governance-production-enduser-reference-oneOfInheritance-noExamples.yaml

openapi: 3.0.3
info:
  title: Okta Enduser Governance API
  description: Allows customers to easily access the Okta Governance API as an enduser
  termsOfService: https://developer.okta.com/terms/
  contact:
    name: Okta Developer Team
    url: https://developer.okta.com/
    email: devex-public@okta.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  version: 3.2.0
  x-logo:
    url: logo.svg
    backgroundColor: transparent
    altText: Okta Developer
servers:
  - url: https://{yourOktaDomain}
    variables:
      yourOktaDomain:
        default: subdomain.okta.com
        description: The domain of your organization. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, etc) or one of your configured custom domains.
tags:
  - name: My Requests
    description: |
      Okta Access Requests automate the process of requesting access to applications and resources.

      Endusers may request entries in their resource catalog.

      Manage this process directly with the following request APIs.

      See [Access Requests](https://help.okta.com/okta_help.htm?type=oie&id=ext-ar) for more information on Access Requests and Identity Governance.
    x-okta-lifecycle:
      lifecycle: GA
  - name: My Catalogs
    description: |
      A catalog entry represents a requestable resource for [Access Requests](https://help.okta.com/okta_help.htm?type=oie&id=ext-ar). Each requestable app or collection has a top-level entry in the catalog. These are known as parent catalog entries. Associated requestable entitlements and groups also have an entry in the catalog, known as child entries. For example, a top-level entry for Figma might have two child entries, one for requesting read-only access to Figma and one for requesting edit access.

       The `parent` property in the catalog entry object shows the relationship between child and parent. The child entry's `parent` property references their respective parent entry identifier. The parent entry's `parent` property has no value. See the [CATALOG-ENTRY](https://developer.okta.com/docs/api/iga/#CATALOG-ENTRY) diagram in the [Relationships](https://developer.okta.com/docs/api/iga/#relationships) model.

      Use the My Catalogs API to request for catalog entries that you're allowed to request. You can search for a list of catalog entries based on the entry parent-child relationship using the `filter` query parameter.
    x-okta-lifecycle:
      lifecycle: GA
  - name: My Tasks
    description: |
      <x-lifecycle class="beta"></x-lifecycle>

      The My Tasks API allows end users to retrieve tasks assigned to them from access requests made through access request conditions in your Okta Identity Governance (OIG) org.
    x-okta-lifecycle:
      lifecycle: BETA
  - name: My Security Access Reviews
    description: |
      The My Security Access Reviews API allows reviewers to manage security access reviews that are assigned to them. These reviews provide a holistic view of a target principal's access to resources such as apps, groups, and entitlements. They're typically triggered as a response to a security or an identiy risk event. Reviewers can assess the target principal's access to resources and take immediate action.

      The resource methods in the My Security Access Reviews API only returns security access reviews and corresponding objects that the authenticated requester (as the reviewer) has permission to access.
    x-okta-lifecycle:
      lifecycle: EA
  - name: My Access Certification Reviews
    description: |
      The My Access Certification Reviews API enables end users to retrieve reviews and associated review resources that are assigned to them. The response is specifically for the authenticated user (the end user) making the request.
    x-okta-lifecycle:
      lifecycle: BETA
  - name: My Settings
    description: The My Settings API allows end users to manage their governance settings. The response is specifically for the authenticated user (the end user) making the request. Use this API to view and manage your settings, such as appointing a delegate for governance reviews.
    x-okta-lifecycle:
      lifecycle: BETA
externalDocs:
  description: Find more info here
  url: https://developer.okta.com/docs/reference/core-okta-api/#design-principles
paths:
  /governance/api/v2/my/catalogs/default/entries:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Catalogs
      operationId: listMyDefaultEntriesV2
      parameters:
        - $ref: '#/components/parameters/rcar-entries-list-filter-v2'
        - $ref: '#/components/parameters/rcar-entries-list-after'
        - $ref: '#/components/parameters/rcar-entries-list-match'
        - $ref: '#/components/parameters/rcar-entries-list-limit'
      summary: List my entries for the default access request catalog
      description: |-
        Lists the filtered entries for the default access request catalog that you're allowed to request (as the authenticated requester).

        The following are request examples with a filter expression. In each example, the filter expression includes the mandatory `parent` property.

        1. Lists at most 20 parent (top-level) entries
            ```
            /governance/api/v2/catalogs/default/entries?filter=not(parent%20pr)&limit=20
            ```
        1. Lists the next 20 results of parent entries after a specific cursor
            ```
            /governance/api/v2/catalogs/default/entries?filter=not(parent%20pr)&limit=20&after=cen33e47frfMB93gQ8g6
            ```
        1. Lists at most 8 parent entries with a fuzzy match for "figma"
            ```
            /governance/api/v2/catalogs/default/entries?filter=not(parent%20pr)&match=figma&limit=8
            ```
        1. Lists at most 8 child entries with a specific parent
            ```
            /governance/api/v2/catalogs/default/entries?filter=parent%20eq%20%22cen385AlcdqGaY8HE0g2%22&limit=8
            ```
        1. Lists at most 8 child entries that have "edit" in the name and have a specific parent
            ```
            /governance/api/v2/catalogs/default/entries?filter=parent%20eq%20%22cen385AlcdqGaY8HE0g2%22&match=edit&limit=8
            ```
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/rcar-entries-list-success-v2'
        '400':
          $ref: '#/components/responses/rcar-entries-list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/catalogs/default/entries/{entryId}:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Catalogs
      operationId: getMyEntryV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
      summary: Retrieve my catalog entry
      description: Retrieves an entry from my catalog
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/rcar-entry-get-success'
        '400':
          $ref: '#/components/responses/list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/catalogs/default/entries/{entryId}/requests:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      operationId: createMyRequestV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
      tags:
        - My Requests
      summary: Create a request
      description: Creates a request for my catalog entry specified by `entryId`
      requestBody:
        required: true
        description: |
          Creates a resource access request for a given user.

          Use this operation to create access requests managed by access request conditions.

          If `requestedBy` and `requestedFor` aren't the same, then you must also enable the [`requestOnBehalfOfSettings`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Request-Settings/#tag/Request-Settings/operation/updateResourceRequestSettingsV2!path=requestOnBehalfOfSettings&t=request) parameter in the access request settings. See [Update the resource request settings](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Request-Settings/#tag/Request-Settings/operation/updateResourceRequestSettingsV2).

          Include the following information in the payload:

          - The Okta user ID for the user who requires access. Add the user ID in the `requestedFor.externalId` parameter.
          - The catalog entry ID of the resource required by the user. Add the catalog ID in the `requested.entryId` parameter.
          - If the request conditions include requester input fields, add field information in the `requesterFieldValues` array. See [Retrieve the request fields](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Catalogs/#tag/Catalogs/operation/getCatalogEntryRequestFieldsV2).
          - Optional: The user ID of the person submitting the request. By default, this value is the admin user ID requesting this operation and doesn't need to be provided. However, to add a different Okta user ID for the request, include the `requestedBy.externalId` parameter in the request body.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/my-request-creatable'
      security:
        - OAuth2:
            - okta.accessRequests.request.manage
      responses:
        '202':
          $ref: '#/components/responses/my-request-create-success-response'
        '400':
          $ref: '#/components/responses/my-request-create-bad-request-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
  /governance/api/v2/my/catalogs/default/entries/{entryId}/requests/{requestId}:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      operationId: getMyRequestV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
        - $ref: '#/components/parameters/rcar-request-id-parameter'
      tags:
        - My Requests
      summary: Retrieve my request
      description: Retrieves a request belonging to the authenticated requester
      security:
        - OAuth2:
            - okta.accessRequests.request.read
      responses:
        '200':
          $ref: '#/components/responses/request-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
  /governance/api/v2/my/catalogs/default/entries/{entryId}/request-fields:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      operationId: getMyCatalogEntryRequestFieldsV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
      tags:
        - My Catalogs
      summary: Retrieve the request fields for my catalog entry
      description: |
        Retrieves request fields for a catalog entry that you're allowed to request (as the authenticated requester):

        * Request fields are determined by evaluating the entry's associated request conditions for the requester.
        * The highest priority matching condition determines the approval sequence that's used for the requester.
        * If that approval sequence has requester fields, then they are returned as request fields.
        * If the request can lead to any separation of duty conflicts, then the risk assessment (`metadata.riskAssessment`) is present. The risk assessment indicates whether the request submission is allowed or restricted, and includes rules that lead to the possible conflicts. If the request submission is allowed, then the request fields are determined by the associated approval sequence.
      security:
        - OAuth2:
            - okta.accessRequests.request.read
      responses:
        '200':
          $ref: '#/components/responses/my-request-fields-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
  /governance/api/v2/my/catalogs/default/entries/{entryId}/users:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Catalogs
      operationId: listMyEntryUsersV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
        - $ref: '#/components/parameters/entry-user-list-filter'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      summary: List my catalog entry users
      description: |
        Lists all users who match the filtered query and can also view and request the entry.

        The `filter` query parameter is mandatory for this operation. A list of users is returned if:
        * the entry has the `requestOnBehalfOfSettings` enabled
        * the authorized user is able to request on behalf of other users

        **Examples**

        Request examples:

        1. Filter users with a last name that starts with "Smi"
            ```
            /governance/api/v2/my/catalogs/default/entries/{entryId}/users?filter=lastName%20sw%20%22Smi%22
            ```
        1. Filter for users with a first name that begins with "John"
            ```
            /governance/api/v2/my/catalogs/default/entries/{entryId}/users?filter=firstName%20sw%20%22John%22
            ```
        1. Search for users with a first or last name that begins with "John"
            ```
            /governance/api/v2/my/catalogs/default/entries/{entryId}/users?filter=firstName%20sw%20%22John%22%20OR%20lastName%20sw%20%22John%22
            ```
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/entry-users-list-success'
        '400':
          $ref: '#/components/responses/list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/catalogs/default/entries/{entryId}/users/{userId}/request-fields:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Catalogs
      operationId: getMyCatalogEntryUserRequestFieldsV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
        - $ref: '#/components/parameters/user-id'
      summary: Retrieve the entry request fields for a user
      description: |
        Retrieves the entry's request fields for the specified requester.

        Request fields for the entry are only returned if the entry has "request on behalf of" (`requestOnBehalfOfSettings`) enabled, and the authorized user is able to request on behalf of other requesters.

        If the request can lead to any separation of duty conflicts, then the risk assessment (`metadata.riskAssessment`) is returned.
        The risk assessment indicates whether the request submission is allowed or restricted, and includes rules that lead to the possible conflicts.
        If the request submission is allowed, then the request fields are determined by the associated approval sequence for the risk level.
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/my-request-fields-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
  /governance/api/v2/my/tasks:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
      tags:
        - My Tasks
      x-disable-permissions-audit: true
      operationId: listAllMyTasksV2
      summary: List all my tasks
      description: |
        Lists all tasks assigned to you from access requests managed by OIG access request conditions.

        See [Access request conditions](https://help.okta.com/okta_help.htm?type=oie&id=csh-rcar-conditions) in the product documentation.
      parameters:
        - $ref: '#/components/parameters/my-task-list-filter'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/task-list-after'
        - $ref: '#/components/parameters/task-list-order-by'
      security:
        - OAuth2:
            - okta.accessRequests.tasks.read
      responses:
        '200':
          $ref: '#/components/responses/my-tasks-list-success'
        '400':
          $ref: '#/components/responses/my-tasks-list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/tasks/{taskId}:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
      tags:
        - My Tasks
      x-disable-permissions-audit: true
      operationId: getMyTaskV2
      summary: Retrieve my task
      description: |
        Retrieves the details of a task that's assigned to you.

        You can only retrieve a task from an access request that's managed by access request conditions.

        See [Access request conditions](https://help.okta.com/okta_help.htm?type=oie&id=csh-rcar-conditions) for more information on Access request conditions and Identity Governance.
      parameters:
        - $ref: '#/components/parameters/task-id-parameter'
      security:
        - OAuth2:
            - okta.accessRequests.tasks.read
      responses:
        '200':
          $ref: '#/components/responses/my-task-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/tasks/{taskId}/resolve:
    post:
      x-okta-lifecycle:
        lifecycle: BETA
      tags:
        - My Tasks
      x-disable-permissions-audit: true
      operationId: resolveMyTaskV2
      summary: Resolve my task
      description: |
        Resolves a task that's assigned to you (the current authenticated user)
      parameters:
        - $ref: '#/components/parameters/task-id-parameter'
      security:
        - OAuth2:
            - okta.accessRequests.tasks.manage
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                value:
                  type: string
                  description: |
                    Specify the task resolution value. Required for `APPROVAL` and `QUESTION` type tasks.
                      * For `APPROVAL` type tasks, the only supported values are `APPROVED` or `DENIED`.
                      * For `QUESTION` type tasks, the value is the answer to the question, and can be any string.
                      * For custom `TODO` type tasks, you don't need to specify a resolution value.
      responses:
        '200':
          $ref: '#/components/responses/my-task-resolve-success'
        '400':
          $ref: '#/components/responses/task-resolve-failed'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: listMySecurityAccessReviews
      summary: List the security access reviews
      description: Lists the security access reviews
      parameters:
        - $ref: '#/components/parameters/security-access-reviews-filter'
        - $ref: '#/components/parameters/security-access-reviews-order-by'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-reviews-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/stats:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: getMySecurityAccessReviewsStats
      summary: Retrieve the statistics for security access reviews
      description: Retrieves the statistics for security access reviews
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-reviews-stats-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: getMySecurityAccessReview
      summary: Retrieve a security access review
      description: Retrieves a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/summary:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: generateMySecurityAccessReviewSummary
      summary: Generate a summary for a security access review
      description: |-
        Generates a summary for a security access review

        > **Note:** The [`governanceAI.securityAccessReview.enabled`](https://developer.okta.com/docs/api/iga/openapi/governance.api/tag/Org-Governance-Settings/#tag/Org-Governance-Settings/operation/updateOrgSettings!path=governanceAI&t=request) org governance setting must be enabled for users to generate summaries for security access reviews.
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.manage
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-generate-summary-post-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/actions:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: listMySecurityAccessReviewActions
      summary: List all actions for a security access review
      description: Lists all of the actions available for a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-actions-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: executeMySecurityAccessReviewAction
      summary: Execute an action on a security access review
      description: Executes a specified action on a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/security-access-review-action-request'
      responses:
        '202':
          description: Action initiated successfully
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/principal:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: getMySecurityAccessReviewPrincipalDetails
      summary: Retrieve the principal for a security access review
      description: Retrieves the details of a security access review's principal target
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-principal-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/accesses:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: listMySecurityAccessReviewAccesses
      summary: List the access items for a security access review
      description: |-
        Lists the access items for a specific security access review.

        Access items refer to the top-level resources that the security access review's target principal has access to.
        For example, a top-level resource can be an app, hence the access item describes the principal's access to that app.
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
        - $ref: '#/components/parameters/security-access-review-accesses-filter'
        - $ref: '#/components/parameters/security-access-review-accesses-order-by'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-access-items-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/accesses/{securityAccessReviewAccessId}/sub-accesses:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: listMySecurityAccessReviewSubAccesses
      summary: List the sub-access items for an access item
      description: |-
        Lists the sub-access items for an access item from a security access review.

        A sub-access item refers to the access of a resource that is a part of a top-level resource in an access item.
        For example, an access item can describe the access of app, and the sub-access items can describe the access of groups, entitlement values, or entitlement bundles that belong to the app.
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
        - $ref: '#/components/parameters/security-access-review-access-id'
        - $ref: '#/components/parameters/security-access-review-sub-accesses-filter'
        - $ref: '#/components/parameters/security-access-review-sub-accesses-order-by'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-sub-access-items-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/accesses/{securityAccessReviewTargetId}/anomalies:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: listMySecurityAccessReviewAccessesAnomalies
      summary: List the anomalies for an access item
      description: Lists the anomalies for an access item in a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
        - $ref: '#/components/parameters/security-access-review-target-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-anomalies-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/accesses/{securityAccessReviewTargetId}/summary:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: generateMySecurityAccessReviewAccessesSummary
      summary: Generate a summary for an access item
      description: |-
        Generates a summary for an access item in a security access review

        > **Note:** The [`governanceAI.securityAccessReview.enabled`](https://developer.okta.com/docs/api/iga/openapi/governance.api/tag/Org-Governance-Settings/#tag/Org-Governance-Settings/operation/updateOrgSettings!path=governanceAI&t=request) org governance setting must be enabled for users to generate summaries for security access reviews.
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
        - $ref: '#/components/parameters/security-access-review-target-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.manage
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-generate-summary-post-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/accesses/{securityAccessReviewTargetId}/actions:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: executeMySecurityAccessReviewAccessesAction
      summary: Execute an action on an access item
      description: Executes an action on an access or sub-access item in a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
        - $ref: '#/components/parameters/security-access-review-target-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/security-access-review-accesses-action-request'
      responses:
        '202':
          description: Action initiated successfully
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/history:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: listMySecurityAccessReviewHistory
      summary: List the history of a security access review
      description: Lists the history of actions and changes for a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.read
      responses:
        '200':
          $ref: '#/components/responses/security-access-review-history-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/my/security-access-reviews/{securityAccessReviewId}/comment:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-disable-permissions-audit: true
      tags:
        - My Security Access Reviews
      operationId: addMySecurityAccessReviewComment
      summary: Add a comment for a security access review
      description: Adds a comment for a security access review
      parameters:
        - $ref: '#/components/parameters/security-access-review-id'
      security:
        - OAuth2:
            - okta.governance.securityAccessReviews.endUser.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/security-access-review-comment-request'
      responses:
        '204':
          description: Comment added successfully
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v1/my/settings:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
      x-disable-permissions-audit: true
      tags:
        - My Settings
      operationId: getMySettings
      summary: Retrieve my settings
      description: Retrieves the settings for the current authenticated user
      security:
        - OAuth2:
            - okta.governance.principalSettings.read
      responses:
        '200':
          $ref: '#/components/responses/my-settings-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    patch:
      x-okta-lifecycle:
        lifecycle: BETA
      x-disable-permissions-audit: true
      tags:
        - My Settings
      operationId: updateMySettings
      summary: Update my settings
      description: Updates the settings for the current authenticated user
      security:
        - OAuth2:
            - okta.governance.principalSettings.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/my-settings-patchable'
      responses:
        '200':
          $ref: '#/components/responses/my-settings-patch-success'
        '400':
          $ref: '#/components/responses/settings-patch-bad-request-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v1/my/settings/delegate/users:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
      x-disable-permissions-audit: true
      tags:
        - My Settings
      operationId: listMyDelegateUsers
      parameters:
        - $ref: '#/components/parameters/delegates-user-list-filter'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      summary: List my eligible delegates
      description: |
        Lists the users who are eligible delegates for the current authenticated user.

        The `filter` query parameter is optional when the org's delegate scope is restricted (the `onlyFor` list contains MANAGER or both MANAGER and PEERS).
        When omitted in this case, the endpoint returns all eligible delegates.

        However, if the org's delegate scope is unrestricted (the `onlyFor` list is empty), the `filter` parameter is required.
        Omitting the filter with an unrestricted scope returns a 400 error.

        Request examples:

        1. List all eligible delegates (only works with restricted delegate scope)
            ```
            /governance/api/v1/my/settings/delegates/users
            ```
        1. Filter users with a last name that starts with "Smi"
            ```
            /governance/api/v1/my/settings/delegates/users?filter=lastName%20sw%20%22Smi%22
            ```
        1. Filter for users with a first name that begins with "John"
            ```
            /governance/api/v1/my/settings/delegates/users?filter=firstName%20sw%20%22John%22
            ```
        1. Search for users with a first or last name that begins with "John"
            ```
            /governance/api/v1/my/settings/delegates/users?filter=firstName%20sw%20%22John%22%20OR%20lastName%20sw%20%22John%22
            ```
      security:
        - OAuth2:
            - okta.governance.principalSettings.read
      responses:
        '200':
          $ref: '#/components/responses/delegates-users-get-success'
        '400':
          $ref: '#/components/responses/list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v1/my/campaigns/{campaignId}/reviews/{reviewId}/agent-resource-connections/{agentId}:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
        features:
          - OKTA_FOR_AI_AGENTS
      x-disable-permissions-audit: true
      tags:
        - My Access Certification Reviews
      operationId: listMyResourceConnections
      summary: List all resource connections for my review
      description: Lists all resource connections for the specified AI agent in the current user's assigned review
      parameters:
        - $ref: '#/components/parameters/campaign-id'
        - $ref: '#/components/parameters/review-id'
        - $ref: '#/components/parameters/resource-connection-agent-id'
        - $ref: '#/components/parameters/after'
        - $ref: '#/components/parameters/limit'
      security:
        - OAuth2:
            - okta.governance.reviewer.read
      responses:
        '200':
          $ref: '#/components/responses/my-resource-connections-list'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions:
    post:
      x-okta-lifecycle:
        lifecycle: EA
        features:
          - IGA_REVIEW_ML_RECOMMENDATIONS
      x-disable-permissions-audit: true
      tags:
        - My Access Certification Reviews
      operationId: submitCampaignBulkDecisions
      summary: Submit a bulk-review decision
      description: |
        Submits a decision for bulk reviews in a campaign.
        The request body includes the criteria used to select the reviews for applying the decision.
      security:
        - OAuth2:
            - okta.governance.reviewer.manage
      parameters:
        - $ref: '#/components/parameters/campaign-id'
      requestBody:
        required: true
        description: |
          Request body for submitting a decision for bulk reviews
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/bulk-review-submission-mutable'
      responses:
        '202':
          $ref: '#/components/responses/campaign-bulk-review-decision-submission-accepted-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '409':
          $ref: '#/components/responses/bulk-review-submission-conflict-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions/jobs/{jobId}:
    get:
      x-okta-lifecycle:
        lifecycle: EA
        features:
          - IGA_REVIEW_ML_RECOMMENDATIONS
      x-disable-permissions-audit: true
      tags:
        - My Access Certification Reviews
      operationId: getCampaignBulkDecisionsJobStatus
      summary: Retrieve the status of a bulk-review submission
      description: Retrieves the job status of a bulk-review submission. Use this request to monitor the status of a bulk-review submission.
      security:
        - OAuth2:
            - okta.governance.reviewer.read
      parameters:
        - $ref: '#/components/parameters/campaign-id'
        - $ref: '#/components/parameters/job-id'
      responses:
        '200':
          $ref: '#/components/responses/campaign-bulk-review-decision-submission-job-status-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
components:
  securitySchemes:
    OAuth2:
      type: oauth2
      description: 'Pass the `access_token` as the value of the Authorization header: `Authorization: Bearer {access_token}`. See [Make a request](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#make-a-request).'
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          tokenUrl: /oauth2/v1/token
          scopes:
            okta.governance.accessCertifications.manage: Allows the app to create and manage Access Certification Campaigns
            okta.governance.accessCertifications.read: Allows the app to read information about Access Certification Campaigns and Reviews in your Okta org
            okta.governance.accessRequests.manage: Allows the app to create and manage V1 Access Requests, Request Types, and Teams
            okta.governance.accessRequests.read: Allows the app to read information about V1 Access Requests, Request Types, and Teams in your Okta org
            okta.governance.entitlements.read: Allows the app to read information about Entitlements, Entitlement bundles, and Grants
            okta.governance.entitlements.manage: Allows the app to create and manage Entitlements, Entitlement bundles, and Grants
            okta.accessRequests.catalog.read: Allows the app to read information about Access Request Catalogs in your Okta org
            okta.accessRequests.condition.manage: Allows the app to create and manage Conditions for the Access Request Resource Catalog
            okta.accessRequests.condition.read: Allows the app to read information about Conditions for the Access Request Resource Catalog
            okta.accessRequests.request.manage: Allows the app to create and manage V2 Access Requests through the Access Request Resource Catalog
            okta.accessRequests.request.read: Allows the app to read information about V2 Access Requests created through the Access Requests Resource Catalog
            okta.governance.collections.manage: Allows the app to create and manage collections
            okta.governance.collections.read: Allows the app to read information about collections in your Okta org
            okta.governance.operations.read: Allows the app to read information about asynchronous operations in your Okta org
            okta.governance.riskRule.manage: Allows the app to create and manage rules
            okta.governance.riskRule.read: Allows the app to read information about rules in your Okta org
            okta.governance.resourceOwner.manage: Allows the app to create and manage resource owners
            okta.governance.resourceOwner.read: Allows the app to read information about resource owners in your Okta org
            okta.governance.labels.manage: Allows the user to create and manage labels
            okta.governance.labels.read: Allows the user to read information about labels in your Okta org
            okta.governance.securityAccessReviews.admin.manage: Allows the admin app to create and manage security access reviews
            okta.governance.securityAccessReviews.admin.read: Allows the admin app to read information about security access reviews
            okta.governance.securityAccessReviews.endUser.manage: Allows the end-user app to create and manage security access reviews
            okta.governance.securityAccessReviews.endUser.read: Allows the end-user app to read information about security access reviews
            okta.governance.principalSettings.manage: Allows the app to create and manage governance settings for any user in your Okta org
            okta.governance.principalSettings.read: Allows the app to read information about governance settings for any user in your Okta org
            okta.governance.settings.manage: Allows the app to create and manage governance settings for your Okta org
            okta.governance.settings.read: Allows the app to read information about governance settings for your Okta org
            okta.governance.delegates.read: Allows the app to read information about delegates in your Okta org
            okta.governance.reviewer.read: Allows the end user to read information about access certification reviews assigned to them
            okta.governance.reviewer.manage: Allows the end user to manage access certification reviews assigned to them
            okta.accessRequests.tasks.manage: Allows the user to manage tasks for access requests in your Okta org
            okta.accessRequests.tasks.read: Allows the user to read information about tasks for access requests in your Okta org
  parameters:
    rcar-entries-list-filter-v2:
      name: filter
      description: |
        A required [filter](https://developer.okta.com/docs/api/#filter) expression that returns entries based on the [`parent`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Catalogs/#tag/Catalogs/operation/listAllDefaultEntriesV2!c=200&path=data/parent&t=response) property:
        * This filter expression only supports the `parent` property and the `eq` and `pr` [operators](https://developer.okta.com/docs/api/#operators).
        * If you want the query to return child entries, then you must specify the `parent` ID with the `eq` operator.

        > **Notes:**
        > * If you don't use the `parent` property in the filter expression, undesireable results are returned.
        > * Query parameter percent encoding is required. See [Special characters]( https://developer.okta.com/docs/api/#special-characters ).
      in: query
      required: true
      schema:
        type: string
        format: scim-filter
        example: not(parent pr)
      x-scim-filter:
        parent:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/catalog-entry-id'
    rcar-entries-list-after:
      name: after
      description: |-
        The [pagination](https://developer.okta.com/docs/api/#pagination) cursor that points to the last record of the previous response.

        The maximum number of entries returned in a response is determined by the [`limit`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Catalogs/#tag/Catalogs/operation/listAllDefaultEntriesV2!in=query&path=limit&t=request) query parameter.
        If there are more entries to return, the `_links.next.href` link contains the `after` cursor for the next page of results.
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/catalog-entry-id'
    rcar-entries-list-match:
      name: match
      description: Return catalog entries that match a substring value in the [`name`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.enduser.v2/tag/My-Catalogs/#tag/My-Catalogs/operation/listMyDefaultEntriesV2!c=200&path=data/name&t=response) or [`description`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.enduser.v2/tag/My-Catalogs/#tag/My-Catalogs/operation/listMyDefaultEntriesV2!c=200&path=data/description&t=response) properties. At least three characters are required for fuzzy search.
      in: query
      required: false
      schema:
        type: string
        minLength: 3
        maxLength: 50
        example: figma
    rcar-entries-list-limit:
      name: limit
      description: The maximum number of records returned in a response
      in: query
      required: false
      schema:
        type: integer
        maximum: 200
        minimum: 1
        example: 20
    catalog-entry-id:
      name: entryId
      description: Unique identifier for the catalog entry
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/catalog-entry-id'
    rcar-request-id-parameter:
      name: requestId
      description: Unique identifier for the Resource-Centric Access Requests (RCAR) request
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/rcar-request-id'
    entry-user-list-filter:
      name: filter
      description: |
        A required filter expression that returns users based on the `firstName` or `lastName` properties.
        This [filter](https://developer.okta.com/docs/api/#filter) expression supports the `sw` [operator](https://developer.okta.com/docs/api/#operators).

        **Note:** Query parameter percent encoding is required. See [Special characters]( https://developer.okta.com/docs/api/#special-characters ).
      in: query
      required: true
      schema:
        type: string
        format: scim-filter
        example: firstName sw "John" OR lastName sw "John"
      x-scim-filter:
        firstName:
          operators:
            - sw
          type: String
        lastName:
          operators:
            - sw
          type: String
    after:
      name: after
      description: |-
        Specifies the pagination cursor for the next page of results.
        Treat this as an opaque value obtained through the standard link headers. See [pagination](https://developer.okta.com/docs/api/#pagination).
      in: query
      required: false
      schema:
        type: string
        example: 00u68w6vzKLultXS97g6
    limit:
      name: limit
      description: The maximum number of records returned in a response
      in: query
      required: false
      schema:
        type: integer
        default: 20
        maximum: 200
        minimum: 1
    user-id:
      name: userId
      description: Unique identifier for the user
      in: path
      required: true
      schema:
        type: string
        maxLength: 20
        minLength: 20
        example: 00ucvnr9rbONeZdRp1d7
    my-task-list-filter:
      name: filter
      description: |
        A [filter](https://developer.okta.com/docs/api/#filter) expression that filters a collection of tasks in the response.
        The filter expression supports the following properties and [operators](https://developer.okta.com/docs/api/#operators):

        - `status`: The status of the task. Possible values: `OPEN`, `COMPLETED`, `ASSIGNING`, and `LOCKED`. Supports the `eq` operator.
        - `type`: The type of the task. Possible values: `QUESTION`, `APPROVAL`, and `TODO`. Supports the `eq` operator.
        - `requestId`: The ID of the request for the task. Supports the `eq` operator.
        - `createdAt`: The task created time. Supports the `gt`, `ge`, `le`, and `lt` operators.
        - `updatedAt`: The latest task updated time. Supports the `gt`, `ge`, `le`, and `lt` operators.

        > **Note**: Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/scim-filter'
      x-scim-filter:
        status:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/task-status'
        type:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/task-type'
        requestId:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/task-request-id'
        createdAt:
          operators:
            - gt
            - ge
            - le
            - lt
          schema:
            $ref: '#/components/schemas/task-created-at'
        updatedAt:
          operators:
            - gt
            - ge
            - le
            - lt
          schema:
            $ref: '#/components/schemas/task-updated-at'
      examples:
        FilterByStatus:
          summary: Filter by status
          value: status eq "OPEN"
        FilterByType:
          summary: Filter by type
          value: type eq "QUESTION"
        FilterByRequestId:
          summary: Filter by requestId
          value: requestId eq "0oafxqCAJWWGELFTYASJ"
        FilterByCreatedAt:
          summary: Filter by createdAt
          value: createdAt gt "2022-05-24T14:15:22Z"
        FilterByUpdatedAt:
          summary: Filter by updatedAt
          value: updatedAt gt "2022-05-24T14:15:22Z"
    task-list-after:
      name: after
      description: |
        Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the standard link headers. See [pagination](https://developer.okta.com/docs/api/#pagination).
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/task-id'
    task-list-order-by:
      name: orderBy
      description: |
        Specifies a property to sort the results. The following properties are supported:
        - `createdAt`
        - `updatedAt`

        Append `desc` or `asc` to indicate the sorting direction.
        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/order-by'
      x-order-by:
        attributes:
          - createdAt
          - updatedAt
      examples:
        OrderByCreated:
          summary: Order by created
          value: createdAt desc
        OrderByLastUpdated:
          summary: Order by updatedAt
          value: updatedAt desc
    task-id-parameter:
      name: taskId
      description: The `id` of the task
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/task-id'
    security-access-reviews-filter:
      name: filter
      in: query
      description: |-
        A [filter](https://developer.okta.com/docs/api/#filter) expression that filters security access reviews.
        The `eq` and `co` [operators](https://developer.okta.com/docs/api/#operators) are supported for string properties.
        The `gt` and `lt` operators are supported for date properties.

        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      required: false
      allowEmptyValue: true
      schema:
        type: string
      examples:
        FilterByName:
          summary: Filter by name provided for the security access review
          value: name co "Git"
        FilterByStatus:
          summary: Filter by status of the security access review
          value: status eq "ACTIVE"
        FilterByReviewerName:
          summary: Filter by reviewer.name. Note that it compares against the first name and last name of the reviewer.
          value: reviewer.name co "John"
        FilterByCreated:
          summary: Filter by created
          value: created gt "2022-05-24T14:15:22Z"
    security-access-reviews-order-by:
      name: orderBy
      description: |
        The field to sort the results, in ascending (`asc`) or descending (`desc`) order.
        Sorting is applied to only one field.

        **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)
      in: query
      required: false
      style: form
      explode: false
      schema:
        type: array
        uniqueItems: false
        minItems: 1
        maxItems: 1
        items:
          type: string
          description: A property of items within the collection, optionally followed by a ` asc` or ` desc` suffix.
        default:
          - created asc
      examples:
        OrderByName:
          summary: Order by name
          value: name desc
        OrderByCreated:
          summary: Order by created
          value: created desc
        OrderByEndTime:
          summary: Order by endTime
          value: endTime desc
        OrderByStatus:
          summary: Order by status
          value: status desc
        OrderById:
          summary: Order by id
          value: id desc
    security-access-review-id:
      name: securityAccessReviewId
      in: path
      description: The ID of the security access review
      required: true
      schema:
        type: string
    security-access-review-accesses-filter:
      name: filter
      description: |-
        A [filter](https://developer.okta.com/docs/api/#filter) expression that filters access items.

        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      schema:
        type: string
      examples:
        FilterByName:
          summary: Filter by name
          value: name co "Git"
        FilterByPriority:
          summary: Filter by priority
          value: priority eq "HIGH"
        FilterBySODConflict:
          summary: Filter by sodConflictSeverity
          value: sodConflictSeverity eq "HIGH"
        FilterByAssignmentMethod:
          summary: Filter by assignmentMethodSeverity
          value: assignmentMethodSeverity eq "HIGH"
        FilterByPastGovernanceDecisions:
          summary: Filter by pastGovernanceDecisionsSeverity
          value: pastGovernanceDecisionsSeverity eq "HIGH"
        FilterByUsageHistory:
          summary: Filter by usageHistorySeverity
          value: usageHistorySeverity eq "HIGH"
        FilterByGovernanceLabel:
          summary: Filter by governanceLabel
          value: governanceLabel co "Crown Jewel"
    security-access-review-accesses-order-by:
      name: orderBy
      description: |-
        The field to sort the results, in ascending (asc) or descending (desc) order. Sorting is applied to only one field.

        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)
      in: query
      required: false
      style: form
      explode: false
      schema:
        type: array
        uniqueItems: false
        minItems: 1
        maxItems: 1
        items:
          type: string
          description: A property of items within the collection, optionally followed by a ` asc` or ` desc` suffix.
        default:
          - priority desc
      examples:
        OrderByPriority:
          summary: Order by priority
          value: priority desc
        OrderByLastAccess:
          summary: Order by lastAccess
          value: lastAccess desc
        OrderByAccessFrequency:
          summary: Order by accessFrequency
          value: accessFrequency desc
    security-access-review-access-id:
      name: securityAccessReviewAccessId
      in: path
      description: The ID of the access item in a security access review
      required: true
      schema:
        type: string
    security-access-review-sub-accesses-filter:
      name: filter
      description: |
        A [filter](https://developer.okta.com/docs/api/#filter) expression that filters sub-access items.

        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      schema:
        type: string
      examples:
        FilterByName:
          summary: Filter by name
          value: name co "Git"
        FilterByResourceType:
          summary: Filter by resourceType
          value: resourceType eq "GROUP"
        FilterByPriority:
          summary: Filter by priority
          value: priority eq "HIGH"
        FilterBySODConflict:
          summary: Filter by sodConflictSeverity
          value: sodConflictSeverity eq "HIGH"
        FilterByAssignmentMethod:
          summary: Filter by assignmentMethodSeverity
          value: assignmentMethodSeverity eq "HIGH"
        FilterByPastGovernanceDecisions:
          summary: Filter by pastGovernanceDecisionsSeverity
          value: pastGovernanceDecisionsSeverity eq "HIGH"
        FilterByUsageHistory:
          summary: Filter by usageHistorySeverity
          value: usageHistorySeverity eq "HIGH"
        FilterByGovernanceLabel:
          summary: Filter by governanceLabel
          value: governanceLabel co "Crown Jewel"
    security-access-review-sub-accesses-order-by:
      name: orderBy
      description: |
        A field by which results can be sorted. For now, sorting by a single field is supported.

        **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)
      in: query
      required: false
      style: form
      explode: false
      schema:
        type: array
        uniqueItems: false
        minItems: 1
        maxItems: 1
        items:
          type: string
          description: A property of items within the collection, optionally followed by a ` asc` or ` desc` suffix.
        default:
          - priority desc
      examples:
        OrderByPriority:
          summary: Order by priority
          value: priority desc
    security-access-review-target-id:
      name: securityAccessReviewTargetId
      in: path
      description: The ID of the access or sub-access item in a security access review
      required: true
      schema:
        type: string
    delegates-user-list-filter:
      name: filter
      description: |
        An optional filter expression that returns users based on the `firstName` or `lastName` properties.
        This [filter](https://developer.okta.com/docs/api/#filter) expression supports the `sw` [operator](https://developer.okta.com/docs/api/#operators).

        When omitted, the endpoint returns all eligible delegates for the current user.
        However, if the org's delegate scope settings are unrestricted (the `onlyFor` list is empty),
        the filter parameter is required and omitting it returns a 400 error.

        **Note:** Query parameter percent encoding is required. See [Special characters](https://developer.okta.com/docs/api/#special-characters).
      in: query
      required: false
      schema:
        type: string
        format: scim-filter
        example: firstName sw "John" OR lastName sw "John"
      x-scim-filter:
        firstName:
          operators:
            - sw
          type: String
        lastName:
          operators:
            - sw
          type: String
    campaign-id:
      name: campaignId
      description: Unique identifier for the campaign
      in: path
      required: true
      schema:
        type: string
    review-id:
      name: reviewId
      description: Unique identifier for the review
      in: path
      required: true
      schema:
        type: string
    resource-connection-agent-id:
      name: agentId
      in: path
      required: true
      description: ID of the agent
      schema:
        type: string
        example: wlpkhjm0jnDp8RrUu0g4
    job-id:
      name: jobId
      description: Unique identifier for the job
      in: path
      required: true
      schema:
        type: string
    campaign-reviews-filter:
      name: filter
      description: |
        Apply various filters by using supported review filtering properties.

        **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)

        Supported filters are:

        - `id`: string
        - `principalId`: string
        - `reviewerId`: string
        - `decision`: string (APPROVE, REVOKE, UNREVIEWED)
        - `resourceId`: string (`GroupId` or `AppId`)
        - `reviewerType`: string (`USER` or `GROUP` or `RESOURCE_OWNER`)
        - `reviewerLevel`: string (`FIRST` or `SECOND`)
        - `entitlementValueId`: string
        - `entitlementBundleId`: string
        - `govAnalyzerRecommendationContext.recommendedReviewDecision`: string (APPROVE, REVOKE, UNREVIEWED)
        - `govAnalyzerRecommendationContext.bulkReviewDecisionJobId`: string
      in: query
      required: false
      schema:
        type: string
      examples:
        FilterByReviewDecision:
          summary: Filter by review decisions
          value: decision eq "UNREVIEWED"
        FilterByReviewerId:
          summary: Filter by reviewerId
          value: reviewerId eq "00u5v5viPvg84h0W68g4"
        FilterByGroupResourceId:
          summary: Filter by group resourceId
          value: resourceId eq "00gyqjxNrsh764hjs784"
        FilterByAppResourceId:
          summary: Filter by app resourceId
          value: resourceId eq "00ayqjxNrZD11n4w40g3"
        FilterByPrincipalId:
          summary: Filter by principalId
          value: principalId eq "00u5v5viPvg84h0W68g4"
        FilterByReviewerType:
          summary: Filter by reviewerType
          value: reviewerType eq USER
        FilterByReviewerLevel:
          summary: Filter by reviewerLevel
          value: reviewerLevel eq FIRST
        FilterByEntitlementId:
          summary: Filter by entitlement value ID
          value: entitlementValueId eq "enthzzPJAXvaYQ71T0g3"
        FilterByEntitlementType:
          summary: Filter by entitlement bundle ID
          value: entitlementBundleId eq "enbisi7xt3iBd39Bn0g3"
        FilterByRecommendedReviewDecision:
          summary: Filter by entitlement bundle ID
          value: govAnalyzerRecommendationContext.recommendedReviewDecision eq "APPROVE"
        FilterByBulkReviewDecisionJobId:
          summary: Filter by entitlement bundle ID
          value: govAnalyzerRecommendationContext.bulkReviewDecisionJobId eq "aae3l2XZ300xRq1rV0g3"
        FilterByAppServiceAccountId:
          summary: Filter by SaaS app service account ID
          value: appServiceAccountId eq "00saqjxNrZD11n4w40g3"
        FilterByOktaServiceAccountId:
          summary: Filter by Okta service account ID
          value: oktaServiceAccountId eq "00sa5v5viPvg84h0W68g4"
    my-reviews-order-by:
      name: orderBy
      description: |
        Specifies a property to sort the results. The following properties are supported:
        - `decided`
        - `decision`
        - `remediationStatus`
        - `created`

        Append `desc` or `asc` to indicate the sorting direction.

        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      style: form
      explode: false
      schema:
        type: array
        uniqueItems: false
        minItems: 1
        maxItems: 1
        items:
          type: string
          description: A property from the collection, optionally followed by an ` asc` or ` desc` suffix.
      examples:
        OrderByDecided:
          summary: Order by decided
          value: decided desc
        OrderByDecision:
          summary: Order by decision
          value: decision desc
        OrderByRemediationStatus:
          summary: Order by remediationStatus
          value: remediationStatus desc
        OrderByCreated:
          summary: Order by created
          value: created desc
  schemas:
    catalog-entry-id:
      type: string
      maxLength: 20
      minLength: 20
      description: Unique identifier of the resource catalog entry
      example: cenp2rjyxK1Js2Fc41d5
    rcar-entry-requestable:
      type: boolean
      nullable: false
      description: Is the resource requestable
    rcar-entry-counts:
      type: object
      description: Entry count metadata
      properties:
        resourceCounts:
          type: object
          description: Collection resource counts
          properties:
            applications:
              type: integer
              description: Number of app resources in a collection
              minimum: 0
              example: 3
    link:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A link to a related RESTful resource
      required:
        - href
      properties:
        name:
          type: string
          description: Link name
        rel:
          type: string
          description: Link relation
        href:
          type: string
          minLength: 1
          description: Link URI
        type:
          type: string
          description: The media type of the link. If omitted, it's implicitly `application/json`.
        method:
          type: string
          deprecated: true
        templated:
          type: boolean
          description: Indicates whether the link object's `href` property is a URI template
        hints:
          type: object
          description: Link hints
          additionalProperties:
            type: array
            items:
              type: string
        title:
          type: string
          description: Link title or label
    rcar-entry-links:
      type: object
      description: |-
        Links available for a resource catalog entry.
        * `createRequest`: returns the link to create the request only if the entry is requestable
        * `parent`: returns the parent entry only if a parent exists
        * `submittedRequest`: returns the submitted request only if the authenticated user has a submitted request for the entry and it's not available for approval
        * `pendingRequest`: returns the pending request only if the authenticated user has a submitted request for the entry and the request is available for approval
        * `relatedEntity`: returns the resource that's requested
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        logo:
          type: array
          description: Links to the catalog entry logo resources
          minItems: 0
          maxItems: 3
          items:
            $ref: '#/components/schemas/link'
        parent:
          $ref: '#/components/schemas/link'
        createRequest:
          $ref: '#/components/schemas/link'
        submittedRequest:
          $ref: '#/components/schemas/link'
        pendingRequest:
          $ref: '#/components/schemas/link'
        relatedEntity:
          $ref: '#/components/schemas/link'
    rcar-entry:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Full representaion of a access request catalog entry
      properties:
        id:
          description: Unique identifier for the entry
          type: string
          minLength: 1
        name:
          type: string
          nullable: false
          description: Name of the entry
          maxLength: 255
          minLength: 1
        description:
          type: string
          description: Description of the entry
          maxLength: 2000
        label:
          type: string
          description: Label of the entry. Currently either `Application` or `Resource Collection`
        parent:
          type: string
          nullable: false
          description: Parent of the entry
        requestable:
          $ref: '#/components/schemas/rcar-entry-requestable'
        counts:
          $ref: '#/components/schemas/rcar-entry-counts'
        _links:
          $ref: '#/components/schemas/rcar-entry-links'
      required:
        - id
        - name
        - requestable
        - _links
    rcar-entries-links:
      type: object
      description: |-
        Links available for the list of catalog entries.
        * `atspoke`: returned only for top level entries and if request types is supported
        * `match`: returned only if match is supported
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
        atspoke:
          $ref: '#/components/schemas/link'
        match:
          $ref: '#/components/schemas/link'
    rcar-entries-list-v2:
      type: object
      properties:
        data:
          description: Catalog entries list
          type: array
          items:
            $ref: '#/components/schemas/rcar-entry'
        _links:
          $ref: '#/components/schemas/rcar-entries-links'
    error-cause:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A specific cause of an error
      required:
        - errorSummary
      properties:
        errorSummary:
          type: string
          description: A more specific summary for the error that contains the error cause
        reason:
          type: string
          description: An enumerated value to represent the reason why the error occurred. This enumeration allows codes to adapt to different conditions in which an error code can occur.
        location:
          type: string
          description: A value that represents the key where the error cause occurred. This is used with `locationType` to give a holistic view of where the error cause occurred. For example, if `locationType` is `body`, `location` is `username`, and the `reason` was `UNIQUE_CONSTRAINT`, you can derive that the username was already taken.
        locationType:
          type: string
          description: A value that represents where the error cause occurred. For example, in the body or header of the request. This value isn't required for cases where the request is correct, but there was another reason why the error occurred (server-side state conflict, rate limit violation, and so on).
        domain:
          type: string
          description: A value that represents the domain of the service in which the error occurs. This value is used to isolate the error cause reason.
    error:
      type: object
      description: An Error object
      required:
        - errorCode
        - errorId
        - errorSummary
      properties:
        errorCode:
          type: string
          description: An error code unique to the error
        errorId:
          type: string
          description: An error identifier useful for troubleshooting an error with support
        errorSummary:
          type: string
          description: An error code description detailing the error
        errorLink:
          type: string
          description: An indicator of where to look to troubleshoot the error
        errorCauses:
          type: array
          description: An optional array of string values that explain possible reasons for the error
          items:
            $ref: '#/components/schemas/error-cause'
    rcar-entry-get:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      allOf:
        - $ref: '#/components/schemas/rcar-entry'
    request-field-type:
      type: string
      enum:
        - TEXT
        - SELECT
        - MULTISELECT
        - ISO_DATE
        - DURATION
        - OKTA_USER_ID
      description: Type of value for the requester field.
    field-option-value:
      type: string
      description: The value of a select option
      maxLength: 280
      minLength: 1
    request-field-value:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          description: |
            The ID of a `requesterField`.

            For `OKTA` request approval, this is typically the ID of an input field defined in an approval sequence.

            For `EXTERNAL` request approval, this is the ID of an input field relevant to the external approval system.

            The following are reserved identifiers:
            - `ACCESS_DURATION`: An identifier used to specify the duration of the access being requested. (**Note:**
              This identifier is to be grandfathered. The new name will be `OKTA_ACCESS_DURATION`.)
            - `OKTA_REQUESTED_FOR`: An identifier used to specify who the resource is being requested for
            - `OKTA_ACCESS_DURATION`: An identifier used to specify the duration of the requested access. If a request 
              field is included in this ID, the field value must be a `DURATION` expression in ISO format. The maximum 
              length of this value is 5 characters. For example, `P1D` represents a duration of one day.
            - Any identifiers with `OKTA_` prefix are reserved for future use.
        label:
          type: string
          description: A human-readable description of `requesterField`. It's used for display purposes and is optional
        type:
          $ref: '#/components/schemas/request-field-type'
        value:
          type: string
          minLength: 1
          maxLength: 1000
          description: |
            The value of `requesterField`, which depends on the type of the field:
            - `TEXT`: A multi-line string
            - `SELECT`: An option predefined by the approval system
            - `ISO_DATE`: An ISO formatted date string. for example, `2022-05-05T14:15:22Z`
            - `DURATION`: An ISO format duration expression with a maximum length of 5 characters. For example, 
              `P1D` indicates a duration of one day.
            - `OKTA_USER_ID`: Okta User ID

            If the field type is one of the previously listed, this property is required.
        values:
          type: array
          items:
            $ref: '#/components/schemas/field-option-value'
          description: |
            The values of `requesterField` with the type `MULTISELECT`.

            If the field type is `MULTISELECT`, this property is required.
    request-field-values:
      type: array
      description: |
        The requester input fields required by the approval system.

        **Note:** The fields required are determined by the approval system.

        For the Okta approval system, the required fields are defined in the approval sequence. Ensure that the requester
        input fields match up with this definition to avoid request approval flow failure.

        For external approval systems, the requester input fields are for recording purposes only and do not affect the approval
        process.
      items:
        $ref: '#/components/schemas/request-field-value'
    my-request-creatable:
      type: object
      description: The properties expected in an initial create request
      properties:
        requesterFieldValues:
          $ref: '#/components/schemas/request-field-values'
    created-by:
      description: The `id` of the Okta user who created the resource
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      readOnly: true
      minLength: 1
      maxLength: 20
      format: okta-user-id
    created:
      description: The ISO 8601 formatted date and time when the resource was created
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      format: date-time
      readOnly: true
    last-updated:
      description: The ISO 8601 formatted date and time when the object was last updated
      type: string
      format: date-time
      readOnly: true
    last-updated-by:
      description: The `id` of the Okta user who last updated the object
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      readOnly: true
      minLength: 1
      maxLength: 20
      format: okta-user-id
    read-only-standard-properties:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - id
        - createdBy
        - created
        - lastUpdated
        - lastUpdatedBy
      properties:
        id:
          description: Unique identifier for the object
          type: string
          minLength: 1
        createdBy:
          $ref: '#/components/schemas/created-by'
        created:
          $ref: '#/components/schemas/created'
        lastUpdated:
          $ref: '#/components/schemas/last-updated'
        lastUpdatedBy:
          $ref: '#/components/schemas/last-updated-by'
        _links:
          type: object
          description: Links to related resources
          additionalProperties:
            $ref: '#/components/schemas/link'
    request-status:
      type: string
      enum:
        - SUBMITTED
        - REJECTED
        - PENDING
        - APPROVED
        - DENIED
        - CANCELED
        - EXPIRED
      description: The status of the request
    request-resolved-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the request was resolved. The property may transition from having a value to null if the request is reopened.
    request-grant-status:
      type: string
      enum:
        - PENDING
        - GRANTED
        - FAILED
        - MANUAL_REQUIRED
      description: The grant status of the request
    request-granted-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the approved access was granted. Only set if request.status is APPROVED.
    request-revocation-status:
      type: string
      enum:
        - PENDING
        - REVOKED
        - FAILED
      description: The revocation status of the request
    request-revoked-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the granted access was revoked. Only set if request.grantStatus is GRANTED and request.revocationStatus is REVOKED.
    client-credential-principal:
      type: object
      description: A representation of a principal
      required:
        - externalId
        - type
      properties:
        externalId:
          type: string
          description: The principal ID
          maxLength: 20
          minLength: 20
          pattern: (00u|pca)[0-9a-zA-Z]+
        type:
          type: string
          description: The type of principal
          enum:
            - OKTA_USER
            - UNKNOWN
          x-enumDescriptions:
            OKTA_USER: The principal is an Okta user. `externalId` has the format `00u*`.
            UNKNOWN: The principal isn't a known Okta user. `externalId` has the format `pca*`. This option is for requests not made by a known Okta user, such as requests from a service using client credentials authentication.
    user-id:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      format: okta-user-id
      description: The Okta user `id`
      maxLength: 20
      minLength: 20
      pattern: 00u[0-9a-zA-Z]+
      example: 00ub0oNGTSWTBKOLGLNR
    principal-type:
      type: string
      description: The type of principal
      enum:
        - OKTA_USER
    target-principal:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A representation of a principal
      required:
        - externalId
        - type
      properties:
        externalId:
          $ref: '#/components/schemas/user-id'
        type:
          $ref: '#/components/schemas/principal-type'
    resource-id:
      type: string
      maxLength: 20
      minLength: 20
      description: the requested resource ID
    resource-type:
      type: string
      description: The requested resource type
      enum:
        - APPLICATION
        - REQUEST_TYPE
    access-scope-id:
      type: string
      description: ID of the access scope
      minLength: 20
      maxLength: 20
    access-scope-type:
      type: string
      description: The access scope type
      enum:
        - ENTITLEMENT_BUNDLE
        - GROUP
        - APPLICATION
        - REQUEST_TYPE
    requested:
      type: object
      description: A representation of the resource in request
      properties:
        entryId:
          $ref: '#/components/schemas/catalog-entry-id'
        resourceId:
          $ref: '#/components/schemas/resource-id'
        resourceType:
          $ref: '#/components/schemas/resource-type'
        accessScopeId:
          $ref: '#/components/schemas/access-scope-id'
        accessScopeType:
          $ref: '#/components/schemas/access-scope-type'
    request-links:
      type: object
      description: Links available on a single request representation
      required:
        - self
      properties:
        catalogEntry:
          $ref: '#/components/schemas/link'
        approvalCondition:
          $ref: '#/components/schemas/link'
        approvalSequence:
          $ref: '#/components/schemas/link'
        self:
          $ref: '#/components/schemas/link'
    request-minimal-read-only-fields:
      type: object
      description: Properties contained by default in sparse representation
      properties:
        status:
          $ref: '#/components/schemas/request-status'
        resolved:
          $ref: '#/components/schemas/request-resolved-date-time'
        grantStatus:
          $ref: '#/components/schemas/request-grant-status'
        granted:
          $ref: '#/components/schemas/request-granted-date-time'
        revocationStatus:
          $ref: '#/components/schemas/request-revocation-status'
        revoked:
          $ref: '#/components/schemas/request-revoked-date-time'
        requestedBy:
          $ref: '#/components/schemas/client-credential-principal'
        requestedFor:
          $ref: '#/components/schemas/target-principal'
        requested:
          $ref: '#/components/schemas/requested'
        _links:
          $ref: '#/components/schemas/request-links'
    request-duration:
      description: |
        How long the requester retains access after their request is approved and fulfilled.

        Specified in [ISO 8601 duration format](https://en.wikipedia.org/wiki/ISO_8601#Durations).

        #### Known limitation

        Only single time unit ISO 8601 duration formats (D, H, M) are supported for units (days, hours, minutes).

        ##### Supported

        | Unit       | Example |
        | ---------- | ------- |
        | D, days    | P40D    |
        | H, hours   | PT65H   |
        | M, minutes | PT90M   |

        > **Note:** Mixes of units, as well as month/year/week designations, aren't supported. For example, `P40DT65H`, `P40M`, `P1W`, and `P1Y` aren't supported.
      type: string
      example: P40D
      format: iso-duration
      nullable: true
      default: null
    request-revocation-scheduled-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the granted access is scheduled for recovation. Only set if request.accessDuration exists, and request.grantStatus is GRANTED.
    approval-provider-type:
      type: string
      description: The approval system type
      enum:
        - OKTA
        - EXTERNAL
    approval-provider-name:
      type: string
      description: A human readable name of the request approval system, for example, Okta Access Requests or ServiceNow
      minLength: 1
      maxLength: 100
    approval-provider-description:
      type: string
      description: A description of the request approval system
      maxLength: 1000
    approval-external-request-id:
      type: string
      description: The external request `id` from a request approval system, for example, ServiceNow or JIRA
      minLength: 1
      maxLength: 200
    request-permalink-id:
      type: integer
      description: The immutable, persistent identifier that always resolves to the request
    request-approval-status:
      type: string
      enum:
        - APPROVED
        - DENIED
      description: The approver's decision.
    approval-decision-date:
      type: string
      format: date-time
      description: The date the approval decision is made.
    approval-decision-enum:
      type: string
      enum:
        - APPROVE
        - DENY
        - CANCEL
    request-approval-decision:
      type: object
      description: A completed access request approval decision
      required:
        - deciderId
        - decision
        - decided
      properties:
        deciderId:
          $ref: '#/components/schemas/user-id'
        deciderName:
          type: string
          description: Okta username of the decider
          maxLength: 100
        decision:
          $ref: '#/components/schemas/approval-decision-enum'
        decided:
          $ref: '#/components/schemas/approval-decision-date'
        originalDeciderId:
          $ref: '#/components/schemas/user-id'
        originalDeciderFullName:
          type: string
          description: Full name of the original decider
          maxLength: 100
        originalDeciderEmail:
          type: string
          description: Email of the original decider
          format: email
        deciderDelegated:
          type: boolean
          description: Indicates if the decision was made by a delegated decider
        deciderEscalated:
          type: boolean
          description: Indicates if the decision was made by an escalated decider
    request-approval:
      type: object
      description: A completed access request approval
      required:
        - type
        - providerName
      properties:
        type:
          $ref: '#/components/schemas/approval-provider-type'
        providerName:
          $ref: '#/components/schemas/approval-provider-name'
        providerDescription:
          $ref: '#/components/schemas/approval-provider-description'
        externalRequestId:
          $ref: '#/components/schemas/approval-external-request-id'
        permalinkId:
          $ref: '#/components/schemas/request-permalink-id'
        status:
          $ref: '#/components/schemas/request-approval-status'
        decided:
          $ref: '#/components/schemas/approval-decision-date'
        decisions:
          type: array
          description: The approval decisions
          minItems: 0
          maxItems: 10
          items:
            $ref: '#/components/schemas/request-approval-decision'
    request-submission-type:
      type: string
      description: Whether a request submission is allowed or restricted in the risk settings
      enum:
        - ALLOWED_WITH_NO_OVERRIDES
        - ALLOWED_WITH_OVERRIDES
        - RESTRICTED
    risk-rule:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          description: The name of a resource rule causing a conflict
          maxLength: 255
          minLength: 1
        description:
          type: string
          description: The human readable description
          maxLength: 1000
          minLength: 1
        resourceName:
          type: string
          description: Human readable name of the resource
    risk-rules:
      type: array
      items:
        $ref: '#/components/schemas/risk-rule'
      minItems: 0
      maxItems: 5
    risk-assessment:
      type: object
      description: A risk assessment that indicates whether request submission is allowed or restricted. It contains the risk rules that lead to possible conflicts for the requested resource.
      required:
        - requestSubmissionType
        - riskRules
      properties:
        requestSubmissionType:
          $ref: '#/components/schemas/request-submission-type'
        riskRules:
          $ref: '#/components/schemas/risk-rules'
    request-full:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Full representation of a Request.
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - $ref: '#/components/schemas/request-minimal-read-only-fields'
        - type: object
          properties:
            accessDuration:
              $ref: '#/components/schemas/request-duration'
            revocationScheduled:
              $ref: '#/components/schemas/request-revocation-scheduled-date-time'
            requesterFieldValues:
              $ref: '#/components/schemas/request-field-values'
            requestApproval:
              $ref: '#/components/schemas/request-approval'
            riskAssessment:
              $ref: '#/components/schemas/risk-assessment'
      required:
        - id
        - created
        - createdBy
        - lastUpdated
        - lastUpdatedBy
        - status
        - requestedBy
        - requestedFor
        - requested
        - _links
    rcar-request-id:
      type: string
      format: rcar-request-id
      maxLength: 20
      minLength: 20
      pattern: req[0-9a-zA-Z]+
      example: reqp1pmpjhVdGEcVK1d5
    request-status-patchable:
      type: string
      enum:
        - CANCELED
      description: |-
        Specify the status of the request.

        Only `CANCELED` is supported. You can't cancel a request if any of its tasks have been resolved.
    request-update:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/request-status-patchable'
    field-required:
      type: boolean
      description: Whether a value to this field is required to advance the request
      example: true
      default: true
    request-field:
      type: object
      description: Fields to be filled out for a request
      required:
        - id
        - type
        - required
      properties:
        id:
          type: string
          description: |
            A `read-only` field ID.

            Useful for specifying requesterFieldValues when adding a request.
        type:
          $ref: '#/components/schemas/request-field-type'
        choices:
          type: array
          description: Valid choices when type is SELECT or MULTISELECT.
          items:
            $ref: '#/components/schemas/field-option-value'
        required:
          $ref: '#/components/schemas/field-required'
        label:
          type: string
          description: label of the requester field
        value:
          type: string
          description: An admin configured value for this field. Only applies to DURATION fields.
        maximumValue:
          type: string
          description: The maximum value allowed for this field. Only applies to DURATION fields.
        readOnly:
          type: boolean
          description: Indicates this field is immutable.
    catalog-entry-request-fields:
      type: object
      properties:
        data:
          type: array
          description: List of request fields
          items:
            $ref: '#/components/schemas/request-field'
        metadata:
          type: object
          description: Additional information about the request fields
          properties:
            riskAssessment:
              $ref: '#/components/schemas/risk-assessment'
    entry-user:
      type: object
      description: A limited set of properties from the user's profile
      required:
        - id
        - email
      properties:
        id:
          type: string
          description: Okta user `id`
          minLength: 1
          maxLength: 20
        firstName:
          type: string
          minLength: 1
          maxLength: 50
        lastName:
          type: string
          minLength: 1
          maxLength: 50
        email:
          type: string
          minLength: 1
          maxLength: 100
    entry-user-list-links:
      type: object
      description: Links available in entry user list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
    entry-users-list:
      type: object
      properties:
        data:
          description: Catalog entry users list
          type: array
          items:
            $ref: '#/components/schemas/entry-user'
        _links:
          $ref: '#/components/schemas/entry-user-list-links'
    scim-filter:
      type: string
      format: scim-filter
    task-id:
      type: string
      format: task-id
      description: The unique identifier for the task
      maxLength: 24
      minLength: 24
      pattern: ^[0-9a-f]{24}$
      example: 68b0a1576dd8db837f5ee55d
    order-by:
      type: string
      format: order-by
      description: A property of items within the collection, optionally followed by a `%20asc` or `%20desc` suffix.
    okta-id:
      description: The Okta ID
      type: string
      maxLength: 20
      minLength: 20
    task-assignees:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - externalId
        - type
      description: A task assignee that performs actions on the task.
      properties:
        externalId:
          $ref: '#/components/schemas/okta-id'
        type:
          $ref: '#/components/schemas/principal-type'
    task-status:
      type: string
      enum:
        - OPEN
        - COMPLETED
        - ASSIGNING
        - LOCKED
      description: The status of the task
    task-request-id:
      type: string
      maxLength: 20
      minLength: 20
      description: The request ID associated with the task
    task-created-at:
      description: The ISO 8601 formatted date and time when the object was created
      type: string
      format: date-time
      readOnly: true
    task-updated-at:
      description: The ISO 8601 formatted date and time when the object was last updated
      type: string
      format: date-time
      readOnly: true
    task-type:
      type: string
      enum:
        - QUESTION
        - APPROVAL
        - TODO
      description: The type of the task
    task-sparse:
      type: object
      description: Sparse representation of a Task resource
      properties:
        id:
          $ref: '#/components/schemas/task-id'
        assignees:
          type: array
          description: List of task assignees that perform actions on the task
          items:
            $ref: '#/components/schemas/task-assignees'
        status:
          $ref: '#/components/schemas/task-status'
        label:
          type: string
          nullable: false
          description: Human readable label for the task
          minLength: 1
        requestId:
          $ref: '#/components/schemas/task-request-id'
        createdAt:
          $ref: '#/components/schemas/task-created-at'
        updatedAt:
          $ref: '#/components/schemas/task-updated-at'
        type:
          $ref: '#/components/schemas/task-type'
        value:
          type: string
          nullable: true
          description: The value of the task completion that's determined by the assignee
      required:
        - id
        - assignees
        - label
        - requestId
        - createdAt
        - updatedAt
        - status
        - type
    task-list-links:
      type: object
      description: Links available in task list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
    task-list:
      type: object
      properties:
        data:
          description: All tasks on the current page
          type: array
          items:
            $ref: '#/components/schemas/task-sparse'
        _links:
          $ref: '#/components/schemas/task-list-links'
    task-is-escalated:
      type: boolean
      description: Indicates whether a task is escalated to another user. See [Escalate Tasks](https://help.okta.com/okta_help.htm?type=oie&id=csh-escl-task) in the product documentation.
    task-is-delegated:
      type: boolean
      description: Indicates whether a task is delegated to another user. See [Governance delegates](https://help.okta.com/okta_help.htm?type=oie&id=csh-governance-delegates) in the product documentation.
    task-completed-by:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - externalId
        - type
      description: The assignee who fulfilled the task
      properties:
        externalId:
          $ref: '#/components/schemas/okta-id'
        type:
          $ref: '#/components/schemas/principal-type'
    task-full:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Full representation of a task.
      allOf:
        - $ref: '#/components/schemas/task-sparse'
        - type: object
          properties:
            isEscalated:
              $ref: '#/components/schemas/task-is-escalated'
            isDelegated:
              $ref: '#/components/schemas/task-is-delegated'
            originalAssigneeId:
              type: string
              nullable: true
              description: ID of the original assignee before delegation or escalation
              minLength: 20
              format: okta-user-id
            completedBy:
              $ref: '#/components/schemas/task-completed-by'
      required:
        - id
        - assignees
        - label
        - requestId
        - createdAt
        - updatedAt
        - status
        - type
    security-access-review-status:
      type: string
      description: Security access review status
      enum:
        - ACTIVE
        - CLOSED
        - PENDING
        - ERROR
    security-access-review-reviewer-type:
      type: string
      description: |
        The type of reviewers involved in the security access review
      enum:
        - USER
    security-access-review-user-reviewer-settings:
      type: object
      properties:
        includedUserIds:
          type: array
          description: The list of reviewer user IDs for the security access review
          minItems: 1
          maxItems: 10
          items:
            type: string
            minLength: 20
            maxLength: 20
    principal-profile-status:
      type: string
      description: The status of the principal's profile
      enum:
        - ACTIVE
        - INACTIVE
    principal-profile-type:
      type: string
      description: The type of principal
      enum:
        - USER
        - CLIENT_APP
        - UNKNOWN
    principal-profile-enriched:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A limited set of properties from the principal's profile
      required:
        - id
        - status
        - type
      properties:
        id:
          type: string
          description: The Okta user `id`
          minLength: 1
          maxLength: 20
        email:
          type: string
          description: The Okta user's email address
          minLength: 1
          maxLength: 100
        firstName:
          type: string
          description: The Okta user's first name
          minLength: 0
          maxLength: 255
        lastName:
          type: string
          description: The Okta user's last name
          minLength: 0
          maxLength: 255
        login:
          type: string
          description: The Okta user's sign-in credentials, which is often their email address
          minLength: 1
          maxLength: 100
        status:
          $ref: '#/components/schemas/principal-profile-status'
        type:
          $ref: '#/components/schemas/principal-profile-type'
    security-access-review-user-reviewer-settings-addnl-details:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Holds reviewer settings in the created security access review and more detailed reviewer details involved in the security access review.
      allOf:
        - $ref: '#/components/schemas/security-access-review-user-reviewer-settings'
        - type: object
          properties:
            includedUserProfiles:
              type: array
              description: The list of user reviewers for the security access review
              minItems: 0
              maxItems: 10
              items:
                $ref: '#/components/schemas/principal-profile-enriched'
    security-access-review-reviewer-settings-response:
      type: object
      description: |
        The reviewer settings for a security access review.
        These include the type of reviewers and a list of reviewer IDs.
      required:
        - type
      properties:
        type:
          $ref: '#/components/schemas/security-access-review-reviewer-type'
        userSettings:
          $ref: '#/components/schemas/security-access-review-user-reviewer-settings-addnl-details'
    security-access-review-sparse:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - type: object
          required:
            - id
            - status
            - name
            - endTime
            - reviewerSettings
          properties:
            id:
              type: string
              description: The ID of the security access review
              minLength: 20
              maxLength: 20
            status:
              $ref: '#/components/schemas/security-access-review-status'
            name:
              type: string
              description: The name of the security access review
              minLength: 1
              maxLength: 200
            endTime:
              type: string
              format: date-time
              description: The end time of the security access review
            reviewerSettings:
              $ref: '#/components/schemas/security-access-review-reviewer-settings-response'
    security-access-review-list-links:
      type: object
      description: Links available in security access review, access, or sub access list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
    security-access-reviews:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      properties:
        data:
          description: Security access reviews entries
          type: array
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-sparse'
        _links:
          $ref: '#/components/schemas/security-access-review-list-links'
    security-access-reviews-stats:
      type: object
      required:
        - activeCount
        - pendingCount
        - errorCount
        - closedCount
      properties:
        activeCount:
          type: integer
          description: The number of active security access reviews
        pendingCount:
          type: integer
          description: The number of pending security access reviews
        errorCount:
          type: integer
          description: The number of errored security access reviews
        closedCount:
          type: integer
          description: The number of closed security access reviews
    server-message-argument-type:
      type: string
      description: Type of the server message argument
      enum:
        - STRING
        - RELATIVE_DATE_TO_NOW
        - NUMBER
      x-enumDescriptions:
        STRING: A string argument
        RELATIVE_DATE_TO_NOW: An ISO 8601 date string argument that's relative to the current date
        NUMBER: A number argument
    server-message-argument:
      type: object
      required:
        - value
        - type
      properties:
        value:
          type: string
        type:
          $ref: '#/components/schemas/server-message-argument-type'
    ai-message:
      type: object
      description: |-
        An AI-generated summary is presented as a long text string and sometimes multiple paragraphs.
        If an AI summary fails to generate, an array of errors is returned with possible steps to correct the failure.
      required:
        - message
      properties:
        message:
          type: string
          description: Generated summary message
        deltaMessage:
          type: string
          description: Generated summary message as a delta (for streaming)
        errors:
          type: array
          minItems: 0
          maxItems: 100
          description: Whenever summary generation has resulted in an error or blocked, the array of errors details the reasons
          items:
            type: object
            required:
              - errorCode
              - errorMsg
            properties:
              errorCode:
                type: string
                description: A unique error code. Error codes are useful to execute additional actions.
              errorMsg:
                type: string
                description: An error message detailing the problem
              args:
                type: array
                description: Any dynamic arguments that are needed to construct the whole message are supplied as an array of values
                minItems: 0
                maxItems: 100
                items:
                  $ref: '#/components/schemas/server-message-argument'
    security-access-review:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - id
        - status
        - name
        - endTime
        - reviewerSettings
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - type: object
          required:
            - status
            - name
            - endTime
            - reviewerSettings
          properties:
            status:
              $ref: '#/components/schemas/security-access-review-status'
            name:
              type: string
              description: The name of the security access review
              minLength: 1
              maxLength: 255
            endTime:
              type: string
              format: date-time
              description: The end time of the security access review
            reviewerSettings:
              $ref: '#/components/schemas/security-access-review-reviewer-settings-response'
            summary:
              $ref: '#/components/schemas/ai-message'
    security-access-review-action-type:
      type: string
      description: The type of action for the security access review
      enum:
        - CLOSE_REVIEW
        - RESTORE_ALL_ACCESS
    security-access-review-action:
      type: object
      required:
        - actionType
      properties:
        actionType:
          $ref: '#/components/schemas/security-access-review-action-type'
    security-access-review-actions:
      type: object
      properties:
        data:
          type: array
          description: Returns all possible actions for the given security access review
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-action'
    security-access-review-action-request:
      type: object
      required:
        - actionType
      properties:
        actionType:
          $ref: '#/components/schemas/security-access-review-action-type'
    security-access-review-principal-location:
      type: object
      description: The location details of the Okta user
      properties:
        city:
          type: string
          description: The city of the location
          minLength: 1
          maxLength: 50
        state:
          type: string
          description: The state of the location
          minLength: 1
          maxLength: 50
        country:
          type: string
          description: The country of the location
          minLength: 1
          maxLength: 50
    security-access-review-principal-last-login-info:
      type: object
      description: The latest sign-in details for the Okta user
      properties:
        date:
          type: string
          format: date-time
          description: Last sign-in date
        location:
          $ref: '#/components/schemas/security-access-review-principal-location'
        device:
          type: string
          description: Last sign-in device
          minLength: 1
          maxLength: 255
        ipAddress:
          type: string
          description: Last sign-in IP address
          minLength: 3
          maxLength: 39
    security-access-review-principal-okta-admin-role:
      type: object
      required:
        - roleId
        - roleName
      properties:
        roleId:
          type: string
          description: Unique identifier for the Okta admin role
          minLength: 1
          maxLength: 255
        roleName:
          type: string
          description: Name of the Okta admin role
          minLength: 1
          maxLength: 255
    security-access-review-principal:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      allOf:
        - $ref: '#/components/schemas/principal-profile-enriched'
        - type: object
          properties:
            department:
              type: string
              description: The department of the Okta user
              minLength: 1
              maxLength: 255
            manager:
              type: string
              description: The manager of the Okta user
              minLength: 1
              maxLength: 255
            role:
              type: string
              description: The Okta user role
              minLength: 1
              maxLength: 255
            homeLocation:
              $ref: '#/components/schemas/security-access-review-principal-location'
            lastLoginInfo:
              $ref: '#/components/schemas/security-access-review-principal-last-login-info'
            oktaAdminRoles:
              type: array
              description: List of Okta admin roles assigned to the principal
              minItems: 0
              maxItems: 50
              items:
                $ref: '#/components/schemas/security-access-review-principal-okta-admin-role'
            _links:
              type: object
              additionalProperties:
                $ref: '#/components/schemas/link'
    security-access-review-access-item-type:
      type: string
      description: Access item type
      enum:
        - APPLICATION
    security-access-review-access-item-severity:
      type: string
      description: The access severity
      enum:
        - LOW
        - MEDIUM
        - HIGH
    security-access-review-access-item-supported-action:
      type: string
      description: Supported actions
      enum:
        - REVOKE_ACCESS
        - RESTORE_ACCESS
        - FLAG_FOR_MANUAL_REMEDIATION
        - FLAG_FOR_MANUAL_RESTORATION
      x-enumDescriptions:
        REVOKE_ACCESS: Revoke access for the user
        RESTORE_ACCESS: Restore access for the user
        FLAG_FOR_MANUAL_REMEDIATION: Access needs to be manually revoked for the user
        FLAG_FOR_MANUAL_RESTORATION: Access needs to be manually restored for the user
    security-access-review-access-item-remediation-status:
      type: string
      description: Remediation status
      enum:
        - PENDING_MANUAL_REMEDIATION
        - PENDING_MANUAL_RESTORATION
        - REMEDIATED
        - IN_PROGRESS
        - NONE
    security-access-review-access-item-manual-remediation-type:
      type: string
      description: The reason manual remediation is required
      enum:
        - GROUP_RULE
        - ENTITLEMENT_POLICY
        - COLLECTION
        - APP_GROUP
        - UNSUPPORTED_GROUP
        - FIRST_PARTY_APP
      x-enumDescriptions:
        GROUP_RULE: Manual remediation is required due to an assignment through a group rule.
        ENTITLEMENT_POLICY: Manual remediation is required due to an assignment through an entitlement policy.
        COLLECTION: Manual remediation is required due to an assignment through a collection.
        APP_GROUP: Manual remediation is required due to an assignment through an unsupported external app group.
        UNSUPPORTED_GROUP: Manual remediation is required due to an assignment through an unsupported group type.
        FIRST_PARTY_APP: Manual remediation is required due to an assignment through a first-party app.
    assignment-type:
      type: string
      description: The assignment type
      enum:
        - INDIVIDUAL
        - GROUP
        - GROUP_RULE
        - APP_GROUP
        - ACCESS_REQUEST
        - ADMIN
        - POLICY
        - ENTITLEMENT
      x-enumDescriptions:
        INDIVIDUAL: Assigned directly to the user
        GROUP: Assigned through a group
        GROUP_RULE: Assigned through a group rule
        APP_GROUP: Assigned through an external app group
        ACCESS_REQUEST: Assigned through an access request
        ADMIN: Assigned by an admin
        POLICY: Assigned through a policy
        ENTITLEMENT: Assigned through an individual entitlement grant
    entitlement-property-id:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The `id` property of an entitlement
      minLength: 20
      maxLength: 20
    entitlement-property-display-name:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The display name for an entitlement property
      minLength: 1
      maxLength: 255
    entitlement-property-value:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The value of an entitlement property
      minLength: 1
      maxLength: 255
    entitlement-property-description:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The description of an entitlement property
      minLength: 1
      maxLength: 1000
    entitlement-property-multi-value:
      type: boolean
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Indicates if the entitlement property can hold multiple values. If this property is `true`, then the `dataType` property is set to `array`.
    entitlement-property-required:
      type: boolean
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The property that determines if the entitlement property is a required attribute
    entitlement-property-datatype:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The data type of the entitlement property
      enum:
        - string
        - array
      x-enumDescriptions:
        string: The entitlement property is a single value.
        array: The entitlement property is multivalued.
    entitlement-property-full:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Attributes related to an entitlement
      properties:
        id:
          $ref: '#/components/schemas/entitlement-property-id'
        name:
          $ref: '#/components/schemas/entitlement-property-display-name'
        externalValue:
          $ref: '#/components/schemas/entitlement-property-value'
        description:
          $ref: '#/components/schemas/entitlement-property-description'
        multiValue:
          $ref: '#/components/schemas/entitlement-property-multi-value'
        required:
          $ref: '#/components/schemas/entitlement-property-required'
        dataType:
          $ref: '#/components/schemas/entitlement-property-datatype'
    label-id:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The ID of a label
      minLength: 20
      maxLength: 20
    label-value-id:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      description: The ID of a label value
      minLength: 20
      maxLength: 20
    label-metadata:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Metadata for a label value
      properties:
        additionalProperties:
          type: object
          description: |-
            Additional metadata properties for the label value.

            Supported property and valid values:
            * `backgroundColor`: [`red`, `orange`, `yellow`, `green`, `blue`, `purple`, `teal`, `beige`, `gray`]
          properties: {}
    label-value:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      properties:
        labelValueId:
          $ref: '#/components/schemas/label-value-id'
        name:
          type: string
          description: The label value
          minLength: 1
          maxLength: 50
        metadata:
          $ref: '#/components/schemas/label-metadata'
      required:
        - labelValueId
        - name
    target-governance-label:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      properties:
        labelId:
          $ref: '#/components/schemas/label-id'
        name:
          type: string
          description: Name of the label
          minLength: 1
          maxLength: 50
        values:
          type: array
          description: List of label values
          maxItems: 10
          items:
            allOf:
              - $ref: '#/components/schemas/label-value'
      required:
        - labelId
        - name
        - values
    security-access-review-access-item-app-info:
      type: object
      description: The details of an app access item
      required:
        - id
        - name
        - logoUrl
      properties:
        id:
          type: string
          description: The Okta app ID
          minLength: 20
          maxLength: 20
        name:
          type: string
          description: The app name
          minLength: 1
          maxLength: 255
        logoUrl:
          type: string
          description: The app logo URL
          minLength: 1
          maxLength: 2048
        label:
          type: string
          description: The app label
          minLength: 1
          maxLength: 255
        lastAccessDate:
          type: string
          description: The last time the app was accessed by the user
          format: date-time
        assignedDate:
          type: string
          format: date-time
          description: The date the app was assigned to the user
        assignmentType:
          $ref: '#/components/schemas/assignment-type'
        applicationUsage:
          description: The number of times the user has used the app in the last 90 days
          type: integer
          format: int64
        lastAccessCertificationReviewedDate:
          type: string
          format: date-time
          description: The last time the user/app pair was reviewed in an access certification campaign
        lastSecurityAccessReviewDate:
          type: string
          format: date-time
          description: The last time an action was taken on this app for the user in a security access review
        lastDeviceLogin:
          type: string
          description: Information about the last device used to log into the app
          minLength: 1
          maxLength: 255
        activeEntitlements:
          description: Any active entitlements for this app
          type: array
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/entitlement-property-full'
        governanceLabels:
          description: All governance labels applied to the app
          type: array
          minItems: 0
          maxItems: 20
          items:
            $ref: '#/components/schemas/target-governance-label'
    security-access-review-sub-access-item-type:
      type: string
      description: The type of sub-access item
      enum:
        - ENTITLEMENT_VALUE
        - ENTITLEMENT_BUNDLE
        - GROUP
    security-access-review-access-item:
      type: object
      required:
        - id
        - type
        - name
        - resourceId
        - severity
        - supportedActions
      properties:
        id:
          type: string
          description: The ID of the access item
          minLength: 20
          maxLength: 20
        type:
          $ref: '#/components/schemas/security-access-review-access-item-type'
        name:
          type: string
          description: The name of the access item
          minLength: 1
          maxLength: 255
        resourceId:
          type: string
          description: The ID of the resource for the access item in a security access review
          minLength: 20
          maxLength: 20
        severity:
          $ref: '#/components/schemas/security-access-review-access-item-severity'
        supportedActions:
          type: array
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-access-item-supported-action'
        remediationStatus:
          $ref: '#/components/schemas/security-access-review-access-item-remediation-status'
        manualRemediationTypes:
          type: array
          description: The reasons for manual remediation
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-access-item-manual-remediation-type'
        appInfo:
          $ref: '#/components/schemas/security-access-review-access-item-app-info'
        summary:
          $ref: '#/components/schemas/ai-message'
        subAccessTypes:
          type: array
          description: A list of sub-access types for the access item
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-sub-access-item-type'
        _links:
          type: object
          description: Links related to the access item
          additionalProperties:
            $ref: '#/components/schemas/link'
    security-access-review-access-items:
      type: object
      properties:
        data:
          description: List of access items in the security access review
          type: array
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-access-item'
        _links:
          $ref: '#/components/schemas/security-access-review-list-links'
    security-access-review-sub-access-item-entitlement-type:
      type: string
      description: The entitlement type
      enum:
        - ENTITLEMENT_VALUE
        - ENTITLEMENT_BUNDLE
    collection-info-sparse:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: Unique identifier of the collection
        name:
          type: string
          description: Name of the collection
    security-access-review-sub-access-item-entitlement-info:
      type: object
      description: The entitlement details for the sub-access item
      required:
        - type
      properties:
        type:
          $ref: '#/components/schemas/security-access-review-sub-access-item-entitlement-type'
        description:
          type: string
          description: A brief description of the entitlement value or bundle
          minLength: 1
          maxLength: 1024
        entitlementDescription:
          type: string
          description: A brief description of the entitlement associated with the value
          minLength: 1
          maxLength: 1024
        assignedDate:
          type: string
          format: date-time
          description: The date the entitlement or bundle was assigned to the user
        assignmentType:
          $ref: '#/components/schemas/assignment-type'
        collectionsAssigning:
          description: Collections assigning this resource
          type: array
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/collection-info-sparse'
        entitlements:
          description: The entitlements included in the entitlement bundle
          type: array
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/entitlement-property-full'
        lastAccessCertificationReviewedDate:
          type: string
          format: date-time
          description: The last time the user/entitlement pair was reviewed in an access certification campaign
        lastSecurityAccessReviewDate:
          type: string
          format: date-time
          description: The last time an action was taken on this entitlement for the user in a security access review
        governanceLabels:
          description: All governance labels applied to the entitlement value or bundle
          type: array
          minItems: 0
          maxItems: 20
          items:
            $ref: '#/components/schemas/target-governance-label'
    security-access-review-sub-access-item-group-info:
      type: object
      description: The group details for the sub-access item
      properties:
        description:
          type: string
          description: A brief description of the group
          minLength: 1
          maxLength: 1024
        assignedDate:
          type: string
          format: date-time
          description: The date the group was assigned to the user
        groupOwner:
          type: string
          minLength: 1
          maxLength: 255
          description: The group owner name
        assignmentType:
          $ref: '#/components/schemas/assignment-type'
        lastAccessCertificationReviewedDate:
          type: string
          format: date-time
          description: The last time the user/group pair was reviewed in an access certification campaign
        lastSecurityAccessReviewDate:
          type: string
          format: date-time
          description: The last time an action was taken on this group for the user in a security access review
        governanceLabels:
          description: All governance labels applied to the group
          type: array
          minItems: 0
          maxItems: 20
          items:
            $ref: '#/components/schemas/target-governance-label'
    security-access-review-sub-access-item:
      type: object
      required:
        - id
        - name
        - type
        - resourceId
        - severity
        - supportedActions
      properties:
        id:
          type: string
          description: The ID of the sub-access item
          minLength: 20
          maxLength: 20
        name:
          type: string
          description: The name of the sub-access item
          minLength: 1
          maxLength: 255
        type:
          $ref: '#/components/schemas/security-access-review-sub-access-item-type'
        resourceId:
          type: string
          description: The ID of the resource for the sub-access item
          minLength: 20
          maxLength: 20
        severity:
          $ref: '#/components/schemas/security-access-review-access-item-severity'
        supportedActions:
          type: array
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-access-item-supported-action'
        remediationStatus:
          $ref: '#/components/schemas/security-access-review-access-item-remediation-status'
        manualRemediationTypes:
          type: array
          description: The reasons for manual remediation
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-access-item-manual-remediation-type'
        entitlementInfo:
          $ref: '#/components/schemas/security-access-review-sub-access-item-entitlement-info'
        groupInfo:
          $ref: '#/components/schemas/security-access-review-sub-access-item-group-info'
    security-access-review-sub-access-items:
      type: object
      properties:
        data:
          description: List of access items in the security access review
          type: array
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-sub-access-item'
        _links:
          $ref: '#/components/schemas/security-access-review-list-links'
    security-access-review-anomaly-type:
      type: string
      description: The access item target type
      enum:
        - SOD_CONFLICT
        - ASSIGNMENT_METHOD
        - PAST_GOVERNANCE_DECISIONS
        - USAGE_HISTORY
    server-message:
      type: object
      required:
        - message
      properties:
        message:
          type: string
          description: Server message with detailed content
          minLength: 1
          maxLength: 1000
        args:
          type: array
          description: Dynamic arguments, used to construct the whole message, are supplied as an array of values.
          minItems: 0
          maxItems: 100
          items:
            $ref: '#/components/schemas/server-message-argument'
    server-extended-message:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: An extended version of the server message that includes a few additional properties
      allOf:
        - $ref: '#/components/schemas/server-message'
        - type: object
          required:
            - messageCode
          properties:
            messageCode:
              type: string
              description: A unique message code. You can use the message code for additional processes, such as localization.
              minLength: 1
              maxLength: 255
    security-access-review-sod-conflict-operator:
      type: string
      description: The boolean operator used to calculate the conflict between the given entitlement lists in the SOD rule
      enum:
        - AND
    security-access-review-conflicted-entitlement-list-scope:
      type: string
      description: Shows the scope used to calculate the conflict between two entitlement lists
      enum:
        - ANY_ONE_OF
        - ALL_OF
    security-access-review-conflicted-entitlement-value:
      type: object
      required:
        - id
        - name
        - sourceOfConflict
      properties:
        id:
          type: string
          description: ID of entitlement value
          minLength: 20
          maxLength: 20
        name:
          type: string
          description: Entitlement value name
          minLength: 1
          maxLength: 255
        sourceOfConflict:
          type: boolean
          description: A true value indicates that the associated resource is for this entitlement value or is a bundle that contains this entitlement value.
    security-access-review-conflicted-entitlement:
      type: object
      required:
        - id
        - name
        - values
      properties:
        id:
          type: string
          description: Entitlement ID
          minLength: 20
          maxLength: 20
        name:
          type: string
          description: Entitlement name
          minLength: 1
          maxLength: 255
        values:
          type: array
          description: List of entitlement values
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-conflicted-entitlement-value'
    security-access-review-sod-conflict-conflicted-entitlement-info:
      type: object
      required:
        - listName
        - entitlements
        - scope
      properties:
        listName:
          type: string
          description: The entitlement list name
          minLength: 1
          maxLength: 255
        scope:
          $ref: '#/components/schemas/security-access-review-conflicted-entitlement-list-scope'
        entitlements:
          type: array
          description: List of entitlements
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-conflicted-entitlement'
    security-access-review-sod-conflict:
      type: object
      required:
        - id
        - name
        - operator
        - conflictedEntitlements
      properties:
        id:
          type: string
          description: ID of SOD conflict rule
          minLength: 20
          maxLength: 20
        name:
          type: string
          description: Name of SOD conflict rule
          minLength: 1
          maxLength: 255
        description:
          type: string
          description: Description of SOD conflict rule
          minLength: 1
          maxLength: 1024
        operator:
          $ref: '#/components/schemas/security-access-review-sod-conflict-operator'
        conflictedEntitlements:
          type: array
          description: List of conflicted entitlements that caused this SOD conflict
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-sod-conflict-conflicted-entitlement-info'
    security-access-review-anomaly:
      type: object
      required:
        - type
        - severity
        - subtext
      properties:
        type:
          $ref: '#/components/schemas/security-access-review-anomaly-type'
        severity:
          $ref: '#/components/schemas/security-access-review-access-item-severity'
        subtext:
          $ref: '#/components/schemas/server-extended-message'
        sodConflicts:
          type: array
          description: A list of separation of duties (SOD) conflicts caused by a user's access to an entitlement
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-sod-conflict'
    security-access-review-anomalies:
      type: object
      properties:
        data:
          type: array
          description: Lists all anomalies identified.
          minItems: 0
          maxItems: 50
          items:
            $ref: '#/components/schemas/security-access-review-anomaly'
    security-access-review-accesses-action-request:
      type: object
      required:
        - type
      properties:
        type:
          $ref: '#/components/schemas/security-access-review-access-item-supported-action'
    security-access-review-history-item:
      type: object
      required:
        - id
        - systemGenerated
        - timestamp
        - message
      properties:
        id:
          type: string
          minLength: 20
          maxLength: 20
        systemGenerated:
          type: boolean
          description: Indicates if the action or change was made by Okta
        timestamp:
          type: string
          description: The date and time of the action or change
          format: date-time
        message:
          type: string
          minLength: 1
          maxLength: 1000
        principalProfile:
          $ref: '#/components/schemas/principal-profile-enriched'
    security-access-review-history-items:
      type: object
      properties:
        data:
          type: array
          description: Lists all events occurred on a given security access review. The history covers all such events and actions.
          minItems: 0
          maxItems: 200
          items:
            $ref: '#/components/schemas/security-access-review-history-item'
        _links:
          $ref: '#/components/schemas/security-access-review-list-links'
    security-access-review-comment-request:
      type: object
      required:
        - comment
      properties:
        comment:
          type: string
          description: A comment for the security access review
          minLength: 1
          maxLength: 1000
    ai-summary-stream-sse-message:
      type: object
      description: |-
        The server-sent events (SSE) format:
        * The `data` property contains a JSON string.
        * The `data` property contains chunks of the AI-generated summary.
      required:
        - data
      properties:
        id:
          type: string
          description: The event ID
        event:
          type: string
          description: The event type
        data:
          type: string
          description: The event data in JSON string format
          example: '{"message": "A detailed message constructed so far", "deltaMessage": "constructed so far", "errors": []}'
    delegate-appointment-delegate:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        The appointed principal who performs delegated duties
      allOf:
        - $ref: '#/components/schemas/target-principal'
    delegate-settings-user:
      type: object
      properties:
        firstName:
          type: string
          minLength: 1
          maxLength: 50
          description: The user's first name
        lastName:
          type: string
          minLength: 1
          maxLength: 50
          description: The user's last name
        email:
          type: string
          minLength: 1
          maxLength: 100
          description: The user's email address
    delegate-appointment-start-time:
      type: string
      format: date-time
      description: The start time of the delegate appointment, in [RFC3339](https://www.rfc-editor.org/rfc/rfc3339.html) date and time format
    delegate-appointment-end-time:
      type: string
      format: date-time
      description: The time when the delegate appointment expires, in [RFC3339](https://www.rfc-editor.org/rfc/rfc3339.html) date and time format
    delegate-appointment-note:
      type: string
      maxLength: 1000
      description: A note that describes the delegate appointment
    my-settings-get-delegate-readonly:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        Delegate appointment settings
      properties:
        id:
          description: Unique identifier for the delegate appointment
          type: string
          minLength: 20
          maxLength: 20
        delegate:
          allOf:
            - $ref: '#/components/schemas/delegate-appointment-delegate'
            - $ref: '#/components/schemas/delegate-settings-user'
        startTime:
          $ref: '#/components/schemas/delegate-appointment-start-time'
        endTime:
          $ref: '#/components/schemas/delegate-appointment-end-time'
        note:
          $ref: '#/components/schemas/delegate-appointment-note'
        createdBy:
          $ref: '#/components/schemas/created-by'
        created:
          $ref: '#/components/schemas/created'
        lastUpdated:
          $ref: '#/components/schemas/last-updated'
        lastUpdatedBy:
          $ref: '#/components/schemas/last-updated-by'
      required:
        - id
        - delegate
        - createdBy
        - created
        - lastUpdated
        - lastUpdatedBy
    org-settings-permission:
      type: string
      description: Permission that can be assigned to a setting
    my-org-settings-delegate-permissions:
      x-okta-lifecycle:
        lifecycle: BETA
      description: |-
        My delegate permission settings

        | Permission | Description |
        |------------|-------------|
        | `READ` | I can view my delegates |
        | `WRITE` | I can view and set my own delegates |
      type: array
      items:
        $ref: '#/components/schemas/org-settings-permission'
      minItems: 1
      maxItems: 1
    delegate-scope:
      type: object
      required:
        - type
      properties:
        type:
          type: string
          description: The type of users that end users can assign as delegates
          enum:
            - MANAGER
            - PEERS
          x-enumDescriptions:
            MANAGER: End users can only assign their manager as a delegate
            PEERS: This option must be used in conjunction with the `MANAGER` option. It allows end users to select their manager's direct reports as delegates.
    delegate-scopes:
      type: array
      description: Restricts the scope of delegate assignment for end users when `permissions` is set to `WRITE`. If this list is empty, end users can assign any user as their delegate.
      items:
        $ref: '#/components/schemas/delegate-scope'
    my-settings-get:
      type: object
      properties:
        delegates:
          type: object
          description: My delegates
          properties:
            appointments:
              description: My delegate appointments
              type: array
              maxItems: 1
              minItems: 0
              items:
                $ref: '#/components/schemas/my-settings-get-delegate-readonly'
            permissions:
              $ref: '#/components/schemas/my-org-settings-delegate-permissions'
            onlyFor:
              $ref: '#/components/schemas/delegate-scopes'
          required:
            - appointments
    delegate-patchable:
      type: object
      properties:
        delegate:
          $ref: '#/components/schemas/delegate-appointment-delegate'
        note:
          $ref: '#/components/schemas/delegate-appointment-note'
        startTime:
          $ref: '#/components/schemas/delegate-appointment-start-time'
        endTime:
          $ref: '#/components/schemas/delegate-appointment-end-time'
      required:
        - delegate
    delegates-patchable:
      type: object
      description: Delegates for the principal
      properties:
        appointments:
          type: array
          description: Delegate appointments
          nullable: true
          maxItems: 1
          minItems: 0
          items:
            $ref: '#/components/schemas/delegate-patchable'
    my-settings-patchable:
      type: object
      description: |
        Governance settings for the current user
      properties:
        delegates:
          $ref: '#/components/schemas/delegates-patchable'
    delegate-readonly:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        Delegate appointment settings
      properties:
        id:
          description: Unique identifier for the delegate appointment
          type: string
          minLength: 20
          maxLength: 20
        delegate:
          $ref: '#/components/schemas/delegate-appointment-delegate'
        startTime:
          $ref: '#/components/schemas/delegate-appointment-start-time'
        endTime:
          $ref: '#/components/schemas/delegate-appointment-end-time'
        note:
          $ref: '#/components/schemas/delegate-appointment-note'
        createdBy:
          $ref: '#/components/schemas/created-by'
        created:
          $ref: '#/components/schemas/created'
        lastUpdated:
          $ref: '#/components/schemas/last-updated'
        lastUpdatedBy:
          $ref: '#/components/schemas/last-updated-by'
      required:
        - id
        - delegate
        - createdBy
        - created
        - lastUpdated
        - lastUpdatedBy
    my-settings:
      type: object
      properties:
        delegates:
          type: object
          description: My delegates
          properties:
            appointments:
              description: My delegate appointments
              type: array
              maxItems: 1
              minItems: 0
              items:
                $ref: '#/components/schemas/delegate-readonly'
            permissions:
              $ref: '#/components/schemas/my-org-settings-delegate-permissions'
          required:
            - appointments
    delegate-user:
      type: object
      description: A limited set of properties from the user's profile
      required:
        - id
        - email
      properties:
        id:
          $ref: '#/components/schemas/user-id'
        firstName:
          type: string
          minLength: 1
          maxLength: 50
          description: The user's first name
        lastName:
          type: string
          minLength: 1
          maxLength: 50
          description: The user's last name
        email:
          type: string
          minLength: 1
          maxLength: 100
          description: The user's email address
    link-self:
      type: object
      description: Links available for an object
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
    delegate-users-list:
      type: object
      properties:
        data:
          description: Delegate users list
          type: array
          items:
            $ref: '#/components/schemas/delegate-user'
        _links:
          $ref: '#/components/schemas/link-self'
    my-resource-connection-common:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      properties:
        id:
          type: string
          description: Unique identifier for the resource connection
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the resource connection
        status:
          type: string
          description: The status of the connection
          enum:
            - ACTIVE
            - INACTIVE
          x-enumDescriptions:
            ACTIVE: The agent connection is active
            INACTIVE: The agent connection is inactive
    custom-authorization-server:
      type: object
      description: Custom authorization server for the resource connection
      required:
        - orn
        - name
        - issuerUrl
      properties:
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the authorization server
        name:
          type: string
          description: Display name of the authorization server
        issuerUrl:
          type: string
          description: Issuer URL for the authorization server
    identity-assertion-custom-as-connection:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Identity assertion connection for a custom authorization server
      required:
        - connectionType
        - authorizationServer
      allOf:
        - $ref: '#/components/schemas/my-resource-connection-common'
      properties:
        connectionType:
          type: string
          enum:
            - IDENTITY_ASSERTION_CUSTOM_AS
          description: Type of connection authentication method
        authorizationServer:
          $ref: '#/components/schemas/custom-authorization-server'
    resource-connection-vaulted-secret:
      type: object
      description: Secret for the resource connection
      required:
        - orn
        - name
      properties:
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the vaulted secret
        name:
          type: string
          description: Display name of the secret
    sts-vault-secret-connection:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: STS connection to a vaulted secret
      required:
        - connectionType
        - secret
      allOf:
        - $ref: '#/components/schemas/my-resource-connection-common'
      properties:
        connectionType:
          type: string
          enum:
            - STS_VAULT_SECRET
          description: Type of connection authentication method
        secret:
          $ref: '#/components/schemas/resource-connection-vaulted-secret'
    resource-connection-appInstance:
      type: object
      description: App instance for the resource connection
      required:
        - orn
        - name
      properties:
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the app instance
        name:
          type: string
          description: Display name of the app
    resource-connection-service-account:
      type: object
      description: Service account for the resource connection
      required:
        - orn
        - name
      properties:
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the service account
        name:
          type: string
          description: Display name of the service account
    sts-service-account-connection:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: STS connection to a service account
      required:
        - connectionType
        - app
        - serviceAccount
      allOf:
        - $ref: '#/components/schemas/my-resource-connection-common'
      properties:
        connectionType:
          type: string
          enum:
            - STS_SERVICE_ACCOUNT
          description: Type of connection authentication method
        app:
          $ref: '#/components/schemas/resource-connection-appInstance'
        serviceAccount:
          $ref: '#/components/schemas/resource-connection-service-account'
    sts-access-token-resource-app-instance:
      type: object
      description: Resource data for an `STS_ACCESS_TOKEN` connection to an app instance
      required:
        - resourceType
        - orn
        - appInstanceName
      properties:
        resourceType:
          type: string
          enum:
            - APP_INSTANCE
          description: Type of resource for this `STS_ACCESS_TOKEN` connection
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the client auth settings
        appInstanceName:
          type: string
          description: Display name of the associated app instance
    sts-access-token-resource-mcp-server:
      type: object
      description: Resource data for an `STS_ACCESS_TOKEN` connection to a third-party MCP server
      required:
        - resourceType
        - orn
        - name
      properties:
        resourceType:
          type: string
          enum:
            - MCP_SERVER
          description: Type of resource for this `STS_ACCESS_TOKEN` connection
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the client auth settings
        name:
          type: string
          description: Display name of the third-party MCP server
    sts-access-token-resource-api-server:
      type: object
      description: Resource data for an `STS_ACCESS_TOKEN` connection to a third-party API server
      required:
        - resourceType
        - orn
        - name
      properties:
        resourceType:
          type: string
          enum:
            - API_SERVER
          description: Type of resource for this `STS_ACCESS_TOKEN` connection
        orn:
          type: string
          description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the client auth settings
        name:
          type: string
          description: Display name of the third-party API server
    sts-access-token-resource:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      discriminator:
        propertyName: resourceType
        mapping:
          APP_INSTANCE: '#/components/schemas/sts-access-token-resource-app-instance'
          MCP_SERVER: '#/components/schemas/sts-access-token-resource-mcp-server'
          API_SERVER: '#/components/schemas/sts-access-token-resource-api-server'
      oneOf:
        - $ref: '#/components/schemas/sts-access-token-resource-app-instance'
        - $ref: '#/components/schemas/sts-access-token-resource-mcp-server'
        - $ref: '#/components/schemas/sts-access-token-resource-api-server'
    sts-access-token-connection:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: STS connection for OAuth-based token exchange (app instances, API servers, or third-party MCP servers)
      required:
        - connectionType
        - resource
      allOf:
        - $ref: '#/components/schemas/my-resource-connection-common'
      properties:
        connectionType:
          type: string
          enum:
            - STS_ACCESS_TOKEN
          description: Type of connection authentication method
        resource:
          $ref: '#/components/schemas/sts-access-token-resource'
    A2aServerOrn:
      type: string
      description: The [ORN](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the A2A server
    resource-connection-a2a-server:
      type: object
      description: Agent-to-agent (A2A) server for the resource connection
      required:
        - orn
        - name
      properties:
        orn:
          $ref: '#/components/schemas/A2aServerOrn'
        name:
          type: string
          description: Display name of the agent-to-agent (A2A) server
    identity-assertion-a2a-server-connection:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Identity assertion connection for an agent-to-agent (A2A) server
      required:
        - connectionType
        - a2aServer
        - authorizationServer
      allOf:
        - $ref: '#/components/schemas/my-resource-connection-common'
      properties:
        connectionType:
          type: string
          enum:
            - IDENTITY_ASSERTION_A2A_SERVER
          description: Type of connection authentication method
        a2aServer:
          $ref: '#/components/schemas/resource-connection-a2a-server'
        authorizationServer:
          $ref: '#/components/schemas/custom-authorization-server'
    my-resource-connection:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      discriminator:
        propertyName: connectionType
        mapping:
          IDENTITY_ASSERTION_CUSTOM_AS: '#/components/schemas/identity-assertion-custom-as-connection'
          STS_VAULT_SECRET: '#/components/schemas/sts-vault-secret-connection'
          STS_SERVICE_ACCOUNT: '#/components/schemas/sts-service-account-connection'
          STS_ACCESS_TOKEN: '#/components/schemas/sts-access-token-connection'
          IDENTITY_ASSERTION_A2A_SERVER: '#/components/schemas/identity-assertion-a2a-server-connection'
      oneOf:
        - $ref: '#/components/schemas/identity-assertion-custom-as-connection'
        - $ref: '#/components/schemas/sts-vault-secret-connection'
        - $ref: '#/components/schemas/sts-service-account-connection'
        - $ref: '#/components/schemas/sts-access-token-connection'
        - $ref: '#/components/schemas/identity-assertion-a2a-server-connection'
    my-resource-connections:
      type: object
      required:
        - data
        - _links
      properties:
        data:
          description: All connections the agent has established
          type: array
          maxItems: 200
          items:
            $ref: '#/components/schemas/my-resource-connection'
        _links:
          type: object
          description: Links available for the list of resource connections
          required:
            - self
          properties:
            self:
              $ref: '#/components/schemas/link'
            next:
              $ref: '#/components/schemas/link'
    bulk-review-criteria-type:
      description: Type of criteria for a bulk-review decision
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      enum:
        - GOVERNANCE_ANALYZER
      x-enumDescriptions:
        GOVERNANCE_ANALYZER: Criteria is based on Governance Analyzer's recommendation.
    decision:
      type: string
      description: The decision for a review
      x-okta-ignore-redocly-rules-for-sdk: true
      enum:
        - UNREVIEWED
        - APPROVE
        - REVOKE
    bulk-review-criteria-gov-analyzer-mutable:
      type: object
      description: |
        The criteria for selecting reviews are based on the action recommended by Governance Analyzer.
      required:
        - recommendedActionDecision
      properties:
        recommendedActionDecision:
          $ref: '#/components/schemas/decision'
    bulk-review-submission-criteria-mutable:
      type: object
      description: |
        The criteria for selecting reviews
      required:
        - type
      properties:
        type:
          $ref: '#/components/schemas/bulk-review-criteria-type'
        govAnalyzerCriteria:
          $ref: '#/components/schemas/bulk-review-criteria-gov-analyzer-mutable'
    bulk-review-decision:
      type: string
      description: The decision applied to all reviews matching the bulk-review criteria
      enum:
        - APPROVE
    reviewer-level-type:
      type: string
      description: Identifies the reviewer level of each reviews during access certification. Applicable for multi level campaigns only.
      enum:
        - FIRST
        - SECOND
    bulk-review-submission-mutable:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        The request body for submitting bulk decisions for a campaign review.
        It holds the criteria for which campaign review items to target and the decision to apply to those items.
        The reviewer level and note are optional fields that can provide additional context for the bulk decision.
        The reviewer level comes into picture, when multi level campaign is in the picture.
      required:
        - criteria
        - reviewDecision
      properties:
        criteria:
          $ref: '#/components/schemas/bulk-review-submission-criteria-mutable'
        reviewDecision:
          $ref: '#/components/schemas/bulk-review-decision'
        reviewerLevel:
          $ref: '#/components/schemas/reviewer-level-type'
        notes:
          type: string
          description: The reviewer's note to include with the bulk decision. This note is added to all reviews that match the bulk-review criteria.
          minLength: 1
          maxLength: 300
    bulk-review-decision-status-type:
      description: The bulk-review submission request status
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      enum:
        - ACCEPTED
        - COMPLETED
        - ERROR
        - IN_PROGRESS
      x-enumDescriptions:
        ACCEPTED: Bulk-review decision submission has been accepted and is pending processing
        IN_PROGRESS: Bulk-review decision submission is processing
        COMPLETED: Bulk-review decision submission was processed and completed successfully
        ERROR: Bulk-review decision submission ended with errors
    bulk-review-submission-links:
      type: object
      description: Links available for a bulk-review submission
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        bulkReviewDecisionStatus:
          $ref: '#/components/schemas/link'
        reviewRecordsProcessed:
          $ref: '#/components/schemas/link'
    bulk-review-submission-details:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        The details of a bulk review submission resulting from a request
      required:
        - status
        - eligibleReviewRecordCount
        - jobId
      properties:
        status:
          $ref: '#/components/schemas/bulk-review-decision-status-type'
        eligibleReviewRecordCount:
          type: integer
          format: int32
          description: The number of eligible reviews in the submission
        jobId:
          type: string
          description: The `id` of the job
          minLength: 1
          maxLength: 20
        _links:
          $ref: '#/components/schemas/bulk-review-submission-links'
    bulk-review-submission-job-details:
      type: object
      description: |
        The details of a bulk-review submission job resulting from a request
      required:
        - id
        - status
        - eligibleReviewRecordCount
      properties:
        id:
          type: string
          description: The `id` of the job
          minLength: 1
          maxLength: 20
        status:
          $ref: '#/components/schemas/bulk-review-decision-status-type'
        errors:
          type: array
          description: A list of errors encountered while processing the bulk review submission job
          items:
            $ref: '#/components/schemas/error'
          minLength: 0
          maxLength: 50
        eligibleReviewRecordCount:
          type: integer
          format: int32
          description: The number of eligible reviews in the submission
        _links:
          $ref: '#/components/schemas/bulk-review-submission-links'
    reviewer-entitlement:
      type: object
      description: Entitlement information
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: The entitlement `id`
          minLength: 1
          maxLength: 20
        name:
          type: string
          description: The entitlement display name
          minLength: 1
          maxLength: 255
        externalValue:
          type: string
          description: The value of the entitlement property
          minLength: 1
          maxLength: 255
    reviewer-entitlement-value:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Entitlement value. Only applicable if `resourceType = APPLICATION` and Entitlement Management is enabled.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: The entitlement value id
          minLength: 1
          maxLength: 20
        name:
          type: string
          description: The entitlement value display name
          minLength: 1
          maxLength: 255
        externalValue:
          type: string
          description: The value of the entitlement property value
          minLength: 1
          maxLength: 2000
        entitlement:
          $ref: '#/components/schemas/reviewer-entitlement'
    reviewer-entitlement-bundle:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Entitlement bundle. Only applicable if `resourceType = APPLICATION` and Entitlement Management is enabled.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: The entitlement bundle id
          minLength: 1
          maxLength: 20
        name:
          type: string
          description: The entitlement bundle name
          minLength: 1
          maxLength: 255
    remediation-status:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      enum:
        - NONE
        - OPEN
        - ERROR
        - SUCCESS
        - MANUAL
    reviewers-reviewer-type:
      type: string
      description: Identifies the kind of reviewer for Access Certification.
      enum:
        - USER
        - GROUP
        - RESOURCE_OWNER
    group-type:
      description: The type of group. It is either 'GROUP' or 'RESOURCE_OWNER'.
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      enum:
        - GROUP
        - RESOURCE_OWNER
    reviewer-group-profile:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        Applicable only when `reviewerType` is `GROUP` or `RESOURCE_OWNER`. For all other reviewer type, this property can be ignored.
        It represents the group in charge of reviews.
      required:
        - name
        - groupId
        - groupType
      properties:
        name:
          type: string
          minLength: 0
          maxLength: 255
        groupId:
          type: string
          minLength: 1
          maxLength: 36
        groupType:
          $ref: '#/components/schemas/group-type'
    review-links:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Links available on a single review representation
      required:
        - self
        - reassignReview
      properties:
        self:
          $ref: '#/components/schemas/link'
        reassignReview:
          $ref: '#/components/schemas/link'
    review-entitlement:
      type: object
      description: Entitlement and it's entitlement values.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: The entitlement id
          minLength: 1
          maxLength: 20
        name:
          type: string
          description: The entitlement name
          minLength: 1
          maxLength: 255
        values:
          type: array
          description: Collection of entitlement values.
          maxItems: 1000
          items:
            $ref: '#/components/schemas/reviewer-entitlement-value'
    risk-rule-criteria:
      type: object
      properties:
        name:
          type: string
          nullable: false
          description: The name of the risk rule criteria
        operation:
          type: string
          nullable: false
          description: Operation to be performed on the criteria value
          enum:
            - CONTAINS_ONE
            - CONTAINS_ALL
        value:
          type: object
          properties:
            type:
              type: string
              nullable: false
              description: The type of the criteria value
              enum:
                - ENTITLEMENTS
            value:
              type: array
              description: Collection of entitlements with associated values
              nullable: false
              items:
                $ref: '#/components/schemas/review-entitlement'
    risk-rule-conflicts:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      properties:
        id:
          description: Unique identifier of the risk rule
          type: string
          minLength: 1
        type:
          type: string
          nullable: false
          description: The type of the rule
          enum:
            - SEPARATION_OF_DUTIES
        conflictCriteria:
          type: object
          properties:
            and:
              type: array
              items:
                $ref: '#/components/schemas/risk-rule-criteria'
              minItems: 2
              maxItems: 2
    reviewer-service-account:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Service account information for reviewer
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: The service account ID
          minLength: 1
          maxLength: 36
        name:
          type: string
          description: The service account name
          minLength: 1
          maxLength: 255
    review-minimal-read-only-fields:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: |
        Properties contained by default in sparse representation.
      required:
        - campaignId
        - resourceId
        - decision
        - remediationStatus
        - principalProfile
        - reviewerType
        - _links
      properties:
        campaignId:
          type: string
          minLength: 1
          maxLength: 20
        resourceId:
          type: string
          minLength: 1
          maxLength: 36
        entitlementValue:
          $ref: '#/components/schemas/reviewer-entitlement-value'
        entitlementBundle:
          $ref: '#/components/schemas/reviewer-entitlement-bundle'
        decision:
          $ref: '#/components/schemas/decision'
        decided:
          type: string
          format: date-time
        remediationStatus:
          $ref: '#/components/schemas/remediation-status'
        principalProfile:
          $ref: '#/components/schemas/principal-profile-enriched'
        reviewerProfile:
          $ref: '#/components/schemas/principal-profile-enriched'
        reviewerType:
          description: Specifies the type of the reviewers. Reviewers can be `USER`, `GROUP`, `RESOURCE_OWNER`
          $ref: '#/components/schemas/reviewers-reviewer-type'
        reviewerGroupProfile:
          $ref: '#/components/schemas/reviewer-group-profile'
        currentReviewerLevel:
          description: The current reviewer level of each review. Applicable only for multi level campaigns only.
          $ref: '#/components/schemas/reviewer-level-type'
        _links:
          $ref: '#/components/schemas/review-links'
        riskRuleConflicts:
          type: array
          description: List of risk rule conflicts caused by this entitlement value. Only applies to review item that has entitlement value.
          nullable: true
          items:
            $ref: '#/components/schemas/risk-rule-conflicts'
        delegatorProfile:
          description: Specifies delegator profile if this review was delegated by original reviewer due to their governence delegate settings
          $ref: '#/components/schemas/principal-profile-enriched'
        delegated:
          description: Specifies if this review was delegated by the original reviewer based on their governance delegate settings
          type: boolean
        appServiceAccount:
          $ref: '#/components/schemas/reviewer-service-account'
        oktaServiceAccount:
          $ref: '#/components/schemas/reviewer-service-account'
    review-sparse:
      description: Sparse representation of a Review resource
      x-okta-ignore-redocly-rules-for-sdk: true
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - $ref: '#/components/schemas/review-minimal-read-only-fields'
      required:
        - _links
      properties:
        _links:
          allOf:
            - $ref: '#/components/schemas/review-links'
    review-list-links:
      type: object
      description: Links available in review list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
    review-list:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - data
        - _links
      properties:
        data:
          description: |
            Sparse representation of reviews
          type: array
          items:
            $ref: '#/components/schemas/review-sparse'
        _links:
          $ref: '#/components/schemas/review-list-links'
  headers:
    link:
      required: false
      description: |-
        A link to `self` and `next`.
        > **Note:** `next` is only present if there's another page of results.
      schema:
        type: string
    rate-limit-limit:
      required: true
      description: The rate-limit ceiling for the current request
      schema:
        type: integer
        minimum: 1
        example: 60
    rate-limit-remaining:
      required: true
      description: The number of requests left for the current rate-limit window
      schema:
        type: integer
        minimum: 0
        example: 60
    rate-limit-reset:
      required: true
      description: The time when the rate limit resets, specified in UTC epoch time (in seconds)
      schema:
        type: integer
        minimum: 0
        example: 1609459200
    self-link:
      required: false
      description: |-
        A link to `self`, which is the URL for the current request.
        This is used for pagination and is included in the response when the request returns a list of items. The value of this header is a URL that points to the current request, and it includes any query parameters that were used in the request. Set the `rel` parameter to `self` to indicate that this is a link to the current request.
      schema:
        type: string
  responses:
    rcar-entries-list-success-v2:
      description: List of all entries in the resource catalog
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/rcar-entries-list-v2'
    rcar-entries-list-bad-request:
      description: An invalid list request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    authentication-error-response:
      description: Authentication fails error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    authorization-error-response:
      description: Authorization fails error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000004
            errorSummary: You don't have permission to perform the requested action.
            errorLink: E0000004
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    resource-not-found-response:
      description: The requested resource wasn't found error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000007
            errorSummary: Resource not found exception
            errorLink: E0000007
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    rate-limit-exceeded-response:
      description: The rate limit has been exceeded error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000047
            errorSummary: The API call exceeded the rate limit due to too many requests.
            errorLink: E0000047
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    unexpected-error-response:
      description: Error response when a server fault occurs due to an unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000009
            errorSummary: Internal Server Error
            errorLink: E0000009
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    rcar-entry-get-success:
      description: List of all entries in the resource catalog
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/rcar-entry-get'
    list-bad-request:
      description: An invalid list request error response
      content:
        application/json:
          schema:
            x-okta-ignore-redocly-rules-for-sdk: true
            $ref: '#/components/schemas/error'
    my-request-create-success-response:
      description: Response when create request is accepted
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-full'
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
    my-request-create-bad-request-response:
      description: When request fails as bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-get-success:
      description: A successful get request response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-full'
    request-update-success:
      description: A successful update request response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-full'
    my-request-update-failed:
      description: When the update failed because the request status is terminal, or the request body is invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    my-request-fields-get-success:
      description: Get requester fields for an entry
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/catalog-entry-request-fields'
    entry-users-list-success:
      description: List of all requesters who may be able to request the entry
      headers:
        Link:
          $ref: '#/components/headers/self-link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/entry-users-list'
    my-tasks-list-success:
      description: A successful my tasks list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-list'
    my-tasks-list-bad-request:
      description: An invalid request to list my tasks
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    my-task-get-success:
      description: A successful get my task response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-full'
    my-task-resolve-success:
      description: A successful resolve my task response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-full'
    task-resolve-failed:
      description: When the task resolution fails due to task already being closed or bad request body
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    security-access-reviews-get-success:
      description: A successful security access reviews get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-reviews'
    security-access-reviews-stats-get-success:
      description: A successful security access reviews stats get response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-reviews-stats'
    security-access-review-get-success:
      description: A successful security access review get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review'
    security-access-review-generate-summary-post-success:
      description: A successful security access review summary response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ai-message'
    security-access-review-actions-get-success:
      description: A successful security access review actions get response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review-actions'
    security-access-review-principal-get-success:
      description: A successful security access review principal details get response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review-principal'
    security-access-review-access-items-get-success:
      description: A successful security access review access items get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review-access-items'
    security-access-review-sub-access-items-get-success:
      description: A successful security access review access items get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review-sub-access-items'
    security-access-review-anomalies-get-success:
      description: A successful security access review anomalies get response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review-anomalies'
    security-access-review-history-get-success:
      description: A successful security access review history get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/security-access-review-history-items'
    security-access-review-generate-summary-stream-post-success:
      description: A successful security access review summary response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        text/event-stream:
          schema:
            $ref: '#/components/schemas/ai-summary-stream-sse-message'
          examples:
            get-ai-summary-sse-delta-success:
              $ref: '#/components/examples/get-ai-summary-sse-delta-success'
            get-ai-summary-sse-end-success:
              $ref: '#/components/examples/get-ai-summary-sse-end-success'
            get-ai-summary-sse-error:
              $ref: '#/components/examples/get-ai-summary-sse-error'
    my-settings-get-success:
      description: A successful my settings response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/my-settings-get'
    my-settings-patch-success:
      description: A successful my settings response
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/my-settings'
    settings-patch-bad-request-response:
      description: When governance settings fails as bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    delegates-users-get-success:
      description: Lists my eligible delegate users
      headers:
        Link:
          $ref: '#/components/headers/self-link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/delegate-users-list'
    my-resource-connections-list:
      description: All connections the agent has established
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/my-resource-connections'
    campaign-bulk-review-decision-submission-accepted-response:
      description: Accepted response for a bulk-review submission
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/bulk-review-submission-details'
    bulk-review-submission-conflict-response:
      description: |
        Another bulk-review submission request is being processed for the same reviews. 
        Wait for the current bulk review submission request to finish processing before submitting another request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000170
            errorSummary: Another bulk review submission request is currently being processed for the same reviews.
            errorLink: E0000170
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    campaign-bulk-review-decision-submission-job-status-response:
      description: Response for the bulk-review submission job
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/bulk-review-submission-job-details'
    review-list-success:
      description: A successful review list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/review-list'