Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.opal.dev/llms.txt

Use this file to discover all available pages before exploring further.

Language Basics

OpalScript uses Starlark syntax, which is similar to Python. This section gives you a quick overview of Starlark syntax and its key differences from Python.

Syntax Overview

# Variables
count = 10
name = "alice"
is_active = True

# Conditionals
if count > 5:
    print("high")
elif count > 0:
    print("low")
else:
    print("zero")

# Loops
for item in [1, 2, 3]:
    print(item)

for i in range(10):
    print(i)

# Functions
def calculate_score(base, multiplier):
    return base * multiplier

# String operations
text = "Hello World"
lower_text = text.lower()          # "hello world"
contains_hello = "hello" in lower_text  # True

# Lists
items = ["a", "b", "c"]
items.append("d")
first = items[0]

# Dictionaries
config = {"key": "value", "count": 42}
value = config["key"]
config["new_key"] = "new_value"

Key Differences from Python

OpalScript (Starlark) has some intentional limitations compared to Python:
FeatureOpalScriptPython
Import statementsNot supported (modules pre-loaded)Supported
ClassesNot supportedSupported
ExceptionsNot supported (try/except)Supported
While loopsNot supported (use for with range())Supported
Global variablesLimited mutationFull support
Standard libraryMinimalExtensive
These limitations ensure scripts are predictable, terminate reliably, and execute safely.

Quick Reference

Utility Functions (All Script Types)

ModuleFunctionDescription
accesslibcheck_access(principal, entity, [level])Check whether a principal has access to an entity
notificationslibnotify_user(user_id, title, body)Notify a specific user via email and Slack (if configured)
notificationslibnotify_admins(title, body)Notify all Opal admins
notificationslibnotify_owner(owner_id, title, body)Notify an owner via Slack channel (if configured) or all owner members
assetlibget_resource_risk_sensitivity(resource_id)Get the risk sensitivity level of a resource
assetlibget_group_risk_sensitivity(group_id)Get the risk sensitivity level of a group
timelibnow()Get the current Unix timestamp
timelibfrom_unix(timestamp)Convert a Unix timestamp to an RFC3339 string
timelibis_before(timestamp1, timestamp2)Check if the first timestamp is before the second
timelibis_after(timestamp1, timestamp2)Check if the first timestamp is after the second
timelibseconds_since(timestamp1, timestamp2)Get the number of seconds between two timestamps
timelibminutes(n) / hours(n) / days(n)Convert time intervals to seconds
entitylibget_user(user_id)Look up a user by ID
entitylibget_group(group_id)Look up a group by ID
entitylibget_resource(resource_id)Look up a resource by ID
ticketslibproviders.<PROVIDER>Access an installed ticket provider (e.g. ticketslib.providers.JIRA)
ticketsliblist_projects(provider)List projects on a provider; returns a dict keyed by project key
ticketslibcreate_ticket(project, title, description)Create a ticket on the provider; returns a ticket object
ticketslibget_ticket(provider, remote_ticket_id)Fetch an existing ticket by its remote identifier
ticketslibcomment_ticket(provider, remote_ticket_id, comment)Add a comment to an existing ticket
ticketslibclose_ticket(provider, remote_ticket_id, [comment])Close a ticket, with an optional closing comment

Request Review Functions

ModuleFunctionDescription
contextget_request()Get the request being reviewed
actionsapprove([comment])Approve the request
actionsdeny(comment)Deny the request (comment required)
actionscomment(comment)Add a comment
actionspause(minutes)Pause script execution for 1–1440 minutes, then resume from the same point; actions before the pause are skipped on replay
actionspoll(pollFunction, minutes, max_iterations)Call pollFunction every minutes minutes (1–1440) up to max_iterations times (1–50); returns True if it succeeded

Request Attributes

AttributeTypeAlways Present
idStringYes
reasonStringYes
requester_idStringYes
statusStringYes
target_user_idStringNo
target_group_idStringNo
requested_duration_minutesintNo
requested_resourcesListYes (may be empty)
requested_groupsListYes (may be empty)
custom_fieldsDictYes (may be empty)
Last modified on May 7, 2026