"title":"Get on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /on-call-schedules","href":"/api-reference/on-call-schedules/get-on-call-schedules"},{"title":"Post on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /on-call-schedules","href":"/api-reference/on-call-schedules/post-on-call-schedules"},{"title":"Get on call schedule by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /on-call-schedules/{on_call_schedule_id}","href":"/api-reference/on-call-schedules/get-on-call-schedule-by-id"}]},{"group":"opal-queries","pages":[{"title":"Run an ad-hoc OpalQuery","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /queries/run","href":"/api-reference/opal-queries/run-an-ad-hoc-opalquery"}]},{"group":"tokens","pages":[{"title":"Get tokens","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tokens","href":"/api-reference/tokens/get-tokens"},{"title":"Create token","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tokens","href":"/api-reference/tokens/create-token"},{"title":"Delete token","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tokens/{token_id}","href":"/api-reference/tokens/delete-token"}]},{"group":"uars","pages":[{"title":"Get uars","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /uars","href":"/api-reference/uars/get-uars"},{"title":"Post uar","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /uar","href":"/api-reference/uars/post-uar"},{"title":"Get uar","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /uar/{uar_id}","href":"/api-reference/uars/get-uar"}]},{"group":"delegations","pages":[{"title":"Get delegations","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /delegations","href":"/api-reference/delegations/get-delegations"},{"title":"Post delegations","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /delegations","href":"/api-reference/delegations/post-delegations"},{"title":"Get delegation by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /delegations/{delegation_id}","href":"/api-reference/delegations/get-delegation-by-id"},{"title":"Delete delegations","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /delegations/{delegation_id}","href":"/api-reference/delegations/delete-delegations"}]}]}]},{"tab":"Changelog","pages":[{"title":"Changelog","href":"/changelog/changelog"}]}]},"basePath":"","title":"End campaign - Opal Security Docs","buildId":"dpl_DTau1J5HqS9UTgVSDwGksstFWtPa","deploymentId":"dpl_DTau1J5HqS9UTgVSDwGksstFWtPa","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-5FCzAcfS.js","utils-SLtAG4EZ.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-2DZi8ZMu.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-D7J3nkzE.js","snippetPresets-D0Alv0AH.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","conditional-requirements-CFM0id0Q.js","ApiExamples-BI4qNJ2c.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-BD3uyr8j.js","shallow-D8iEBr5z.js","getApiPlaygroundDisplay-CgNP4lzR.js","CodeSnippet-CX-QHuMs.js","CodeSnippets-VlXE-ZUf.js","Page-D9ithiIZ.js","getPastedJson-DYNQkZ1M.js","icon-CzacdwOi.js","MethodPill-2JVqoYKi.js","DuplicateIcon-_xVXs-U8.js","createIcon-BRHrweLo.js","DynamicMarkdown-mQG_iQiE.js","SectionHeading-DMpJzv8f.js","axios-vUo_bRtp.js","Markdown-5FGIym-8.js","clsx-D-TRO5q5.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-CdrJecqK.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-CHlcWBLM.js"]}