Skip to main content

​
Overview

OpalScript is Opal’s scripting language for automating access management workflows integrated deeply with Opal’s access management platform. Built on Starlark (a Python-like language), OpalScript enables you to write custom automation logic and scripts that evaluate conditions, query the access graph and take actions programmatically.

​
Use cases

OpalScript currently supports automated request review, delegation conditions, request configuration conditions, and Paladin context, with more automation types planned:
New to OpalScript? The AI assistant can write a script for you from a plain-language description.

​
How OpalScript works

Each OpalScript type has access to:
  1. Utility modules: Common functions shared across script types (e.g., access for access queries, notifications for sending notifications, http and secrets for calling external APIs). Which modules a script can use depends on its type. See Module availability by script type
  2. Context module: Script-type-specific data about what triggered the script
  3. Actions module: Script-type-specific operations the script can perform
This separation allows you to learn the core language and utility functions once, then apply them across different automation scenarios.

​
Create your first workflow

  1. In Opal, navigate to Admin > OpalScript > Editor and create a new script. Give it a name and select an owner. For Request Review scripts, Opal provisions a service user with the same name as the script, owned by the owner you select. This service user is the identity that runs the script.
  2. Enter your OpalScript in the editor. For example, to auto-approve all requests:
    See Request Review: Get started for the full context and actions API reference, and examples for ready-to-use scripts.
  3. Attach the OpalScript to an approval stage on any resource, group, or configuration template (or via opal_script_ids in the REST API and Terraform). When a request reaches that stage, the script runs automatically.
For test runs, version history, triggers, and run monitoring, see Using the editor. To keep scripts in version control and attach them to approval stages as code, see Manage OpalScripts with Terraform.
Last modified on October 27, 2026