Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a Node query filters and returns entities (users, resources, or groups); an Access query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set type to NODE or ACCESS in the request body to select the query type.
This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/json
Node
Access
Request body for an ad-hoc OpalQuery. Set type to NODE to query entities, or ACCESS to query access grants. The fields available in query differ by type — refer to each tab for the full schema.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Opal Security Docs","colors":{"primary":"#0C7997","light":"#EDFCFC","dark":"#074055"},"logo":{"light":"https://mintcdn.com/opalsecurity/FBbZyeMPZrA69UcV/logo/logo-dark.svg?fit=max\u0026auto=format\u0026n=FBbZyeMPZrA69UcV\u0026q=85\u0026s=93a4bd75f157f9f0ab43cdf4d715b5cd","dark":"https://mintcdn.com/opalsecurity/FBbZyeMPZrA69UcV/logo/logo-light.svg?fit=max\u0026auto=format\u0026n=FBbZyeMPZrA69UcV\u0026q=85\u0026s=1774b545e4f1c5cad647f5194f7b26d9"},"favicon":{"light":"https://mintcdn.com/opalsecurity/DRAwGKUXMxLRQouh/logo/icon-opal-black.svg?fit=max\u0026auto=format\u0026n=DRAwGKUXMxLRQouh\u0026q=85\u0026s=9c8bd1204b6b5b83542c2ab5be549858","dark":"https://mintcdn.com/opalsecurity/DRAwGKUXMxLRQouh/logo/icon-opal-white.svg?fit=max\u0026auto=format\u0026n=DRAwGKUXMxLRQouh\u0026q=85\u0026s=73b53b4ceab6ae0b00e30b2042a6020a"},"icons":{"library":"lucide"},"styling":{"eyebrows":"breadcrumbs","latex":false},"integrations":{"ga4":{"measurementId":"G-1PPPM1WF6D"}},"errors":{"404":{"redirect":false,"title":"Page can't be found","description":"Sorry! This page might have been moved, or the link might be broken. Go back to our documentation via https://docs.opal.dev/docs/welcome."}},"metadata":{"timestamp":true},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"opalsecurity","hasAudioNarration":false,"actualSubdomain":"opalsecurity","customDomains":["docs.opal.dev"],"gitSource":{"type":"github","owner":"opalsecurity","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ae53a3b88b90693e911fadb","collectionId":"58745dd4-af12-4aee-a56b-e01162c67c8c","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ae53a3b88b90693e911fadb"},"feedback":{"thumbs":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ae53a3b88b90693e911fadb","clientVersion":"0.0.4044","searchFilterCounts":[{"language":"default","tag":"API Reference","count":212},{"language":"default","tag":"Opal API","count":207},{"language":"default","tag":"Documentation","count":99},{"language":"default","tag":"Integrations","count":94},{"language":"default","tag":"Entitlement Management","count":63},{"language":"default","tag":"resources","count":34},{"language":"default","tag":"groups","count":32},{"language":"default","tag":"Getting Started","count":25},{"language":"default","tag":"Access Management","count":22},{"language":"default","tag":"Infrastructure","count":22}]},"assistantConfig":{"enableStarterQuestions":true,"enableContextualStarterQuestions":true,"deflection":{"enabled":true,"email":"support@opal.dev","showHelpButton":true}},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/opal-queries/run-an-ad-hoc-opalquery","slug":"/api-reference/opal-queries/run-an-ad-hoc-opalquery","pageMetadata":{"title":"Run an ad-hoc OpalQuery","description":"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a **Node** query filters and returns entities (users, resources, or groups); an **Access** query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set `type` to `NODE` or `ACCESS` in the request body to select the query type.\n\nThis endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\n","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /queries/run","href":"/api-reference/opal-queries/run-an-ad-hoc-opalquery","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n code: \"code\",\n p: \"p\",\n strong: \"strong\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_Fragment, {\n children: [_jsxs(_components.p, {\n children: [\"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a \", _jsx(_components.strong, {\n children: \"Node\"\n }), \" query filters and returns entities (users, resources, or groups); an \", _jsx(_components.strong, {\n children: \"Access\"\n }), \" query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set \", _jsx(_components.code, {\n children: \"type\"\n }), \" to \", _jsx(_components.code, {\n children: \"NODE\"\n }), \" or \", _jsx(_components.code, {\n children: \"ACCESS\"\n }), \" in the request body to select the query type.\"]\n }), \"\\n\", _jsx(_components.p, {\n children: \"This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\"\n })]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Run an ad-hoc OpalQuery","description":"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a **Node** query filters and returns entities (users, resources, or groups); an **Access** query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set `type` to `NODE` or `ACCESS` in the request body to select the query type.\n\nThis endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\n","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /queries/run","href":"/api-reference/opal-queries/run-an-ad-hoc-opalquery","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":["/_mintlify/custom/opalsecurity/d0e14c3cf9bbd682/changelog-scraper.js"],"openApiReferenceData":{"operation":{"summary":"Run an ad-hoc OpalQuery","description":"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a **Node** query filters and returns entities (users, resources, or groups); an **Access** query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set `type` to `NODE` or `ACCESS` in the request body to select the query type.\n\nThis endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\n","operationId":"runOpalQuery","requestBody":"d1b9b713-e8f5-49c2-96e0-b8ac435c6eb6","responses":{"200":"ba82c6a3-e151-436d-a8da-af2e55bf6925"},"security":["1730a7b8-f283-47eb-a7e6-de1e6f775717"],"tags":["opal-queries"],"method":"post","type":"path","servers":["eede27a1-273e-429e-8894-5fea991f83c7"],"path":"/queries/run","baseUrlOptions":["https://api.opal.dev/v1"],"title":"Run an ad-hoc OpalQuery","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{},"requestBody":{"required":true,"content":{"application/json":{"schema":{"oneOf":[{"type":"object","title":"Node","description":"Request body for an ad-hoc OpalQuery. Set `type` to `NODE` to query entities, or `ACCESS` to query access grants. The fields available in `query` differ by type — refer to each tab for the full schema.\n","required":["type"],"example":{"type":"NODE","query":{"nodeFilters":{"entityTypes":["RESOURCE"],"entityTag":{"key":"env","value":"prod"}},"accessFilters":{"isAccessibleBy":{"entityTypes":["USER"],"entityTag":{"key":"contractor"}}}},"first":50},"properties":{"type":{"type":"string","enum":["NODE"],"isRequired":true,"uniqueKey":"oneOf.0.type","typeLabel":"enum\u003cstring>"},"query":{"type":"object","description":"The filter body for a NODE-type OpalQuery.","properties":{"nodeFilters":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.0.query.nodeFilters.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.nodeFilters.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.0.query.nodeFilters.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.nodeFilters.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.0.query.nodeFilters.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.0.query.nodeFilters.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.0.query.nodeFilters.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.0.query.nodeFilters.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.0.query.nodeFilters.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.nodeFilters.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.0.query.nodeFilters.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.0.query.nodeFilters.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.0.query.nodeFilters.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.0.query.nodeFilters.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.0.query.nodeFilters.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.0.query.nodeFilters.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.query.nodeFilters.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.0.query.nodeFilters.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.nodeFilters.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.0.query.nodeFilters.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.nodeFilters.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.nodeFilters.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.0.query.nodeFilters.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.0.query.nodeFilters.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.nodeFilters.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.nodeFilters.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.0.query.nodeFilters.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.nodeFilters.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.0.query.nodeFilters.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.0.query.nodeFilters.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.query.nodeFilters.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.0.query.nodeFilters.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.query.nodeFilters.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.0.query.nodeFilters.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.0.query.nodeFilters.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.0.query.nodeFilters.not","typeLabel":"object"}},"uniqueKey":"oneOf.0.query.nodeFilters","typeLabel":"object"},"accessFilters":{"type":"object","description":"Filters the returned nodes by the access edges connected to them. When `isAccessibleBy` and `hasAccessTo` are provided, the returned nodes must satisfy both edge constraints simultaneously.\n","properties":{"isAccessibleBy":{"type":"object","description":"Inbound-edge filter. The returned node must be accessible by at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy.not","typeLabel":"object"}},"uniqueKey":"oneOf.0.query.accessFilters.isAccessibleBy","typeLabel":"object"},"hasAccessTo":{"type":"object","description":"Outbound-edge filter. The returned node must have access to at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo.not","typeLabel":"object"}},"uniqueKey":"oneOf.0.query.accessFilters.hasAccessTo","typeLabel":"object"}},"uniqueKey":"oneOf.0.query.accessFilters","typeLabel":"object"}},"uniqueKey":"oneOf.0.query","typeLabel":"object"},"first":{"type":"integer","description":"Maximum number of results to return. Defaults to 200.","example":200,"uniqueKey":"oneOf.0.first","typeLabel":"integer"},"after":{"type":"string","description":"Cursor from a previous response to fetch the next page of results.","example":"29827fb8-f2dd-4e80-9576-28e31e9934ac","uniqueKey":"oneOf.0.after","typeLabel":"string"}},"uniqueKey":"oneOf.0","typeLabel":"Node · object"},{"type":"object","title":"Access","description":"Request body for an ad-hoc OpalQuery. Set `type` to `NODE` to query entities, or `ACCESS` to query access grants. The fields available in `query` differ by type — refer to each tab for the full schema.\n","required":["type"],"example":{"type":"ACCESS","query":{"principalFilter":{"entityTypes":["USER"]},"entitlementFilter":{"entityItemTypes":["AWS_IAM_ROLE"]}},"first":50},"properties":{"type":{"type":"string","enum":["ACCESS"],"isRequired":true,"uniqueKey":"oneOf.1.type","typeLabel":"enum\u003cstring>"},"query":{"type":"object","description":"Edge-query filters for an ACCESS OpalQuery. At least one of principalFilter or entitlementFilter is required.","properties":{"principalFilter":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.1.query.principalFilter.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalFilter.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.1.query.principalFilter.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalFilter.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.1.query.principalFilter.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.1.query.principalFilter.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.1.query.principalFilter.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.1.query.principalFilter.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.1.query.principalFilter.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalFilter.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.1.query.principalFilter.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.1.query.principalFilter.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.1.query.principalFilter.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.1.query.principalFilter.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalFilter.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.1.query.principalFilter.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.query.principalFilter.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.1.query.principalFilter.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalFilter.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.1.query.principalFilter.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalFilter.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalFilter.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.query.principalFilter.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.1.query.principalFilter.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalFilter.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalFilter.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.principalFilter.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalFilter.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.principalFilter.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalFilter.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.principalFilter.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalFilter.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.principalFilter.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.principalFilter.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.principalFilter.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.1.query.principalFilter.not","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.principalFilter","typeLabel":"object"},"entitlementFilter":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.1.query.entitlementFilter.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementFilter.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.1.query.entitlementFilter.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementFilter.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementFilter.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementFilter.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.1.query.entitlementFilter.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementFilter.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.1.query.entitlementFilter.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementFilter.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementFilter.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.1.query.entitlementFilter.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.1.query.entitlementFilter.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.1.query.entitlementFilter.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementFilter.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementFilter.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.query.entitlementFilter.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.1.query.entitlementFilter.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementFilter.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.1.query.entitlementFilter.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementFilter.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementFilter.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementFilter.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.1.query.entitlementFilter.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementFilter.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementFilter.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.entitlementFilter.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementFilter.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.entitlementFilter.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementFilter.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.entitlementFilter.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementFilter.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.entitlementFilter.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.entitlementFilter.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.entitlementFilter.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.1.query.entitlementFilter.not","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.entitlementFilter","typeLabel":"object"},"principalAccessFilters":{"type":"object","description":"Advanced access filter on the principal side of each path. Restricts results to principals that additionally satisfy these access-edge constraints: `hasAccessTo` keeps only principals that also have access to a matching entity; `isAccessibleBy` keeps only principals that are also accessible by a matching entity. Only takes effect when `principalFilter` is also supplied (it refines that filter); on its own it has no effect.\n","properties":{"isAccessibleBy":{"type":"object","description":"Inbound-edge filter. The returned node must be accessible by at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy.not","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.isAccessibleBy","typeLabel":"object"},"hasAccessTo":{"type":"object","description":"Outbound-edge filter. The returned node must have access to at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo.not","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.principalAccessFilters.hasAccessTo","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.principalAccessFilters","typeLabel":"object"},"entitlementAccessFilters":{"type":"object","description":"Advanced access filter on the entitlement side of each path. Restricts results to entitlements that additionally satisfy these access-edge constraints: `hasAccessTo` keeps only entitlements that also have access to a matching entity; `isAccessibleBy` keeps only entitlements that are also accessible by a matching entity. Only takes effect when `entitlementFilter` is also supplied (it refines that filter); on its own it has no effect.\n","properties":{"isAccessibleBy":{"type":"object","description":"Inbound-edge filter. The returned node must be accessible by at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy.not","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.isAccessibleBy","typeLabel":"object"},"hasAccessTo":{"type":"object","description":"Outbound-edge filter. The returned node must have access to at least one entity matching this filter.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"],"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTypes","typeLabel":"enum\u003cstring>[]"},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityItemTypes.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityItemTypes","typeLabel":"enum\u003cstring>[]"},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityName.stringMatchType","typeLabel":"enum\u003cstring>"},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityName.string","typeLabel":"string"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityName","typeLabel":"object"},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityDescription.string","typeLabel":"string"},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring.","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityDescription.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityDescription","typeLabel":"object"},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTag.key","typeLabel":"string"},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTag.value","typeLabel":"string"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection.","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTag.connectionId","typeLabel":"string\u003cuuid>"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTag","typeLabel":"object"},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTagKey.keys.items.[INDEX]","typeLabel":"string"},"example":["Critical"],"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTagKey.keys","typeLabel":"string[]"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityTagKey","typeLabel":"object"},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.hrIdpStatus.statuses.items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.hrIdpStatus.statuses","typeLabel":"enum\u003cstring>[]"},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\").","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.hrIdpStatus.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.hrIdpStatus","typeLabel":"object"},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityAdminOwner.ownerIDs","typeLabel":"string\u003cuuid>[]"},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners.","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityAdminOwner.not","typeLabel":"boolean"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityAdminOwner","typeLabel":"object"},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityIDs.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.entityIDs","typeLabel":"string\u003cuuid>[]"},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.importedFromApp.items.[INDEX]","typeLabel":"string\u003cuuid>"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.importedFromApp","typeLabel":"string\u003cuuid>[]"},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.roleRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.roleRemoteIds","typeLabel":"string[]"},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.roleNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.roleNames","typeLabel":"string[]"},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.allOf","typeLabel":"array"},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.anyOf","typeLabel":"array"},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters","uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo.not","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters.hasAccessTo","typeLabel":"object"}},"uniqueKey":"oneOf.1.query.entitlementAccessFilters","typeLabel":"object"},"accessLevelRemoteIds":{"type":"array","description":"Filter by access-level remote IDs on the terminal edge.","items":{"type":"string","uniqueKey":"oneOf.1.query.accessLevelRemoteIds.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.accessLevelRemoteIds","typeLabel":"string[]"},"accessLevelNames":{"type":"array","description":"Filter by access-level display names on the terminal edge.","items":{"type":"string","uniqueKey":"oneOf.1.query.accessLevelNames.items.[INDEX]","typeLabel":"string"},"uniqueKey":"oneOf.1.query.accessLevelNames","typeLabel":"string[]"},"edgeFilter":{"type":"object","description":"Constraints on the access path edges themselves.","properties":{"directOnly":{"type":"boolean","description":"When true, only return direct (depth-1) principal-to-entitlement edges.","example":true,"uniqueKey":"oneOf.1.query.edgeFilter.directOnly","typeLabel":"boolean"},"accessDurationType":{"type":"string","description":"Constrain results by whether the terminal access expires.","enum":["EXPIRING_ONLY","PERMANENT_ONLY"],"example":"EXPIRING_ONLY","uniqueKey":"oneOf.1.query.edgeFilter.accessDurationType","typeLabel":"enum\u003cstring>"}},"uniqueKey":"oneOf.1.query.edgeFilter","typeLabel":"object"}},"uniqueKey":"oneOf.1.query","typeLabel":"object"},"first":{"type":"integer","description":"Maximum number of results to return. Defaults to 200.","example":200,"uniqueKey":"oneOf.1.first","typeLabel":"integer"},"after":{"type":"string","description":"Opaque cursor from a previous ACCESS response to fetch the next page of results.","uniqueKey":"oneOf.1.after","typeLabel":"string"}},"uniqueKey":"oneOf.1","typeLabel":"Access · object"}],"uniqueKey":"","typeLabel":"Node · object | Access · object"},"examples":{"Example":{"title":"Example","value":{"type":"NODE","query":{"nodeFilters":{"entityTypes":["RESOURCE"],"entityTag":{"key":"env","value":"prod"}},"accessFilters":{"isAccessibleBy":{"entityTypes":["USER"],"entityTag":{"key":"contractor"}}}},"first":50}}},"exampleType":"generated"}},"exampleType":"generated"},"responses":{"ba82c6a3-e151-436d-a8da-af2e55bf6925":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","description":"Paginated results of an OpalQuery. The `type` field discriminates which result schema applies and mirrors the `type` field on the request.","required":["type","edges","pageInfo"],"properties":{"type":{"type":"string","enum":["NODE"],"isRequired":true,"uniqueKey":"oneOf.0.type","typeLabel":"enum\u003cstring>"},"edges":{"type":"array","description":"List of matched entities.","items":{"type":"object","required":["node","cursor"],"description":"A single result edge from an OpalQuery, containing the matched entity and its pagination cursor.","properties":{"node":{"type":"object","required":["id","name","entityType","entityItemType"],"description":"A matched entity from an OpalQuery result.","properties":{"id":{"type":"string","format":"uuid","description":"The entity's unique identifier.","isRequired":true,"uniqueKey":"oneOf.0.edges.items.[INDEX].node.id","typeLabel":"string\u003cuuid>"},"name":{"type":"string","description":"The display name of the entity.","isRequired":true,"uniqueKey":"oneOf.0.edges.items.[INDEX].node.name","typeLabel":"string"},"entityType":{"type":"string","enum":["USER","GROUP","RESOURCE"],"description":"The top-level entity type.","isRequired":true,"uniqueKey":"oneOf.0.edges.items.[INDEX].node.entityType","typeLabel":"enum\u003cstring>"},"entityItemType":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string","isRequired":true,"uniqueKey":"oneOf.0.edges.items.[INDEX].node.entityItemType","typeLabel":"enum\u003cstring>"}},"isRequired":true,"uniqueKey":"oneOf.0.edges.items.[INDEX].node","typeLabel":"object"},"cursor":{"type":"string","description":"Opaque cursor for this entity, used for pagination.","isRequired":true,"uniqueKey":"oneOf.0.edges.items.[INDEX].cursor","typeLabel":"string"}},"uniqueKey":"oneOf.0.edges.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.0.edges","typeLabel":"object[]"},"pageInfo":{"type":"object","required":["hasNextPage","endCursor","hasPreviousPage","startCursor"],"properties":{"hasNextPage":{"type":"boolean","description":"Whether there are more items after the end cursor","isRequired":true,"uniqueKey":"oneOf.0.pageInfo.hasNextPage","typeLabel":"boolean"},"endCursor":{"type":"string","description":"The cursor to continue pagination forwards","isRequired":true,"uniqueKey":"oneOf.0.pageInfo.endCursor","typeLabel":"string"},"hasPreviousPage":{"type":"boolean","description":"Whether there are more items before the start cursor","isRequired":true,"uniqueKey":"oneOf.0.pageInfo.hasPreviousPage","typeLabel":"boolean"},"startCursor":{"type":"string","description":"The cursor to continue pagination backwards","isRequired":true,"uniqueKey":"oneOf.0.pageInfo.startCursor","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.0.pageInfo","typeLabel":"object"}},"uniqueKey":"oneOf.0","typeLabel":"object"},{"type":"object","description":"Paginated results of an OpalQuery. The `type` field discriminates which result schema applies and mirrors the `type` field on the request.","required":["type","edges","pageInfo"],"properties":{"type":{"type":"string","enum":["ACCESS"],"isRequired":true,"uniqueKey":"oneOf.1.type","typeLabel":"enum\u003cstring>"},"edges":{"type":"array","description":"List of matched access grants.","items":{"type":"object","required":["node","cursor"],"description":"A single ACCESS result edge containing the matched access grant and its pagination cursor.","properties":{"node":{"type":"object","required":["principalId","entitlementId","isDirect","paths"],"description":"A matched access grant from an ACCESS OpalQuery — one per (principal, entitlement, access level), with every access path as metadata.","properties":{"principalId":{"type":"string","format":"uuid","description":"The principal entity ID.","isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].node.principalId","typeLabel":"string\u003cuuid>"},"entitlementId":{"type":"string","format":"uuid","description":"The entitlement entity ID.","isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].node.entitlementId","typeLabel":"string\u003cuuid>"},"isDirect":{"type":"boolean","description":"True when any path is a direct grant.","isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].node.isDirect","typeLabel":"boolean"},"paths":{"type":"array","description":"Every access path reaching this grant.","items":{"type":"object","required":["path"],"description":"A single access path within an ACCESS result.","properties":{"path":{"type":"array","description":"Entity IDs along the path from principal to entitlement.","items":{"type":"string","format":"uuid","uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths.items.[INDEX].path.items.[INDEX]","typeLabel":"string\u003cuuid>"},"isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths.items.[INDEX].path","typeLabel":"string\u003cuuid>[]"},"expiration":{"oneOf":[{"type":"string","format":"date-time","description":"This path's expiration, if any.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths.items.[INDEX].expiration.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"This path's expiration, if any.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths.items.[INDEX].expiration.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths.items.[INDEX].expiration","typeLabel":"string\u003cdate-time> | null"}},"uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].node.paths","typeLabel":"object[]"},"accessLevelRemoteId":{"oneOf":[{"type":"string","description":"Remote ID of the access level.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.accessLevelRemoteId.oneOf.0","typeLabel":"string"},{"type":"null","description":"Remote ID of the access level.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.accessLevelRemoteId.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.edges.items.[INDEX].node.accessLevelRemoteId","typeLabel":"string | null"},"accessLevelName":{"oneOf":[{"type":"string","description":"Display name of the access level.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.accessLevelName.oneOf.0","typeLabel":"string"},{"type":"null","description":"Display name of the access level.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.accessLevelName.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.edges.items.[INDEX].node.accessLevelName","typeLabel":"string | null"},"effectiveExpiration":{"oneOf":[{"type":"string","format":"date-time","description":"The expiration in effect across all paths (the latest-expiring; a permanent path wins). Null means access never expires.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.effectiveExpiration.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"The expiration in effect across all paths (the latest-expiring; a permanent path wins). Null means access never expires.","uniqueKey":"oneOf.1.edges.items.[INDEX].node.effectiveExpiration.oneOf.1","typeLabel":"null"}],"uniqueKey":"oneOf.1.edges.items.[INDEX].node.effectiveExpiration","typeLabel":"string\u003cdate-time> | null"}},"isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].node","typeLabel":"object"},"cursor":{"type":"string","description":"Opaque cursor for this grant, used for pagination.","isRequired":true,"uniqueKey":"oneOf.1.edges.items.[INDEX].cursor","typeLabel":"string"}},"uniqueKey":"oneOf.1.edges.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"oneOf.1.edges","typeLabel":"object[]"},"pageInfo":{"type":"object","required":["hasNextPage","endCursor","hasPreviousPage","startCursor"],"properties":{"hasNextPage":{"type":"boolean","description":"Whether there are more items after the end cursor","isRequired":true,"uniqueKey":"oneOf.1.pageInfo.hasNextPage","typeLabel":"boolean"},"endCursor":{"type":"string","description":"The cursor to continue pagination forwards","isRequired":true,"uniqueKey":"oneOf.1.pageInfo.endCursor","typeLabel":"string"},"hasPreviousPage":{"type":"boolean","description":"Whether there are more items before the start cursor","isRequired":true,"uniqueKey":"oneOf.1.pageInfo.hasPreviousPage","typeLabel":"boolean"},"startCursor":{"type":"string","description":"The cursor to continue pagination backwards","isRequired":true,"uniqueKey":"oneOf.1.pageInfo.startCursor","typeLabel":"string"}},"isRequired":true,"uniqueKey":"oneOf.1.pageInfo","typeLabel":"object"}},"uniqueKey":"oneOf.1","typeLabel":"object"}],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"type":"NODE","edges":[{"node":{"id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","name":"\u003cstring>","entityType":"USER","entityItemType":"OPAL_ROLE"},"cursor":"\u003cstring>"}],"pageInfo":{"hasNextPage":true,"endCursor":"\u003cstring>","hasPreviousPage":true,"startCursor":"\u003cstring>"}}}},"exampleType":"generated"}},"description":"The results of the OpalQuery.","exampleType":"generated"}},"security":{"1730a7b8-f283-47eb-a7e6-de1e6f775717":{"BearerAuth":{"scheme":"bearer","type":"http","scopes":[],"schemeName":"BearerAuth"}}},"servers":{"eede27a1-273e-429e-8894-5fea991f83c7":{"description":"Production","url":"https://api.opal.dev/v1"}},"schemas":{"d8001960-380e-4944-9f06-319abcb92371":{"type":"object","description":"Filters for matching entities by type, name, tag, IDs, connections, or access levels. Supports recursive logical composition via allOf/anyOf.","properties":{"entityTypes":{"type":"array","description":"Filter by entity type. Only RESOURCE, GROUP, and USER are queryable via OpalQuery.","items":{"type":"string","enum":["RESOURCE","GROUP","USER"]}},"entityItemTypes":{"type":"array","description":"Filter by entity item types.","items":{"description":"Granular subtype of an entity.","enum":["USER","SERVICE_USER","ACTIVE_DIRECTORY_GROUP","AWS_SSO_GROUP","DUO_GROUP","GIT_HUB_TEAM","GIT_LAB_GROUP","GOOGLE_GROUPS_GROUP","GOOGLE_GROUPS_GKE_GROUP","LDAP_GROUP","OKTA_GROUP","OKTA_GROUP_RULE","TAILSCALE_GROUP","TWINGATE_GROUP","TWINGATE_GROUP_SYNCED","OPAL_GROUP","OPAL_ACCESS_RULE","AZURE_AD_SECURITY_GROUP","AZURE_AD_MICROSOFT_365_GROUP","CONNECTOR_GROUP","SNOWFLAKE_ROLE","WORKDAY_USER_SECURITY_GROUP","DATABRICKS_ACCOUNT_GROUP","AWS_IAM_ROLE","AWS_EC2_INSTANCE","AWS_EKS_CLUSTER","AWS_RDS_POSTGRES_INSTANCE","AWS_RDS_POSTGRES_CLUSTER","AWS_RDS_MYSQL_INSTANCE","AWS_RDS_MYSQL_CLUSTER","AWS_ACCOUNT","AWS_SSO_PERMISSION_SET","AWS_AGENTCORE_GATEWAY","AWS_AGENTCORE_GATEWAY_TARGET","AWS_AGENTCORE_GATEWAY_TOOL","AZURE_MANAGEMENT_GROUP","AZURE_RESOURCE_GROUP","AZURE_SUBSCRIPTION","AZURE_VIRTUAL_MACHINE","AZURE_STORAGE_ACCOUNT","AZURE_STORAGE_CONTAINER","AZURE_SQL_SERVER","AZURE_SQL_MANAGED_INSTANCE","AZURE_SQL_DATABASE","AZURE_SQL_MANAGED_DATABASE","AZURE_USER_ASSIGNED_MANAGED_Identity","AZURE_ENTRA_ID_ROLE","AZURE_ENTERPRISE_APP","CUSTOM","CUSTOM_CONNECTOR","GCP_ORGANIZATION","GCP_BUCKET","GCP_COMPUTE_INSTANCE","GCP_BIG_QUERY_DATASET","GCP_BIG_QUERY_TABLE","GCP_FOLDER","GCP_GKE_CLUSTER","GCP_PROJECT","GCP_CLOUD_SQL_POSTGRES_INSTANCE","GCP_CLOUD_SQL_MYSQL_INSTANCE","GCP_SERVICE_ACCOUNT","GCP_BILLING_ACCOUNT","GIT_HUB_REPO","GIT_HUB_ORG_ROLE","GIT_LAB_PROJECT","GOOGLE_WORKSPACE_ROLE","MONGO_INSTANCE","MONGO_ATLAS_INSTANCE","OKTA_APP","OKTA_ROLE","OPAL_ROLE","OPAL_SCOPED_ROLE","PAGERDUTY_ROLE","TAILSCALE_SSH","TWINGATE_RESOURCE","SALESFORCE_PERMISSION_SET","SALESFORCE_PROFILE","SALESFORCE_ROLE","SNOWFLAKE_DATABASE","SNOWFLAKE_SCHEMA","SNOWFLAKE_TABLE","WORKDAY_ROLE","MYSQL_INSTANCE","MARIADB_INSTANCE","POSTGRES_INSTANCE","TELEPORT_ROLE","DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL","ILEVEL_ADVANCED_ROLE","DATABRICKS_CATALOG","DATABRICKS_SCHEMA","DATABRICKS_VOLUME","DATABRICKS_FUNCTION","DATABRICKS_MODEL","DATABRICKS_SERVICE","DATABRICKS_MCP_SERVER"],"example":"OPAL_ROLE","type":"string"}},"entityName":{"type":"object","required":["stringMatchType","string"],"description":"Filters entities by name using a string match strategy.","properties":{"stringMatchType":{"type":"string","description":"How to match a string value against entity names. REGEX matches the value as a case-insensitive regular expression.","enum":["CONTAINS","EQUALS","STARTS_WITH","ENDS_WITH","REGEX"],"isRequired":true},"string":{"type":"string","description":"The string value to match against the entity name.","example":"engineering","isRequired":true}}},"entityDescription":{"type":"object","required":["string"],"description":"Filters GROUP and RESOURCE entities by a case-insensitive substring of their description (\"contains\"). USER entities have no description and never match, in either polarity. `not` inverts the match within the resource/group domain (\"does NOT contain\"), so it still returns only resources/groups rather than sweeping in users.\n","properties":{"string":{"type":"string","description":"The substring to match against the entity description.","example":"production","isRequired":true},"not":{"type":"boolean","description":"Invert the match — return resources/groups whose description does NOT contain the substring."}}},"entityTag":{"type":"object","required":["key"],"description":"Filters entities by a tag key/value pair, optionally scoped to a connection.","properties":{"key":{"type":"string","description":"The tag key to filter by.","example":"team","isRequired":true},"value":{"type":"string","description":"The tag value to filter by. If omitted, matches only tags with no value; use entityTagKey to match any value for a key.","example":"platform"},"connectionId":{"type":"string","format":"uuid","description":"If specified, filters by tags associated with this connection."}}},"entityTagKey":{"type":"object","required":["keys"],"description":"Filters entities that have a tag whose key is one of `keys`, whatever its value (including no value). Keys match exactly and case-sensitively. An empty list matches nothing. AGENT entities carry no tags, so they never match; under `not`, every agent matches, as with entityTag.\n","properties":{"keys":{"type":"array","description":"The tag keys to match.","items":{"type":"string"},"example":["Critical"],"isRequired":true}}},"hrIdpStatus":{"type":"object","description":"Filters USER entities by their HR/IDP lifecycle status. Only applies to USER entities; GROUP and RESOURCE entities never match, in either polarity. `statuses` combine with OR. `not` inverts the match within the user domain (e.g. \"IDP status is NOT active\"), so it still returns only users rather than sweeping in groups/resources.\n","properties":{"statuses":{"type":"array","description":"Match users whose HR/IDP status is one of these values.","items":{"description":"User status pulled from an HR/IDP provider.","enum":["ACTIVE","SUSPENDED","DEPROVISIONED","DELETED","NOT_FOUND"],"example":"ACTIVE","type":"string"}},"not":{"type":"boolean","description":"Invert the match within the user domain (e.g. \"IDP status is NOT active\")."}}},"entityAdminOwner":{"type":"object","required":["ownerIDs"],"description":"Filters GROUP and RESOURCE entities by their admin owner. USER entities never match, in either polarity. `not` inverts the match within the resource/group domain (self-negating, like IdpStatusFilter): omit it (or false) to include entities owned by the given owners, set it true to exclude them.\n","properties":{"ownerIDs":{"type":"array","description":"The owner (group) UUIDs to match entities against.","items":{"type":"string","format":"uuid"},"isRequired":true},"not":{"type":"boolean","description":"Invert the match — return resources/groups NOT owned by the given owners."}}},"entityIDs":{"type":"array","description":"Filter by specific entity UUIDs.","items":{"type":"string","format":"uuid"}},"importedFromApp":{"type":"array","description":"Filter by app IDs from which returned nodes will be imported from.","items":{"type":"string","format":"uuid"}},"roleRemoteIds":{"type":"array","description":"Filter by role remote IDs. Can only be applied within a hasAccessTo clause.","items":{"type":"string"}},"roleNames":{"type":"array","description":"Filter by role display names (e.g. \"Admin\", \"Read\"). Can only be applied within a hasAccessTo clause.","items":{"type":"string"}},"allOf":{"type":"array","description":"A list of nested filters that must all match (logical AND). Each\n item has the same shape as this object — scalar fields like\n `entityTypes` or `entityTag`, and can further nest `allOf`,\n `anyOf`, or `not`.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"}},"anyOf":{"type":"array","description":"A list of nested filters where at least one must match (logical\n OR). Each item has the same shape as this object.\n","items":{"$circularRef":"d8001960-380e-4944-9f06-319abcb92371"}},"not":{"description":"Excludes entities matching the embedded filter (logical NOT). Pass a filter object with the same shape as this one — typically a single scalar field, like `{not: {entityTypes: [\"RESOURCE\"]}}` to exclude resources.\n","type":"object","x-go-type":"AccessEntityFilters"}}}},"processedSecurityOptions":[{"schemes":[{"scheme":{"scheme":"bearer","type":"http","scopes":[],"schemeName":"BearerAuth"},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"Bearer authentication header of the form `Bearer \u003ctoken>`, where `\u003ctoken>` is your auth token.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"BearerAuth","name":"Authorization"}],"title":"BearerAuth"}]},"originalFileLocation":"https://app.opal.dev/openapi.yaml"},"subdomain":"opalsecurity","siteName":"Opal Security Docs","title":"Run an ad-hoc OpalQuery - Opal Security Docs","contextualStarterQuestions":[],"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"originalFileLocation":"api-reference/opal-queries/run-an-ad-hoc-opalquery.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a Node query filters and returns entities (users, resources, or groups); an Access query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set type to NODE or ACCESS in the request body to select the query type. This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Opal Security Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Run an ad-hoc OpalQuery - Opal Security Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a Node query filters and returns entities (users, resources, or groups); an Access query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set type to NODE or ACCESS in the request body to select the query type. This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Opal Security Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://opalsecurity.mintlify.app/_mintlify/api/og/v2?division=opal-queries\u0026amp;title=Run+an+ad-hoc+OpalQuery\u0026amp;description=Executes+an+ad-hoc+OpalQuery+and+returns+paginated+results.+Two+query+types+are+supported%3A+a+**Node**+query+filters+and+returns+entities+%28users%2C+resources%2C+or+g\u0026amp;theme=287ef1256bbb1bf2a61f3fd2\u0026amp;signature=b64820c9c181411e4f0b2a08dc795fb2eae7d60d92470282337962c0283d3b9c\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Run an ad-hoc OpalQuery - Opal Security Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a Node query filters and returns entities (users, resources, or groups); an Access query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set type to NODE or ACCESS in the request body to select the query type. This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://opalsecurity.mintlify.app/_mintlify/api/og/v2?division=opal-queries\u0026amp;title=Run+an+ad-hoc+OpalQuery\u0026amp;description=Executes+an+ad-hoc+OpalQuery+and+returns+paginated+results.+Two+query+types+are+supported%3A+a+**Node**+query+filters+and+returns+entities+%28users%2C+resources%2C+or+g\u0026amp;theme=287ef1256bbb1bf2a61f3fd2\u0026amp;signature=b64820c9c181411e4f0b2a08dc795fb2eae7d60d92470282337962c0283d3b9c\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/opalsecurity/t501z2uOx-XXqevB/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Opal Security Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0C7997\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/opal-queries/run-an-ad-hoc-opalquery.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.opal.dev/#organization\",\"name\":\"Opal Security Docs\",\"url\":\"https://docs.opal.dev\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/opalsecurity/FBbZyeMPZrA69UcV/logo/logo-dark.svg?fit=max\u0026auto=format\u0026n=FBbZyeMPZrA69UcV\u0026q=85\u0026s=93a4bd75f157f9f0ab43cdf4d715b5cd\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.opal.dev#website\",\"name\":\"Opal Security Docs\",\"url\":\"https://docs.opal.dev\",\"publisher\":{\"@id\":\"https://docs.opal.dev/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery#webpage\",\"url\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery\",\"name\":\"Run an ad-hoc OpalQuery\",\"description\":\"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a Node query filters and returns entities (users, resources, or groups); an Access query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set type to NODE or ACCESS in the request body to select the query type. This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\",\"isPartOf\":{\"@id\":\"https://docs.opal.dev#website\"},\"breadcrumb\":{\"@id\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Opal API\",\"item\":\"https://docs.opal.dev/api-reference/agent-activity/report-agent-activity\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Run an ad-hoc OpalQuery\",\"item\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery#apireference\",\"headline\":\"Run an ad-hoc OpalQuery\",\"name\":\"Run an ad-hoc OpalQuery\",\"description\":\"Executes an ad-hoc OpalQuery and returns paginated results. Two query types are supported: a Node query filters and returns entities (users, resources, or groups); an Access query returns the access grants between principals and their entitlements, one per (principal, entitlement, access level). Set type to NODE or ACCESS in the request body to select the query type. This endpoint is available to OpalQuery beta participants. To request access, contact Opal support.\",\"url\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery\",\"mainEntityOfPage\":{\"@id\":\"https://docs.opal.dev/api-reference/opal-queries/run-an-ad-hoc-opalquery#webpage\"},\"publisher\":{\"@id\":\"https://docs.opal.dev/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.opal.dev#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Opal Security Docs\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Opal Security Docs","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":"/docs/welcome"}]},{"tab":"Integrations","pages":[{"title":"Integrations","href":"/integrations/overview"}]},{"tab":"API Reference","groups":[{"group":"API Concepts","pages":[{"title":"Authentication","href":"/reference/authentication"},{"title":"Pagination","href":"/reference/pagination"},{"title":"Identifying End System Objects","href":"/reference/end-system-objects"},{"title":"Opal API Rate Limits","href":"/reference/opal-api-rate-limits"}]},{"group":"SDKs","pages":[{"title":"Overview","href":"/reference/opal-sdks"}]},{"group":"Opal API","pages":[{"group":"agent-activity","pages":[{"title":"Report agent activity","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /agent-activity","href":"/api-reference/agent-activity/report-agent-activity"},{"title":"Anthropic inference hook verdict","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /inference-hooks/anthropic","href":"/api-reference/agent-activity/anthropic-inference-hook-verdict"},{"title":"Get the agent kill switch","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /agent-kill-switch","href":"/api-reference/agent-activity/get-the-agent-kill-switch"},{"title":"Set the agent kill switch","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /agent-kill-switch","href":"/api-reference/agent-activity/set-the-agent-kill-switch"}]},{"group":"apps","pages":[{"title":"Get apps","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /apps","href":"/api-reference/apps/get-apps"},{"title":"Create app","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /apps","href":"/api-reference/apps/create-app"},{"title":"Get app by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /apps/{app_id}","href":"/api-reference/apps/get-app-by-id"},{"title":"Update app","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /apps/{app_id}","href":"/api-reference/apps/update-app"},{"title":"Delete app","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /apps/{app_id}","href":"/api-reference/apps/delete-app"},{"title":"Get sync errors","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /sync_errors","href":"/api-reference/apps/get-sync_errors"}]},{"group":"bundles","pages":[{"title":"Get bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles","href":"/api-reference/bundles/get-bundles"},{"title":"Post bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /bundles","href":"/api-reference/bundles/post-bundles"},{"title":"Get bundle by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}","href":"/api-reference/bundles/get-bundle-by-id"},{"title":"Put bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /bundles/{bundle_id}","href":"/api-reference/bundles/put-bundles"},{"title":"Delete bundles","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /bundles/{bundle_id}","href":"/api-reference/bundles/delete-bundles"},{"title":"Get bundles resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}/resources","href":"/api-reference/bundles/get-bundles-resources"},{"title":"Post bundles resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /bundles/{bundle_id}/resources","href":"/api-reference/bundles/post-bundles-resources"},{"title":"Delete bundles resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /bundles/{bundle_id}/resources/{resource_id}","href":"/api-reference/bundles/delete-bundles-resources"},{"title":"Get bundles groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}/groups","href":"/api-reference/bundles/get-bundles-groups"},{"title":"Post bundles groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /bundles/{bundle_id}/groups","href":"/api-reference/bundles/post-bundles-groups"},{"title":"Delete bundles groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /bundles/{bundle_id}/groups/{group_id}","href":"/api-reference/bundles/delete-bundles-groups"},{"title":"Get bundles visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /bundles/{bundle_id}/visibility","href":"/api-reference/bundles/get-bundles-visibility"},{"title":"Put bundles visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /bundles/{bundle_id}/visibility","href":"/api-reference/bundles/put-bundles-visibility"}]},{"group":"campaigns","pages":[{"title":"Get campaigns","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns","href":"/api-reference/campaigns/get-campaigns"},{"title":"Post campaigns","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns","href":"/api-reference/campaigns/post-campaigns"},{"title":"Get campaign by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns/{campaign_id}","href":"/api-reference/campaigns/get-campaign-by-id"},{"title":"Update campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /campaigns/{campaign_id}","href":"/api-reference/campaigns/update-campaign"},{"title":"Start campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/start","href":"/api-reference/campaigns/start-campaign"},{"title":"Stop campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/stop","href":"/api-reference/campaigns/stop-campaign"},{"title":"End campaign","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/end","href":"/api-reference/campaigns/end-campaign"},{"title":"List campaign items","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns/{campaign_id}/items","href":"/api-reference/campaigns/list-campaign-items"},{"title":"Update campaign item reviewers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/item-reviewers","href":"/api-reference/campaigns/update-campaign-item-reviewers"},{"title":"Submit campaign item review decisions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /campaigns/{campaign_id}/reviews","href":"/api-reference/campaigns/submit-campaign-item-review-decisions"},{"title":"List viewer campaign items","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /campaigns/{campaign_id}/viewer-items","href":"/api-reference/campaigns/list-viewer-campaign-items"}]},{"group":"configuration-templates","pages":[{"title":"Get configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /configuration-templates","href":"/api-reference/configuration-templates/get-configuration-templates"},{"title":"Put configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /configuration-templates","href":"/api-reference/configuration-templates/put-configuration-templates"},{"title":"Post configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /configuration-templates","href":"/api-reference/configuration-templates/post-configuration-templates"},{"title":"Delete configuration templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /configuration-templates/{configuration_template_id}","href":"/api-reference/configuration-templates/delete-configuration-templates"}]},{"group":"event-streams","pages":[{"title":"Get event streams","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /event-streams","href":"/api-reference/event-streams/get-event-streams"},{"title":"Create event stream","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /event-streams","href":"/api-reference/event-streams/create-event-stream"},{"title":"Update event stream","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /event-streams/{event_stream_id}","href":"/api-reference/event-streams/update-event-stream"},{"title":"Delete event stream","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /event-streams/{event_stream_id}","href":"/api-reference/event-streams/delete-event-stream"}]},{"group":"events","pages":[{"title":"Get events","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /events","href":"/api-reference/events/get-events"},{"title":"Get event by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /events/{event_id}","href":"/api-reference/events/get-event-by-id"}]},{"group":"groups","pages":[{"title":"Get groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups","href":"/api-reference/groups/get-groups"},{"title":"Put groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups","href":"/api-reference/groups/put-groups"},{"title":"Post groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups","href":"/api-reference/groups/post-groups"},{"title":"Get group by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}","href":"/api-reference/groups/get-group-by-id"},{"title":"Delete groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /groups/{group_id}","href":"/api-reference/groups/delete-groups"},{"title":"Get the ID of the configuration template linked to a group","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/configuration-template","href":"/api-reference/groups/get-the-id-of-the-configuration-template-linked-to-a-group"},{"title":"Set the ID of the configuration template linked to a group","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/configuration-template","href":"/api-reference/groups/set-the-id-of-the-configuration-template-linked-to-a-group"},{"title":"Get groups message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/message-channels","href":"/api-reference/groups/get-groups-message-channels"},{"title":"Put groups message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/message-channels","href":"/api-reference/groups/put-groups-message-channels"},{"title":"Get groups on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/on-call-schedules","href":"/api-reference/groups/get-groups-on-call-schedules"},{"title":"Put groups on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/on-call-schedules","href":"/api-reference/groups/put-groups-on-call-schedules"},{"title":"Get group access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/access_levels","href":"/api-reference/groups/get-group-access-levels"},{"title":"Get groups resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/resources","href":"/api-reference/groups/get-groups-resources"},{"title":"Put groups resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/resources","href":"/api-reference/groups/put-groups-resources"},{"title":"Get member groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/groups","href":"/api-reference/groups/get-member-groups"},{"title":"Get nested groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/containing-groups","href":"/api-reference/groups/get-nested-groups"},{"title":"Post groups containing groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups/{group_id}/containing-groups","href":"/api-reference/groups/post-groups-containing-groups"},{"title":"Get nested group by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/containing-groups/{containing_group_id}","href":"/api-reference/groups/get-nested-group-by-id"},{"title":"Delete groups containing groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /groups/{group_id}/containing-groups/{containing_group_id}","href":"/api-reference/groups/delete-groups-containing-groups"},{"title":"Post groups resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups/{group_id}/resources/{resource_id}","href":"/api-reference/groups/post-groups-resources"},{"title":"Get groups visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/visibility","href":"/api-reference/groups/get-groups-visibility"},{"title":"Put groups visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/visibility","href":"/api-reference/groups/put-groups-visibility"},{"title":"Get groups reviewers","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/reviewers","href":"/api-reference/groups/get-groups-reviewers"},{"title":"Put groups reviewers","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/reviewers","href":"/api-reference/groups/put-groups-reviewers"},{"title":"Get groups reviewer stages","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/reviewer-stages","href":"/api-reference/groups/get-groups-reviewer-stages"},{"title":"Put groups reviewer stages","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/reviewer-stages","href":"/api-reference/groups/put-groups-reviewer-stages"},{"title":"Get groups tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/tags","href":"/api-reference/groups/get-groups-tags"},{"title":"Get groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/{group_id}/users","href":"/api-reference/groups/get-groups-users"},{"title":"Put groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /groups/{group_id}/users/{user_id}","href":"/api-reference/groups/put-groups-users"},{"title":"Post groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /groups/{group_id}/users/{user_id}","href":"/api-reference/groups/post-groups-users"},{"title":"Delete groups users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /groups/{group_id}/users/{user_id}","href":"/api-reference/groups/delete-groups-users"},{"title":"Get groupsusers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /groups/users/{user_id}","href":"/api-reference/groups/get-groupsusers"}]},{"group":"group-bindings","pages":[{"title":"Get group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /group-bindings","href":"/api-reference/group-bindings/get-group-bindings"},{"title":"Put group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /group-bindings","href":"/api-reference/group-bindings/put-group-bindings"},{"title":"Post group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /group-bindings","href":"/api-reference/group-bindings/post-group-bindings"},{"title":"Get group binding by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /group-bindings/{group_binding_id}","href":"/api-reference/group-bindings/get-group-binding-by-id"},{"title":"Delete group bindings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /group-bindings/{group_binding_id}","href":"/api-reference/group-bindings/delete-group-bindings"}]},{"group":"idp-group-mappings","pages":[{"title":"Get idp group mappings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /idp-group-mappings/{app_resource_id}","href":"/api-reference/idp-group-mappings/get-idp-group-mappings"},{"title":"Put idp group mappings","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /idp-group-mappings/{app_resource_id}","href":"/api-reference/idp-group-mappings/put-idp-group-mappings"},{"title":"Get idp group mappings groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /idp-group-mappings/{app_resource_id}/groups/{group_id}","href":"/api-reference/idp-group-mappings/get-idp-group-mappings-groups"},{"title":"Post idp group mappings groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /idp-group-mappings/{app_resource_id}/groups/{group_id}","href":"/api-reference/idp-group-mappings/post-idp-group-mappings-groups"},{"title":"Delete idp group mappings groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /idp-group-mappings/{app_resource_id}/groups/{group_id}","href":"/api-reference/idp-group-mappings/delete-idp-group-mappings-groups"}]},{"group":"opal-scripts","pages":[{"title":"List OpalScripts","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /opal-scripts","href":"/api-reference/opal-scripts/list-opalscripts"},{"title":"Create OpalScript","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /opal-scripts","href":"/api-reference/opal-scripts/create-opalscript"},{"title":"Get OpalScript by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /opal-scripts/{opal_script_id}","href":"/api-reference/opal-scripts/get-opalscript-by-id"},{"title":"Update OpalScript","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /opal-scripts/{opal_script_id}","href":"/api-reference/opal-scripts/update-opalscript"},{"title":"Delete OpalScript","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /opal-scripts/{opal_script_id}","href":"/api-reference/opal-scripts/delete-opalscript"},{"title":"Get OpalScript by name","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /opal-scripts/name/{opal_script_name}","href":"/api-reference/opal-scripts/get-opalscript-by-name"}]},{"group":"owners","pages":[{"title":"Get owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners","href":"/api-reference/owners/get-owners"},{"title":"Put owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /owners","href":"/api-reference/owners/put-owners"},{"title":"Post owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /owners","href":"/api-reference/owners/post-owners"},{"title":"Get owner by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners/{owner_id}","href":"/api-reference/owners/get-owner-by-id"},{"title":"Delete owners","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /owners/{owner_id}","href":"/api-reference/owners/delete-owners"},{"title":"Get ownersname","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners/name/{owner_name}","href":"/api-reference/owners/get-ownersname"},{"title":"Get owners users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /owners/{owner_id}/users","href":"/api-reference/owners/get-owners-users"},{"title":"Put owners users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /owners/{owner_id}/users","href":"/api-reference/owners/put-owners-users"}]},{"group":"request-templates","pages":[{"title":"Get request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /request-templates","href":"/api-reference/request-templates/get-request-templates"},{"title":"Put request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /request-templates","href":"/api-reference/request-templates/put-request-templates"},{"title":"Post request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /request-templates","href":"/api-reference/request-templates/post-request-templates"},{"title":"Get request templates 1","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /request-templates/{request_template_id}","href":"/api-reference/request-templates/get-request-templates-1"},{"title":"Delete request templates","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /request-templates/{request_template_id}","href":"/api-reference/request-templates/delete-request-templates"}]},{"group":"requests","pages":[{"title":"Get requests","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests","href":"/api-reference/requests/get-requests"},{"title":"Post requests","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests","href":"/api-reference/requests/post-requests"},{"title":"Get requests via Relay","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests/relay","href":"/api-reference/requests/get-requests-via-relay"},{"title":"Get request by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests/{id}","href":"/api-reference/requests/get-request-by-id"},{"title":"Post requests approve","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/approve","href":"/api-reference/requests/post-requests-approve"},{"title":"Post requests deny","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/deny","href":"/api-reference/requests/post-requests-deny"},{"title":"Cancel request","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/cancel","href":"/api-reference/requests/cancel-request"},{"title":"Escalate request to skip-manager","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/escalate","href":"/api-reference/requests/escalate-request-to-skip-manager"},{"title":"Send request reminder","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/remind","href":"/api-reference/requests/send-request-reminder"},{"title":"Send reminder to a reviewer","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/reviewers/{reviewer_id}/remind","href":"/api-reference/requests/send-reminder-to-a-reviewer"},{"title":"Get requests comments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /requests/{id}/comments","href":"/api-reference/requests/get-requests-comments"},{"title":"Post requests comments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /requests/{id}/comments","href":"/api-reference/requests/post-requests-comments"}]},{"group":"role-assignments","pages":[{"title":"List role assignments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /role-assignments","href":"/api-reference/role-assignments/list-role-assignments"},{"title":"Add role assignments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /role-assignments","href":"/api-reference/role-assignments/add-role-assignments"},{"title":"Remove role assignments","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /role-assignments","href":"/api-reference/role-assignments/remove-role-assignments"}]},{"group":"resources","pages":[{"title":"Get resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources","href":"/api-reference/resources/get-resources"},{"title":"Put resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources","href":"/api-reference/resources/put-resources"},{"title":"Post resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources","href":"/api-reference/resources/post-resources"},{"title":"Get resource by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}","href":"/api-reference/resources/get-resource-by-id"},{"title":"Delete resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}","href":"/api-reference/resources/delete-resources"},{"title":"Get the ID of the configuration template linked to a resource","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/configuration-template","href":"/api-reference/resources/get-the-id-of-the-configuration-template-linked-to-a-resource"},{"title":"Set the ID of the configuration template linked to a resource","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/configuration-template","href":"/api-reference/resources/set-the-id-of-the-configuration-template-linked-to-a-resource"},{"title":"Get resources message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/message-channels","href":"/api-reference/resources/get-resources-message-channels"},{"title":"Put resources message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/message-channels","href":"/api-reference/resources/put-resources-message-channels"},{"title":"Get resources visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/visibility","href":"/api-reference/resources/get-resources-visibility"},{"title":"Put resources visibility","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/visibility","href":"/api-reference/resources/put-resources-visibility"},{"title":"Get resources reviewers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/reviewers","href":"/api-reference/resources/get-resources-reviewers"},{"title":"Put resources reviewers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/reviewers","href":"/api-reference/resources/put-resources-reviewers"},{"title":"Get resources reviewer stages","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/reviewer-stages","href":"/api-reference/resources/get-resources-reviewer-stages"},{"title":"Put resources reviewer stages","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/reviewer-stages","href":"/api-reference/resources/put-resources-reviewer-stages"},{"title":"Get resources non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/non-human-identities","href":"/api-reference/resources/get-resources-non-human-identities"},{"title":"Get resource users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/users","href":"/api-reference/resources/get-resource-users"},{"title":"Post resources non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources/{resource_id}/non-human-identities/{non_human_identity_id}","href":"/api-reference/resources/post-resources-non-human-identities"},{"title":"Delete resources non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}/non-human-identities/{non_human_identity_id}","href":"/api-reference/resources/delete-resources-non-human-identities"},{"title":"Get resource user","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/get-resource-user"},{"title":"Put resources users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/put-resources-users"},{"title":"Post resources users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/post-resources-users"},{"title":"Delete resources users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}/users/{user_id}","href":"/api-reference/resources/delete-resources-users"},{"title":"Get resource user access status ","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resource-user-access-status/{resource_id}/{user_id}","href":"/api-reference/resources/get-resource-user-access-status-"},{"title":"Get resources tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/tags","href":"/api-reference/resources/get-resources-tags"},{"title":"Get resources scoped role permissions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/scoped-role-permissions","href":"/api-reference/resources/get-resources-scoped-role-permissions"},{"title":"Put resources scoped role permissions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /resources/{resource_id}/scoped-role-permissions","href":"/api-reference/resources/put-resources-scoped-role-permissions"},{"title":"Get resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/custom-access-levels","href":"/api-reference/resources/get-resources-custom-access-levels"},{"title":"Post resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /resources/{resource_id}/custom-access-levels","href":"/api-reference/resources/post-resources-custom-access-levels"},{"title":"Delete resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /resources/{resource_id}/custom-access-levels/{access_level_remote_id}","href":"/api-reference/resources/delete-resources-custom-access-levels"},{"title":"Patch resources custom access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml patch /resources/{resource_id}/custom-access-levels/{access_level_remote_id}","href":"/api-reference/resources/patch-resources-custom-access-levels"},{"title":"Get resourcesusers","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/users/{user_id}","href":"/api-reference/resources/get-resourcesusers"},{"title":"Get resources groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/groups","href":"/api-reference/resources/get-resources-groups"},{"title":"Get resource access levels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /resources/{resource_id}/access_levels","href":"/api-reference/resources/get-resource-access-levels"}]},{"group":"non-human-identities","pages":[{"title":"Get non human identities","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /non-human-identities","href":"/api-reference/non-human-identities/get-non-human-identities"}]},{"group":"paladin","pages":[{"title":"Create Paladin","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /paladin","href":"/api-reference/paladin/create-paladin"},{"title":"Get Paladin by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /paladin/{paladin_id}","href":"/api-reference/paladin/get-paladin-by-id"},{"title":"Update Paladin","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /paladin/{paladin_id}","href":"/api-reference/paladin/update-paladin"},{"title":"Delete Paladin","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /paladin/{paladin_id}","href":"/api-reference/paladin/delete-paladin"},{"title":"Get Paladins by name","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /paladin/name/{paladin_name}","href":"/api-reference/paladin/get-paladins-by-name"},{"title":"List Paladin context sources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /paladin/{paladin_id}/context-sources","href":"/api-reference/paladin/list-paladin-context-sources"},{"title":"Add a Paladin context source","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /paladin/{paladin_id}/context-sources","href":"/api-reference/paladin/add-a-paladin-context-source"},{"title":"Remove a Paladin context source","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /paladin/{paladin_id}/context-sources/{context_source_id}","href":"/api-reference/paladin/remove-a-paladin-context-source"}]},{"group":"service-users","pages":[{"title":"Create service user","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /service-users","href":"/api-reference/service-users/create-service-user"}]},{"group":"sessions","pages":[{"title":"Get sessions","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /sessions","href":"/api-reference/sessions/get-sessions"}]},{"group":"users","pages":[{"title":"Get user","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /user","href":"/api-reference/users/get-user"},{"title":"Get users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users","href":"/api-reference/users/get-users"},{"title":"Post users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /users","href":"/api-reference/users/post-users"},{"title":"Get user by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/{user_id}","href":"/api-reference/users/get-user-by-id"},{"title":"Delete users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /users/{user_id}","href":"/api-reference/users/delete-users"},{"title":"Patch users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml patch /users/{user_id}","href":"/api-reference/users/patch-users"},{"title":"Reset a user's Opal MFA","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /users/{user_id}/mfa/reset","href":"/api-reference/users/reset-a-users-opal-mfa"},{"title":"Get usersremote users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/remote_users","href":"/api-reference/users/get-usersremote_users"},{"title":"Get userswhoami","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/whoami","href":"/api-reference/users/get-userswhoami"},{"title":"Get users tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /users/{user_id}/tags","href":"/api-reference/users/get-users-tags"}]},{"group":"access-rules","pages":[{"title":"Get access rules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /access-rules","href":"/api-reference/access-rules/get-access-rules"},{"title":"Post access rules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /access-rules","href":"/api-reference/access-rules/post-access-rules"},{"title":"Get access rules 1","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /access-rules/{access_rule_id}","href":"/api-reference/access-rules/get-access-rules-1"},{"title":"Put access rules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml put /access-rules/{access_rule_id}","href":"/api-reference/access-rules/put-access-rules"}]},{"group":"tags","pages":[{"title":"Get tag by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tag/{tag_id}","href":"/api-reference/tags/get-tag-by-id"},{"title":"Delete tag","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tag/{tag_id}","href":"/api-reference/tags/delete-tag"},{"title":"Get tag","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tag","href":"/api-reference/tags/get-tag"},{"title":"Post tag","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tag","href":"/api-reference/tags/post-tag"},{"title":"Get tags","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tags","href":"/api-reference/tags/get-tags"},{"title":"Post tags users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tags/{tag_id}/users/{user_id}","href":"/api-reference/tags/post-tags-users"},{"title":"Delete tags users","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tags/{tag_id}/users/{user_id}","href":"/api-reference/tags/delete-tags-users"},{"title":"Post tags groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tags/{tag_id}/groups/{group_id}","href":"/api-reference/tags/post-tags-groups"},{"title":"Delete tags groups","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tags/{tag_id}/groups/{group_id}","href":"/api-reference/tags/delete-tags-groups"},{"title":"Post tags resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tags/{tag_id}/resources/{resource_id}","href":"/api-reference/tags/post-tags-resources"},{"title":"Delete tags resources","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tags/{tag_id}/resources/{resource_id}","href":"/api-reference/tags/delete-tags-resources"}]},{"group":"message-channels","pages":[{"title":"Get message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /message-channels","href":"/api-reference/message-channels/get-message-channels"},{"title":"Post message channels","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /message-channels","href":"/api-reference/message-channels/post-message-channels"},{"title":"Get message channel by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /message-channels/{message_channel_id}","href":"/api-reference/message-channels/get-message-channel-by-id"}]},{"group":"on-call-schedules","pages":[{"title":"Get on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /on-call-schedules","href":"/api-reference/on-call-schedules/get-on-call-schedules"},{"title":"Post on call schedules","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /on-call-schedules","href":"/api-reference/on-call-schedules/post-on-call-schedules"},{"title":"Get on call schedule by ID","description":"Gets a `OnCallSchedule` object.","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /on-call-schedules/{on_call_schedule_id}","href":"/api-reference/on-call-schedules/get-on-call-schedule-by-id"}]},{"group":"opal-queries","pages":[{"title":"Run an ad-hoc OpalQuery","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /queries/run","href":"/api-reference/opal-queries/run-an-ad-hoc-opalquery"}]},{"group":"tokens","pages":[{"title":"Get tokens","description":"Returns a list of first-party API tokens for your organization. Requires admin access.","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /tokens","href":"/api-reference/tokens/get-tokens"},{"title":"Create token","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /tokens","href":"/api-reference/tokens/create-token"},{"title":"Delete token","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /tokens/{token_id}","href":"/api-reference/tokens/delete-token"}]},{"group":"uars","pages":[{"title":"Get uars","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /uars","href":"/api-reference/uars/get-uars"},{"title":"Post uar","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /uar","href":"/api-reference/uars/post-uar"},{"title":"Get uar","deprecated":true,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /uar/{uar_id}","href":"/api-reference/uars/get-uar"}]},{"group":"delegations","pages":[{"title":"Get delegations","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /delegations","href":"/api-reference/delegations/get-delegations"},{"title":"Post delegations","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml post /delegations","href":"/api-reference/delegations/post-delegations"},{"title":"Get delegation by ID","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml get /delegations/{delegation_id}","href":"/api-reference/delegations/get-delegation-by-id"},{"title":"Delete delegations","deprecated":null,"version":null,"openapi":"https://app.opal.dev/openapi.yaml delete /delegations/{delegation_id}","href":"/api-reference/delegations/delete-delegations"}]}]}]},{"tab":"Changelog","pages":[{"title":"Changelog","href":"/changelog/changelog"}]}]},"basePath":"","title":"Run an ad-hoc OpalQuery - Opal Security Docs","buildId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","deploymentId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-CS552b7R.js","utils-DDTCYAF2.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-De8ttokP.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-DrwRDvAh.js","snippetPresets-DtAN0nWx.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-D5rWArI6.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-O2i12wsz.js","shallow-DV8xABTt.js","getApiPlaygroundDisplay-DBZ0B5Jx.js","CodeSnippet-BVi0tPUX.js","CodeSnippets-CqASbIwY.js","Page-m07pfKpT.js","getPastedJson-DG9vsMS8.js","icon-CXzRSCr8.js","MethodPill-BdKVtEuX.js","DuplicateIcon-CZlmBrJI.js","createIcon-biFEUKPL.js","DynamicMarkdown-B54_zNBF.js","SectionHeading-DwwHK3Pt.js","axios-vUo_bRtp.js","Markdown-DfhCTwyA.js","clsx-xpJZXxdP.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BTZUMDnx.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-DqdKa2R4.js"]}