SDKs
Opal API
- GETGet groups
- PUTPut groups
- POSTPost groups
- GETGet group by ID
- DELDelete groups
- GETGet groups message channels
- PUTPut groups message channels
- GETGet groups on call schedules
- PUTPut groups on call schedules
- GETGet groups resources
- PUTPut groups resources
- GETGet nested groups
- POSTPost groups containing groups
- GETGet nested group by ID
- DELDelete groups containing groups
- POSTPost groups resources
- GETGet groups visibility
- PUTPut groups visibility
- GETGet groups reviewersdeprecated
- PUTPut groups reviewersdeprecated
- GETGet groups reviewer stagesdeprecated
- PUTPut groups reviewer stagesdeprecated
- GETGet groups tags
- GETGet groups users
- PUTPut groups users
- POSTPost groups users
- DELDelete groups users
- GETGet groupsusers
- GET
curl --request GET \
--url https://api.opal.dev/v1/groups \
--header 'Authorization: Bearer <token>'{
"next": "cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw",
"previous": "cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ",
"results": [
{
"group_id": "f454d283-ca87-4a8a-bdbb-df212eca5353",
"app_id": "b5a5ca27-0ea3-4d86-9199-2126d57d1fbd",
"description": "This group represents Active Directory group \"Payments Production Admin\". We use this AD group to facilitate staging deployments and qualifying new releases.",
"admin_owner_id": "7c86c85d-0651-43e2-a748-d69d658418e8",
"max_duration": 120,
"require_manager_approval": false,
"require_support_ticket": false
},
{
"group_id": "99d0b81d-14be-4cf6-bd27-348b4af1d11b",
"description": "Manages the Integrations Team on-call privileged resources. This group is automatically synced with the on-call rotation defined in PagerDuty.",
"admin_owner_id": "4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3",
"max_duration": 360,
"require_manager_approval": false,
"require_support_ticket": true
}
]
}Returns a list of groups for your organization.
curl --request GET \
--url https://api.opal.dev/v1/groups \
--header 'Authorization: Bearer <token>'{
"next": "cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw",
"previous": "cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ",
"results": [
{
"group_id": "f454d283-ca87-4a8a-bdbb-df212eca5353",
"app_id": "b5a5ca27-0ea3-4d86-9199-2126d57d1fbd",
"description": "This group represents Active Directory group \"Payments Production Admin\". We use this AD group to facilitate staging deployments and qualifying new releases.",
"admin_owner_id": "7c86c85d-0651-43e2-a748-d69d658418e8",
"max_duration": 120,
"require_manager_approval": false,
"require_support_ticket": false
},
{
"group_id": "99d0b81d-14be-4cf6-bd27-348b4af1d11b",
"description": "Manages the Integrations Team on-call privileged resources. This group is automatically synced with the on-call rotation defined in PagerDuty.",
"admin_owner_id": "4220bc12-ab8a-4b5d-be7b-f6bbcf9159f3",
"max_duration": 360,
"require_manager_approval": false,
"require_support_ticket": true
}
]
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Query Parameters
The pagination cursor value.
Number of results to return per page. Default is 200.
x <= 1000The group type to filter by. The type of the group.
ACTIVE_DIRECTORY_GROUP, AWS_SSO_GROUP, DATABRICKS_ACCOUNT_GROUP, DUO_GROUP, GIT_HUB_TEAM, GIT_LAB_GROUP, GOOGLE_GROUPS_GROUP, GOOGLE_GROUPS_GKE_GROUP, LDAP_GROUP, OKTA_GROUP, OKTA_GROUP_RULE, TAILSCALE_GROUP, OPAL_GROUP, OPAL_ACCESS_RULE, AZURE_AD_SECURITY_GROUP, AZURE_AD_MICROSOFT_365_GROUP, CONNECTOR_GROUP, SNOWFLAKE_ROLE, WORKDAY_USER_SECURITY_GROUP, PAGERDUTY_ON_CALL_SCHEDULE, INCIDENTIO_ON_CALL_SCHEDULE, DEVIN_GROUP "OPAL_GROUP"
The group ids to filter by.
Group name.
Response
One page worth groups associated with your organization.
Show child attributes
Show child attributes
The ID of the group.
"f454d283-ca87-4a8a-bdbb-df212eca5353"
The ID of the group's app.
"b5a5ca27-0ea3-4d86-9199-2126d57d1fbd"
The name of the group.
"API Group"
A description of the group.
"This group represents Active Directory group \"Payments Production Admin\". We use this AD group to facilitate staging deployments and qualifying new releases."
The ID of the owner of the group.
"7c86c85d-0651-43e2-a748-d69d658418e8"
A list of User IDs for the group leaders of the group
The ID of the remote.
"google-group-group:037m2jsg218b2wb"
The name of the remote.
"Finance team"
The type of the group.
ACTIVE_DIRECTORY_GROUP, AWS_SSO_GROUP, DATABRICKS_ACCOUNT_GROUP, DUO_GROUP, GIT_HUB_TEAM, GIT_LAB_GROUP, GOOGLE_GROUPS_GROUP, GOOGLE_GROUPS_GKE_GROUP, LDAP_GROUP, OKTA_GROUP, OKTA_GROUP_RULE, TAILSCALE_GROUP, OPAL_GROUP, OPAL_ACCESS_RULE, AZURE_AD_SECURITY_GROUP, AZURE_AD_MICROSOFT_365_GROUP, CONNECTOR_GROUP, SNOWFLAKE_ROLE, WORKDAY_USER_SECURITY_GROUP, PAGERDUTY_ON_CALL_SCHEDULE, INCIDENTIO_ON_CALL_SCHEDULE, DEVIN_GROUP "OPAL_GROUP"
The maximum duration for which the group can be requested (in minutes).
120
The recommended duration for which the group should be requested (in minutes). -1 represents an indefinite duration.
120
The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.
120
A bool representing whether or not access requests to the group require manager approval.
false
A bool representing whether or not access requests to the group require an access ticket.
false
A bool representing whether or not to require MFA for reviewers to approve requests for this group.
false
A bool representing whether or not to require MFA for requesting access to this group.
false
A bool representing whether or not to automatically approve requests to this group.
false
The ID of the associated request template.
"06851574-e50d-40ca-8c78-f72ae6ab4304"
The ID of the associated configuration template.
"06851574-e50d-40ca-8c78-f72ae6ab4304"
The ID of the associated group binding.
"06851574-e50d-40ca-8c78-f72ae6ab4304"
A bool representing whether or not to allow access requests to this group.
false
A list of request configurations for this group.
Show child attributes
Show child attributes
A bool representing whether or not to allow requests for this resource.
true
A bool representing whether or not to automatically approve requests for this resource.
false
A bool representing whether or not to require MFA for requesting access to this resource.
false
A bool representing whether or not access requests to the resource require an access ticket.
false
The priority of the request configuration.
1
The condition for the request configuration.
Show child attributes
Show child attributes
The list of group IDs to match.
["1b978423-db0a-4037-a4cf-f79c60cb67b3"]The list of role remote IDs to match.
[
"arn:aws:iam::590304332660:role/AdministratorAccess"
]{
"group_ids": ["1b978423-db0a-4037-a4cf-f79c60cb67b3"]
}The maximum duration for which the resource can be requested (in minutes).
120
The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.
120
The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.
120
The ID of the associated request template.
"06851574-e50d-40ca-8c78-f72ae6ab4304"
The list of reviewer stages for the request configuration.
Show child attributes
Show child attributes
Whether this reviewer stage should require manager approval.
false
The operator of the reviewer stage. Admin and manager approval are also treated as reviewers.
AND, OR "AND"
Whether this reviewer stage should require admin approval.
false
[]A list of request configurations for this group. Deprecated in favor of request_configurations.
Show child attributes
Show child attributes
A bool representing whether or not to allow requests for this resource.
true
A bool representing whether or not to automatically approve requests for this resource.
false
A bool representing whether or not to require MFA for requesting access to this resource.
false
A bool representing whether or not access requests to the resource require an access ticket.
false
The priority of the request configuration.
1
The condition for the request configuration.
Show child attributes
Show child attributes
The list of group IDs to match.
["1b978423-db0a-4037-a4cf-f79c60cb67b3"]The list of role remote IDs to match.
[
"arn:aws:iam::590304332660:role/AdministratorAccess"
]{
"group_ids": ["1b978423-db0a-4037-a4cf-f79c60cb67b3"]
}The maximum duration for which the resource can be requested (in minutes).
120
The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.
120
The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.
120
The ID of the associated request template.
"06851574-e50d-40ca-8c78-f72ae6ab4304"
The list of reviewer stages for the request configuration.
Show child attributes
Show child attributes
Whether this reviewer stage should require manager approval.
false
The operator of the reviewer stage. Admin and manager approval are also treated as reviewers.
AND, OR "AND"
Whether this reviewer stage should require admin approval.
false
[]JSON metadata about the remote group. Only set for items linked to remote systems. See this guide for details.
"{ \"okta_directory_group\": { \"group_id\": \"00g4bs66kwtpe1g12345\" } }"
Information that defines the remote group. This replaces the deprecated remote_id and metadata fields. If remote_info is provided, a group will be imported into Opal. For group types that support group creation through Opal, a new group will be created if remote_info is not provided.
Show child attributes
Show child attributes
Remote info for Microsoft Entra ID Microsoft 365 group.
Show child attributes
Show child attributes
The id of the Microsoft Entra ID Microsoft 365 group.
"01fa7402-01d8-103b-8deb-5f3a0ab7884"
Custom request notification sent to the requester when the request is approved.
800"Check your email to register your account."
The risk sensitivity level for the group. When an override is set, this field will match that.
UNKNOWN, CRITICAL, HIGH, MEDIUM, LOW, NONE Indicates the level of potential impact misuse or unauthorized access may incur.
UNKNOWN, CRITICAL, HIGH, MEDIUM, LOW, NONE Information about the last successful sync of this group.
{
"id": "7c86c85d-0651-43e2-a748-d69d658418e8",
"completed_at": "2023-10-01T12:00:00.000Z"
}The cursor with which to continue pagination if additional result pages exist.
"cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw"
The cursor used to obtain the current result page.
"cj1sZXdwd2VycWVtY29zZnNkc2NzUWxNMEUxTXk0ME16UXpNallsTWtJ"
Was this page helpful?