Skip to main content
POST
/
resources
cURL
curl --request POST \
  --url https://api.opal.dev/v1/resources \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "remote_resource_id": "API_ACCESS_MANAGEMENT_ADMIN-51d203da-313a-4fd9-8fcf-420ce6312345",
  "name": "Okta Engineering Super Admin",
  "description": "Okta super admin role.",
  "resource_type": "OKTA_ROLE",
  "metadata": "{\n  \"okta_directory_role\":\n    {\n      \"role_id\": \"SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345\",\n      \"role_type\": \"SUPER_ADMIN\",\n    },\n}",
  "app_id": "f454d283-ca87-4a8a-bdbb-df212eca5353"
}'
{
  "resource_id": "f454d283-ca87-4a8a-bdbb-df212eca5353",
  "app_id": "b5a5ca27-0ea3-4d86-9199-2126d57d1fbd",
  "description": "This resource represents AWS IAM role \"SupportUser\".",
  "admin_owner_id": "7c86c85d-0651-43e2-a748-d69d658418e8",
  "remote_id": 318038399,
  "remote_name": "repo-name",
  "max_duration": 120,
  "require_manager_approval": false,
  "require_support_ticket": false,
  "parent_resource_id": "f454d283-ca67-4a8a-bdbb-df212eca5345",
  "ancestor_resource_ids": [
    "f454d283-ca67-4a8a-bdbb-df212eca5345"
  ],
  "descendant_resource_ids": [
    "f454d283-ca67-4a8a-bdbb-df212eca5345"
  ]
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

CreateResourceInfo Object

Description

The CreateResourceInfo object is used to store creation info for a resource.

Usage Example

Use in the POST Resources endpoint.

​
name
string
required

The name of the remote resource.

Example:

"mongo-db-prod"

​
resource_type
enum<string>
required

The type of the resource.

Available options:
AWS_IAM_ROLE,
AWS_EC2_INSTANCE,
AWS_EKS_CLUSTER,
AWS_RDS_POSTGRES_CLUSTER,
AWS_RDS_POSTGRES_INSTANCE,
AWS_RDS_MYSQL_CLUSTER,
AWS_RDS_MYSQL_INSTANCE,
AWS_ACCOUNT,
AWS_SSO_PERMISSION_SET,
AWS_ORGANIZATIONAL_UNIT,
AZURE_MANAGEMENT_GROUP,
AZURE_RESOURCE_GROUP,
AZURE_SUBSCRIPTION,
AZURE_VIRTUAL_MACHINE,
AZURE_STORAGE_ACCOUNT,
AZURE_STORAGE_CONTAINER,
AZURE_SQL_SERVER,
AZURE_SQL_MANAGED_INSTANCE,
AZURE_SQL_DATABASE,
AZURE_SQL_MANAGED_DATABASE,
AZURE_USER_ASSIGNED_MANAGED_Identity,
AZURE_ENTRA_ID_ROLE,
AZURE_ENTERPRISE_APP,
CUSTOM,
CUSTOM_CONNECTOR,
DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL,
GCP_ORGANIZATION,
GCP_BUCKET,
GCP_COMPUTE_INSTANCE,
GCP_FOLDER,
GCP_GKE_CLUSTER,
GCP_PROJECT,
GCP_CLOUD_SQL_POSTGRES_INSTANCE,
GCP_CLOUD_SQL_MYSQL_INSTANCE,
GCP_BIG_QUERY_DATASET,
GCP_BIG_QUERY_TABLE,
GCP_SERVICE_ACCOUNT,
GIT_HUB_REPO,
GIT_HUB_ORG_ROLE,
GIT_LAB_PROJECT,
GOOGLE_WORKSPACE_ROLE,
MONGO_INSTANCE,
MONGO_ATLAS_INSTANCE,
OKTA_APP,
OKTA_ROLE,
OPAL_ROLE,
OPAL_SCOPED_ROLE,
PAGERDUTY_ROLE,
TAILSCALE_SSH,
SALESFORCE_PERMISSION_SET,
SALESFORCE_PROFILE,
SALESFORCE_ROLE,
SNOWFLAKE_DATABASE,
SNOWFLAKE_SCHEMA,
SNOWFLAKE_TABLE,
WORKDAY_ROLE,
MYSQL_INSTANCE,
MARIADB_INSTANCE,
POSTGRES_INSTANCE,
TELEPORT_ROLE,
ILEVEL_ADVANCED_ROLE,
DATASTAX_ASTRA_ROLE,
COUPA_ROLE,
CURSOR_ORGANIZATION,
OPENAI_PLATFORM_PROJECT,
OPENAI_PLATFORM_SERVICE_ACCOUNT,
ANTHROPIC_WORKSPACE,
GIT_HUB_ORG,
ORACLE_FUSION_ROLE
Example:

"AWS_IAM_ROLE"

​
app_id
string<uuid>
required

The ID of the app for the resource.

Example:

"f454d283-ca87-4a8a-bdbb-df212eca5353"

​
description
string

A description of the remote resource.

Example:

"Engineering team Okta role."

​
remote_info
object

Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields.

​
remote_resource_id
string
deprecated

Deprecated - use remote_info instead. The ID of the resource on the remote system. Include only for items linked to remote systems. See this guide for details on how to specify this field.

Example:

"API_ACCESS_MANAGEMENT_ADMIN-51d203da-313a-4fd9-8fcf-420ce6312345"

​
metadata
string
deprecated

Deprecated - use remote_info instead.

JSON metadata about the remote resource. Include only for items linked to remote systems. See this guide for details on how to specify this field. The required format is dependent on resource_type and should have the following schema:

<style type="text/css"> code {max-height:300px !important} </style> 
{
  "$schema": "http://json-schema.org/draft-04/schema#",
  "title": "Resource Metadata",
  "properties": {
    "aws_ec2_instance": {
      "properties": {
        "instance_id": {
          "type": "string"
        },
        "region": {
          "type": "string"
        }
      },
      "required": ["instance_id", "region"],
      "additionalProperties": false,
      "type": "object",
      "title": "AWS EC2 Instance"
    },
    "aws_eks_cluster": {
      "properties": {
        "cluster_name": {
          "type": "string"
        },
        "cluster_region": {
          "type": "string"
        },
        "cluster_arn": {
          "type": "string"
        }
      },
      "required": ["cluster_name", "cluster_region", "cluster_arn"],
      "additionalProperties": false,
      "type": "object",
      "title": "AWS EKS Cluster"
    },
    "aws_rds_instance": {
      "properties": {
        "instance_id": {
          "type": "string"
        },
        "engine": {
          "type": "string"
        },
        "region": {
          "type": "string"
        },
        "resource_id": {
          "type": "string"
        },
        "database_name": {
          "type": "string"
        }
      },
      "required": [
        "instance_id",
        "engine",
        "region",
        "resource_id",
        "database_name"
      ],
      "additionalProperties": false,
      "type": "object",
      "title": "AWS RDS Instance"
    },
    "aws_role": {
      "properties": {
        "arn": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": ["arn", "name"],
      "additionalProperties": false,
      "type": "object",
      "title": "AWS Role"
    },
    "gcp_bucket": {
      "properties": {
        "bucket_id": {
          "type": "string"
        }
      },
      "required": ["bucket_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "GCP Bucket"
    },
    "gcp_compute_instance": {
      "properties": {
        "instance_id": {
          "type": "string"
        },
        "project_id": {
          "type": "string"
        },
        "zone": {
          "type": "string"
        }
      },
      "required": ["instance_id", "project_id", "zone"],
      "additionalProperties": false,
      "type": "object",
      "title": "GCP Compute Instance"
    },
    "gcp_folder": {
      "properties": {
        "folder_id": {
          "type": "string"
        }
      },
      "required": ["folder_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "GCP Folder"
    },
    "gcp_gke_cluster": {
      "properties": {
        "cluster_name": {
          "type": "string"
        }
      },
      "required": ["cluster_name"],
      "additionalProperties": false,
      "type": "object",
      "title": "GCP GKE Cluster"
    },
    "gcp_project": {
      "properties": {
        "project_id": {
          "type": "string"
        }
      },
      "required": ["project_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "GCP Project"
    },
    "gcp_sql_instance": {
      "properties": {
        "instance_id": {
          "type": "string"
        },
        "project_id": {
          "type": "string"
        }
      },
      "required": ["instance_id", "project_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "GCP SQL Instance"
    },
    "git_hub_repo": {
      "properties": {
        "org_name": {
          "type": "string"
        },
        "repo_name": {
          "type": "string"
        }
      },
      "required": ["org_name", "repo_name"],
      "additionalProperties": false,
      "type": "object",
      "title": "GitHub Repo"
    },
    "okta_directory_app": {
      "properties": {
        "app_id": {
          "type": "string"
        },
        "logo_url": {
          "type": "string"
        }
      },
      "required": ["app_id", "logo_url"],
      "additionalProperties": false,
      "type": "object",
      "title": "Okta Directory App"
    },
    "okta_directory_role": {
      "properties": {
        "role_type": {
          "type": "string"
        },
        "role_id": {
          "type": "string"
        }
      },
      "required": ["role_type", "role_id"],
      "additionalProperties": false,
      "type": "object",
      "title": "Okta Directory Role"
    },
    "salesforce_profile": {
      "properties": {
        "user_license": {
          "type": "string"
        }
      },
      "required": ["user_license"],
      "additionalProperties": false,
      "type": "object",
      "title": "Salesforce Profile"
    }
  },
  "additionalProperties": false,
  "minProperties": 1,
  "maxProperties": 1,
  "type": "object"
}
Example:

"{\n \"okta_directory_role\":\n {\n \"role_id\": \"SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345\",\n \"role_type\": \"SUPER_ADMIN\",\n },\n}"

​
custom_request_notification
string | null

Custom request notification sent upon request approval.

Maximum length: 800
Example:

"Check your email to register your account."

​
risk_sensitivity_override
enum<string>

Indicates the level of potential impact misuse or unauthorized access may incur.

Available options:
UNKNOWN,
CRITICAL,
HIGH,
MEDIUM,
LOW,
NONE

Response

200 - application/json

The resource just created.

Resource Object

Description

The Resource object is used to represent a resource.

Usage Example

Update from the UPDATE Resources endpoint.

​
resource_id
string<uuid>
required

The ID of the resource.

Example:

"f454d283-ca87-4a8a-bdbb-df212eca5353"

​
app_id
string<uuid>

The ID of the app.

Example:

"b5a5ca27-0ea3-4d86-9199-2126d57d1fbd"

​
name
string

The name of the resource.

Example:

"mongo-db-prod"

​
description
string

A description of the resource.

Example:

"This resource represents AWS IAM role \"SupportUser\"."

​
admin_owner_id
string<uuid>

The ID of the owner of the resource.

Example:

"7c86c85d-0651-43e2-a748-d69d658418e8"

​
remote_resource_id
string

The ID of the resource on the remote system.

Example:

318038399

​
remote_resource_name
string

The name of the resource on the remote system.

Example:

"repo-name"

​
resource_type
enum<string>

The type of the resource.

Available options:
AWS_IAM_ROLE,
AWS_EC2_INSTANCE,
AWS_EKS_CLUSTER,
AWS_RDS_POSTGRES_CLUSTER,
AWS_RDS_POSTGRES_INSTANCE,
AWS_RDS_MYSQL_CLUSTER,
AWS_RDS_MYSQL_INSTANCE,
AWS_ACCOUNT,
AWS_SSO_PERMISSION_SET,
AWS_ORGANIZATIONAL_UNIT,
AZURE_MANAGEMENT_GROUP,
AZURE_RESOURCE_GROUP,
AZURE_SUBSCRIPTION,
AZURE_VIRTUAL_MACHINE,
AZURE_STORAGE_ACCOUNT,
AZURE_STORAGE_CONTAINER,
AZURE_SQL_SERVER,
AZURE_SQL_MANAGED_INSTANCE,
AZURE_SQL_DATABASE,
AZURE_SQL_MANAGED_DATABASE,
AZURE_USER_ASSIGNED_MANAGED_Identity,
AZURE_ENTRA_ID_ROLE,
AZURE_ENTERPRISE_APP,
CUSTOM,
CUSTOM_CONNECTOR,
DATABRICKS_ACCOUNT_SERVICE_PRINCIPAL,
GCP_ORGANIZATION,
GCP_BUCKET,
GCP_COMPUTE_INSTANCE,
GCP_FOLDER,
GCP_GKE_CLUSTER,
GCP_PROJECT,
GCP_CLOUD_SQL_POSTGRES_INSTANCE,
GCP_CLOUD_SQL_MYSQL_INSTANCE,
GCP_BIG_QUERY_DATASET,
GCP_BIG_QUERY_TABLE,
GCP_SERVICE_ACCOUNT,
GIT_HUB_REPO,
GIT_HUB_ORG_ROLE,
GIT_LAB_PROJECT,
GOOGLE_WORKSPACE_ROLE,
MONGO_INSTANCE,
MONGO_ATLAS_INSTANCE,
OKTA_APP,
OKTA_ROLE,
OPAL_ROLE,
OPAL_SCOPED_ROLE,
PAGERDUTY_ROLE,
TAILSCALE_SSH,
SALESFORCE_PERMISSION_SET,
SALESFORCE_PROFILE,
SALESFORCE_ROLE,
SNOWFLAKE_DATABASE,
SNOWFLAKE_SCHEMA,
SNOWFLAKE_TABLE,
WORKDAY_ROLE,
MYSQL_INSTANCE,
MARIADB_INSTANCE,
POSTGRES_INSTANCE,
TELEPORT_ROLE,
ILEVEL_ADVANCED_ROLE,
DATASTAX_ASTRA_ROLE,
COUPA_ROLE,
CURSOR_ORGANIZATION,
OPENAI_PLATFORM_PROJECT,
OPENAI_PLATFORM_SERVICE_ACCOUNT,
ANTHROPIC_WORKSPACE,
GIT_HUB_ORG,
ORACLE_FUSION_ROLE
Example:

"AWS_IAM_ROLE"

​
max_duration
integer

The maximum duration for which the resource can be requested (in minutes).

Example:

120

​
recommended_duration
integer

The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.

Example:

120

​
extensions_duration_in_minutes
integer

The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.

Example:

120

​
require_manager_approval
boolean
deprecated

A bool representing whether or not access requests to the resource require manager approval.

Example:

false

​
require_support_ticket
boolean

A bool representing whether or not access requests to the resource require an access ticket.

Example:

false

​
require_mfa_to_approve
boolean

A bool representing whether or not to require MFA for reviewers to approve requests for this resource.

Example:

false

​
require_mfa_to_request
boolean

A bool representing whether or not to require MFA for requesting access to this resource.

Example:

false

​
require_mfa_to_connect
boolean

A bool representing whether or not to require MFA to connect to this resource.

Example:

false

​
auto_approval
boolean

A bool representing whether or not to automatically approve requests to this resource.

Example:

false

​
request_template_id
string<uuid>

The ID of the associated request template.

Example:

"06851574-e50d-40ca-8c78-f72ae6ab4304"

​
is_requestable
boolean

A bool representing whether or not to allow access requests to this resource.

Example:

false

​
parent_resource_id
string<uuid>

The ID of the parent resource.

Example:

"06851574-e50d-40ca-8c78-f72ae6ab4305"

​
configuration_template_id
string<uuid>

The ID of the associated configuration template.

Example:

"06851574-e50d-40ca-8c78-f72ae6ab4304"

​
request_configurations
object[]

A list of configurations for requests to this resource.

​
request_configuration_list
object[]
deprecated

A list of configurations for requests to this resource. Deprecated in favor of request_configurations.

​
ticket_propagation
object

Configuration for ticket propagation, when enabled, a ticket will be created for access changes related to the users in this resource.

​
custom_request_notification
string | null

Custom request notification sent upon request approval.

Maximum length: 800
​
risk_sensitivity
enum<string>

The risk sensitivity level for the resource. When an override is set, this field will match that. Indicates the level of potential impact misuse or unauthorized access may incur.

Available options:
UNKNOWN,
CRITICAL,
HIGH,
MEDIUM,
LOW,
NONE
​
risk_sensitivity_override
enum<string>

Indicates the level of potential impact misuse or unauthorized access may incur.

Available options:
UNKNOWN,
CRITICAL,
HIGH,
MEDIUM,
LOW,
NONE
​
metadata
string
deprecated

JSON metadata about the remote resource. Only set for items linked to remote systems. See this guide for details.

Example:

"{\n \"okta_directory_role\":\n {\n \"role_id\": \"SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345\",\n \"role_type\": \"SUPER_ADMIN\",\n },\n}"

​
remote_info
object

Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields.

​
ancestor_resource_ids
string<uuid>[]

List of resource IDs that are ancestors of this resource.

Example:
[
  "f454d283-ca67-4a8a-bdbb-df212eca5345",
  "f454d283-ca67-4a8a-bdbb-df212eca5346"
]
​
descendant_resource_ids
string<uuid>[]

List of resource IDs that are descendants of this resource.

Example:
[
  "f454d283-ca67-4a8a-bdbb-df212eca5347",
  "f454d283-ca67-4a8a-bdbb-df212eca5348"
]
​
last_successful_sync
object

Information about the last successful sync of this resource.

Example:
{
  "id": "7c86c85d-0651-43e2-a748-d69d658418e8",
  "completed_at": "2023-10-01T12:00:00.000Z"
}