governance-production-requests-admin-v2-reference-oneOfInheritance-noExamples.yaml

openapi: 3.0.3
info:
  title: Access Requests - V2
  description: Allows customers to easily access the Okta API
  termsOfService: https://developer.okta.com/terms/
  contact:
    name: Okta Developer Team
    url: https://developer.okta.com/
    email: devex-public@okta.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  version: 3.2.0
  x-logo:
    url: logo.svg
    backgroundColor: transparent
    altText: Okta Developer
servers:
  - url: https://{yourOktaDomain}
    variables:
      yourOktaDomain:
        default: subdomain.okta.com
        description: The domain of your organization. This can be a provided subdomain of an official okta domain (okta.com, oktapreview.com, etc) or one of your configured custom domains.
tags:
  - name: Request Conditions
    description: |
      Request conditions define what resources and access levels requesters can request from their resource catalog.

      Each request condition defines the following:

      - Who can request access
      - What resource and access level they can request
      - How long the access should be granted for
      - What request sequence to use for approval
      - A priority to control what condition should take precedence when a requester matches against multiple request conditions

      See [Access request conditions](https://help.okta.com/oie/en-us/content/topics/identity-governance/access-requests/rcar-conditions.htm) for more information on Access request conditions and Identity Governance.
    x-okta-lifecycle:
      lifecycle: GA
  - name: Request Sequences
    description: |-
      The Request Sequences API allows you to retrieve request sequence data necessary for managing request conditions. Request sequences are created in the Okta Access Requets app and define a series of steps (questions, approval tasks, and custom tasks) that must be completed for a requester to gain access to the resource.

      When you create a request condition, you must reference a request sequence. You can reuse request sequences with many request conditions.

      See [Configure an approval sequence](https://help.okta.com/okta_help.htm?type=oie&id=csh-rcar-approval-sequences) in the product documentation.

      > **Note:** Each org has a maximum of 250 request sequences.
    x-okta-lifecycle:
      lifecycle: GA
  - name: Request Settings
    description: |
      Request settings are useful for managing your org's access requests.

      Request settings can be read and updated at the org and resource level.

      The information provided by request settings may be used to determine if another operation, such as creating a request condition, is valid for a particular organization and resource.

      See [Access requests - Get started](https://help.okta.com/oie/en-us/content/topics/identity-governance/access-requests/ar-get-started.htm) for information on setting up access requests for your organization.
    x-okta-lifecycle:
      lifecycle: GA
  - name: Requests
    description: |
      Okta Access Requests automate the process of requesting access to resources managed by access request conditions.

      Access request conditions define the resource to access, who can request access, length of access, and the approval sequence. For more information, see [Access request conditions](https://help.okta.com/okta_help.htm?type=oie&id=csh-rcar-conditions). See also the following APIs: [Request Conditions](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Request-Conditions/#tag/Request-Conditions) and [Request Sequences](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Request-Sequences/#tag/Request-Sequences).

      Manage the access request process directly with the Requests API.

      > **Notes:**
      > * Each org has a maximum of 10,000 open or pending requests.
      > * Each org has a maximum of 50,000 resolved requests that are accessible within an app.

      See [Access Requests](https://help.okta.com/oie/en-us/content/topics/identity-governance/access-requests/ar-overview.htm) for more information on Access Requests and Identity Governance.
    x-okta-lifecycle:
      lifecycle: GA
  - name: Catalogs
    description: |
      A catalog entry represents a requestable resource for [Access Requests](https://help.okta.com/okta_help.htm?type=oie&id=ext-ar). Each requestable app or collection has a top-level entry in the catalog. These are known as parent catalog entries. Associated requestable entitlements and groups also have an entry in the catalog, known as child entries. For example, a top-level entry for Figma might have two child entries, one for requesting read-only access to Figma and one for requesting edit access.

       The `parent` property in the catalog entry object shows the relationship between child and parent. The child entry's `parent` property references their respective parent entry identifier. The parent entry's `parent` property has no value. See the [CATALOG-ENTRY](https://developer.okta.com/docs/api/iga/#CATALOG-ENTRY) diagram in the [Relationships](https://developer.okta.com/docs/api/iga/#relationships) model.

      Use the Catalogs API to request for catalog entries as a principal with admin privileges. You can search for a list of catalog entries based on the entry parent-child relationship using the `filter` query parameter.
    x-okta-lifecycle:
      lifecycle: GA
  - name: Tasks
    description: |
      <x-lifecycle class="beta"></x-lifecycle>

      The Tasks API allows you to manage tasks from access requests made through access request conditions in your Okta Identity Governance (OIG) org.
    x-okta-lifecycle:
      lifecycle: BETA
externalDocs:
  description: Find more info here
  url: https://developer.okta.com/docs/reference/core-okta-api/#design-principles
paths:
  /governance/api/v2/resources/{resourceId}/request-conditions:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      operationId: listResourceRequestConditionsV2
      summary: List all resource request conditions
      description: |
        Lists request conditions for a resource specified by `resourceId`
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.read
      responses:
        '200':
          $ref: '#/components/responses/resource-request-conditions-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
      operationId: createResourceRequestConditionV2
      summary: Create a request condition
      description: |
        Creates a request condition to govern how a resource can be requested.

        Specify the following to create a request condition:

        - What resource can be requested? (`resourceId` in path)
        - What access scope can be requested? (`accessScopeSettings` in request body)
        - Who can request access? (`requesterSettings` in request body)
        - What is the approval process? (`approvalSequenceId` in request body)

        Any `requesterSettings` or `accessScopeSettings` parameters in the request body are validated against the resource's current request settings.
        After a request condition is created successfully, its `status` is set to `INACTIVE`.

        > **Note:** You can define a maximum of 100 conditions for each resource (app).
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/request-condition-creatable'
      responses:
        '201':
          $ref: '#/components/responses/request-condition-create-success'
        '400':
          $ref: '#/components/responses/request-condition-create-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/resources/{resourceId}/request-conditions/{requestConditionId}:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      operationId: getResourceRequestConditionV2
      summary: Retrieve a resource request condition
      description: Retrieves a resource request condition
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
        - $ref: '#/components/parameters/request-condition-id'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.read
      responses:
        '200':
          $ref: '#/components/responses/resource-request-condition-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    delete:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      operationId: deleteResourceRequestConditionV2
      summary: Delete a request condition
      description: Deletes a request condition
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
        - $ref: '#/components/parameters/request-condition-id'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      responses:
        '204':
          $ref: '#/components/responses/request-condition-delete-success-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    patch:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      operationId: updateResourceRequestConditionV2
      summary: Update the request condition
      description: |
        Updates the request condition

        Conditions can be updated while their status is ACTIVE, INACTIVE or INVALID.

        An update will be rejected if it would lead to the condition entering an INVALID status.

        While an update request body may not contain `status`, a successful update request condition operation will always result in the condition entering ACTIVE or INACTIVE status.

        Any `requesterSettings`, `accessScopeSettings` in the update request body will be validated against the resource's current request settings.
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
        - $ref: '#/components/parameters/request-condition-id'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/request-condition-patchable'
      responses:
        '200':
          $ref: '#/components/responses/request-condition-patch-success-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/resources/{resourceId}/request-conditions/{requestConditionId}/activate:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      operationId: activateResourceRequestConditionV2
      summary: Activate the request condition
      description: |
        Activates the request condition

        Conditions can be activated while their status is INACTIVE.

        Activating a condition allows it to provide catalog entries to endusers.
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
        - $ref: '#/components/parameters/request-condition-id'
      security:
        - OAuth2:
            - okta.accessRequests.condition.manage
      responses:
        '200':
          $ref: '#/components/responses/request-condition-activate-success-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '409':
          $ref: '#/components/responses/request-condition-activate-conflict-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/resources/{resourceId}/request-conditions/{requestConditionId}/deactivate:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Conditions
      operationId: deactivateResourceRequestConditionV2
      summary: Deactivate the request condition
      description: |
        Deactivates the request condition

        Conditions can be deactivated while their status is ACTIVE.

        Deactivating a condition prevents the condition from providing catalog entries to endusers.
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
        - $ref: '#/components/parameters/request-condition-id'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      responses:
        '200':
          $ref: '#/components/responses/request-condition-deactivate-success-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '409':
          $ref: '#/components/responses/request-condition-deactivate-conflict-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/resources/{resourceId}/request-settings:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Settings
      operationId: getRequestSettingsV2
      summary: Retrieve the resource request settings
      description: |-
        Retrieves the request settings for a resource

        Resource request settings are useful for determining what kind of request conditions
        can be created or updated for a resource.

        For example:

        - `validAccessScopeSettings` indicates what `accessScopeSettings` may be passed in a `Create request condition` or `Update request condition` operation.
        - `validRequesterSettings` indicates what `requesterSettings` may be passed in a `Create request condition` or `Update request condition` operation.
        - `validAccessDurationSettings` indicates the maximum duration the user will have access to the resources.
        - `validRiskSettings` indicates what `riskSettings` may be passed. Currently, it can be at the resource request settings.
        - `validRequestOnBehalfOfSettings` indicates the available request on behalf of settings for the resource. 
        - `requestOnBehalfOfSettings` if they exist, they indicate the settings specified for request on behalf of.
        - `riskSettings` if they exist, they indicate the risk settings specified for the resource.

        See response examples for various possible request setting scenarios.
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.read
      responses:
        '200':
          $ref: '#/components/responses/request-settings-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    patch:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Settings
      operationId: updateResourceRequestSettingsV2
      summary: Update the resource request settings
      description: |
        Updates the resource request settings
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/resource-request-settings-patchable'
      responses:
        '200':
          $ref: '#/components/responses/resource-request-settings-patch-success'
        '400':
          $ref: '#/components/responses/resource-request-settings-patch-bad-request-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/request-settings:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Settings
      operationId: getOrgRequestSettingsV2
      summary: Retrieve the org request settings
      description: |
        Retrieves the request settings for the org.

        Org request settings indicate:
        - If the Access Requests app has been provisioned
        - If a customer has triggered Access Requests app provisioning in their org
        - The request experiences that are supported
        - If the provisioning for the Access Requests app was triggered a while ago
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.read
      responses:
        '200':
          $ref: '#/components/responses/org-request-settings-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    patch:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Settings
      operationId: updateOrgRequestSettingsV2
      summary: Update the org request settings
      description: |
        Updates the request settings for the org
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/org-request-settings-patchable'
      responses:
        '200':
          $ref: '#/components/responses/org-request-settings-patch-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/resources/{resourceId}/request-sequences:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Sequences
      operationId: listResourceRequestSequencesV2
      summary: List all resource request sequences
      description: Lists access request sequences for a resource in your org
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.read
      responses:
        '200':
          $ref: '#/components/responses/request-sequences-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/resources/{resourceId}/request-sequences/{sequenceId}:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Sequences
      parameters:
        - $ref: '#/components/parameters/resource-id-orn-or-okta'
        - $ref: '#/components/parameters/sequence-id-parameter'
      operationId: getResourceRequestSequenceV2
      summary: Retrieve a resource request sequence
      description: Retrieves a access request sequence referenced by the specified resource
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.read
      responses:
        '200':
          $ref: '#/components/responses/request-sequence-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/request-sequences/{sequenceId}:
    delete:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Request Sequences
      operationId: deleteRequestSequenceV2
      summary: Delete a request sequence
      description: Deletes the access request sequence given its `id`
      parameters:
        - $ref: '#/components/parameters/sequence-id-parameter'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.condition.manage
      responses:
        '204':
          $ref: '#/components/responses/request-sequence-delete-success-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/requests:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Requests
      operationId: listAllRequestsV2
      summary: List all requests
      description: |
        Lists the requests made by users in your org. Use this operation to retrieve all access requests managed by access request conditions.

        Use the `filter` parameter to narrow down the results. This SCIM query string supports the following attributes:
        - `status`: The status of the request. Possible values: `SUBMITTED`, `REJECTED`, `PENDING`, `APPROVED`, `DENIED`, `CANCELED`, `EXPIRED`
        - `lastUpdated`: The last updated time of the request
        - `requestedFor`: The Okta user ID for whom the request is made
        - `resourceId`: The Okta resource ID for which the request is made
        - `resourceType`: The type of resource for which the request is made. Possible values: `APPLICATION`
        - `accessScopeId`: The ID of the resource access scope for which the request is made
        - `accessScopeType`: The type of the resource access scope for which the request is made. Possible values: `ENTITLEMENT_BUNDLE`, `GROUP`, `APPLICATION`

        Pagination parameters are accepted, and standard link headers are in the response.
      parameters:
        - $ref: '#/components/parameters/request-list-filter'
        - $ref: '#/components/parameters/request-list-after'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/request-list-order-by'
      security:
        - OAuth2:
            - okta.accessRequests.request.read
      responses:
        '200':
          $ref: '#/components/responses/requests-list-success'
        '400':
          $ref: '#/components/responses/requests-list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      operationId: createRequestV2
      tags:
        - Requests
      summary: Create a request
      description: |
        Creates a resource access request for a given user.

        Use this operation to create access requests managed by access request conditions.

        If `requestedBy` and `requestedFor` aren't the same, then you must also enable the [`requestOnBehalfOfSettings`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Request-Settings/#tag/Request-Settings/operation/updateResourceRequestSettingsV2!path=requestOnBehalfOfSettings&t=request) parameter in the access request settings. See [Update the resource request settings](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Request-Settings/#tag/Request-Settings/operation/updateResourceRequestSettingsV2).

        Include the following information in the payload:

        - The Okta user ID for the user who requires access. Add the user ID in the `requestedFor.externalId` parameter.
        - The catalog entry ID of the resource required by the user. Add the catalog ID in the `requested.entryId` parameter.
        - If the request conditions include requester input fields, add field information in the `requesterFieldValues` array. See [Retrieve the request fields](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Catalogs/#tag/Catalogs/operation/getCatalogEntryRequestFieldsV2).
        - Optional: The user ID of the person submitting the request. By default, this value is the admin user ID requesting this operation and doesn't need to be provided. However, to add a different Okta user ID for the request, include the `requestedBy.externalId` parameter in the request body.
      requestBody:
        required: true
        description: The writable attributes of a request
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/request-creatable'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.request.manage
      responses:
        '202':
          $ref: '#/components/responses/request-create-success-response'
        '400':
          $ref: '#/components/responses/request-create-bad-request-response'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/request-create-forbidden-response'
        '409':
          $ref: '#/components/responses/request-create-conflict-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/requests/{requestId}:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Requests
      operationId: getRequestV2
      summary: Retrieve a request
      description: |
        Retrieves the full representation of a specific request

        You can use this endpoint to retrieve access requests managed by access request conditions.

        More information is returned than the abbreviated representation in a List requests operation.
      parameters:
        - $ref: '#/components/parameters/rcar-request-id-parameter'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.request.read
      responses:
        '200':
          $ref: '#/components/responses/request-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/requests/{requestId}/messages:
    post:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Requests
      operationId: createRequestMessageV2
      summary: Create a request message
      description: |
        Creates a message to add context to the Access requests using request conditions and sequences. The message appears in the **Requester** section of the Access Requests console, and the message is authored by the admin user ID calling the endpoint.
      parameters:
        - $ref: '#/components/parameters/rcar-request-id-parameter'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.request.manage
      requestBody:
        required: true
        description: The writable attributes of a request message
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/request-message-creatable'
      responses:
        '201':
          description: A successful create request message response
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/catalogs/default/entries:
    get:
      x-okta-lifecycle:
        lifecycle: EA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Catalogs
      operationId: listAllDefaultEntriesV2
      parameters:
        - $ref: '#/components/parameters/rcar-entries-list-filter-v2'
        - $ref: '#/components/parameters/rcar-entries-list-after'
        - $ref: '#/components/parameters/rcar-entries-list-match'
        - $ref: '#/components/parameters/rcar-entries-list-limit'
      summary: List all entries for the default access request catalog
      description: |-
        Lists entries for the default access request catalog based on a required `filter` query parameter.

        The following are request examples with a filter expression. In each example, the filter expression includes the mandatory `parent` property.

        1. Lists at most 20 parent (top-level) entries
            ```
            /governance/api/v2/catalogs/default/entries?filter=not(parent%20pr)&limit=20
            ```
        1. Lists the next 20 results of parent entries after a specific cursor
            ```
            /governance/api/v2/catalogs/default/entries?filter=not(parent%20pr)&limit=20&after=cen33e47frfMB93gQ8g6
            ```
        1. Lists at most 8 parent entries with a fuzzy match for "figma"
            ```
            /governance/api/v2/catalogs/default/entries?filter=not(parent%20pr)&match=figma&limit=8
            ```
        1. Lists at most 8 child entries with a specific parent
            ```
            /governance/api/v2/catalogs/default/entries?filter=parent%20eq%20%22cen385AlcdqGaY8HE0g2%22&limit=8
            ```
        1. Lists at most 8 child entries that have "edit" in the name and have a specific parent
            ```
            /governance/api/v2/catalogs/default/entries?filter=parent%20eq%20%22cen385AlcdqGaY8HE0g2%22&match=edit&limit=8
            ```
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/catalog-entries-list-success-v2'
        '400':
          $ref: '#/components/responses/rcar-entries-list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/catalogs/default/entries/{entryId}:
    get:
      x-okta-lifecycle:
        lifecycle: EA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Catalogs
      operationId: getCatalogEntryV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
      summary: Retrieve a catalog entry
      description: Retrieves a catalog entry
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/rcar-entry-get-success'
        '400':
          $ref: '#/components/responses/list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/catalogs/default/user/{userId}/entries:
    get:
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Catalogs
      operationId: listAllDefaultUserEntriesV2
      parameters:
        - $ref: '#/components/parameters/user-id'
        - $ref: '#/components/parameters/rcar-entries-list-filter-v2'
        - $ref: '#/components/parameters/rcar-entries-list-after'
        - $ref: '#/components/parameters/rcar-entries-list-match'
        - $ref: '#/components/parameters/rcar-entries-list-limit'
      summary: List all access request catalog entries for a user
      description: |-
        Lists access request catalog entries for a user based on a filter (the `filter` query parameter is required)

        The following are request examples with query parameters:

        1. Lists at most 20 parent (top-level) entries
            ```
            /governance/api/v2/catalogs/default/user/{userId}/entries?filter=not(parent%20pr)&limit=20
            ```
        1. Lists the next 20 results of parent entries after a specific cursor
            ```
            /governance/api/v2/catalogs/default/user/{userId}/entries?filter=not(parent%20pr)&limit=20&after=cen33e47frfMB93gQ8g6
            ```
        1. Lists at most 8 parent entries with a string match for "figma"
            ```
            /governance/api/v2/catalogs/default/user/{userId}/entries?filter=not(parent%20pr)&match=figma&limit=8
            ```
        1. Lists at most 8 child entries with a specific parent
            ```
            /governance/api/v2/catalogs/default/user/{userId}/entries?filter=parent%20eq%20%22cen385AlcdqGaY8HE0g2%22&limit=8
            ```
        1. Lists at most 8 child entries that have "edit" in the name and have a specific parent
            ```
            /governance/api/v2/catalogs/default/user/{userId}/entries?filter=parent%20eq%20%22cen385AlcdqGaY8HE0g2%22&match=edit&limit=8
            ```
      security:
        - OAuth2:
            - okta.accessRequests.catalog.read
      responses:
        '200':
          $ref: '#/components/responses/catalog-entries-list-success-v2'
        '400':
          $ref: '#/components/responses/rcar-entries-list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/catalogs/default/entries/{entryId}/users/{userId}/request-fields:
    get:
      x-okta-lifecycle:
        lifecycle: GA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      operationId: getCatalogEntryRequestFieldsV2
      parameters:
        - $ref: '#/components/parameters/catalog-entry-id'
        - $ref: '#/components/parameters/user-id'
      tags:
        - Catalogs
      summary: Retrieve the request fields
      description: |
        Retrieves request fields for a catalog entry:

        * Request fields are determined by evaluating the entry's associated request conditions for the requester.
        * The highest priority matching condition determines the approval sequence that's used for the requester.
        * If that approval sequence has requester fields, then they are returned as request fields.
        * If the request can lead to any separation of duty conflicts, then the risk assessment (`metadata.riskAssessment`) is present. The risk assessment indicates whether the request submission is allowed or restricted, and includes rules that lead to the possible conflicts. If the request submission is allowed, then the request fields are determined by the associated approval sequence.
      security:
        - OAuth2:
            - okta.accessRequests.request.read
      responses:
        '200':
          $ref: '#/components/responses/request-fields-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
  /governance/api/v2/tasks:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Tasks
      operationId: listAllTasksV2
      summary: List all tasks
      description: |
        Lists all tasks from requests made by users in your org. Use this operation to retrieve all tasks from all access requests managed by access request conditions.

        [Pagination](https://developer.okta.com/docs/api/#pagination) parameters are supported, and standard [link headers](https://developer.okta.com/docs/api/#link-header) are returned in the response.
      parameters:
        - $ref: '#/components/parameters/task-list-filter'
        - $ref: '#/components/parameters/limit'
        - $ref: '#/components/parameters/task-list-after'
        - $ref: '#/components/parameters/task-list-order-by'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.tasks.read
      responses:
        '200':
          $ref: '#/components/responses/tasks-list-success'
        '400':
          $ref: '#/components/responses/tasks-list-bad-request'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/tasks/{taskId}:
    get:
      x-okta-lifecycle:
        lifecycle: BETA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Tasks
      operationId: getTaskV2
      summary: Retrieve a task
      description: |
        Retrieves all the details of a specific task.

        Use this operation to retrieve a task from access requests managed by access request conditions. More information is returned than the shortened task details in the [List all tasks](/iga/openapi/governance-production-requests-admin-v2-reference/tasks/listalltasksv2) operation.
      parameters:
        - $ref: '#/components/parameters/task-id-parameter'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.tasks.read
      responses:
        '200':
          $ref: '#/components/responses/task-get-success'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '403':
          $ref: '#/components/responses/authorization-error-response'
        '404':
          $ref: '#/components/responses/resource-not-found-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
    patch:
      x-okta-lifecycle:
        lifecycle: BETA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Tasks
      operationId: updateTaskV2
      summary: Update a task
      description: |
        Updates a task by performing actions such as assigning the task to a new set of task assignees.

        When task assignment is made via this endpoint, the task will be unassigned from any previous task assignees and assigned to the new set of task assignees.
      parameters:
        - $ref: '#/components/parameters/task-id-parameter'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.tasks.manage
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                assignees:
                  type: array
                  minItems: 1
                  items:
                    $ref: '#/components/schemas/task-assignees'
      responses:
        '200':
          $ref: '#/components/responses/task-update-success'
        '400':
          $ref: '#/components/responses/task-update-failed'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
  /governance/api/v2/tasks/{taskId}/resolve:
    post:
      x-okta-lifecycle:
        lifecycle: BETA
      x-okta-iam-admin-roles:
        - ACCESS_REQUESTS_ADMIN
      tags:
        - Tasks
      operationId: resolveTaskV2
      summary: Resolve a task
      description: |
        Resolves a task for an assignee by providing the value of the task resolution
      parameters:
        - $ref: '#/components/parameters/task-id-parameter'
      security:
        - ApiKey:
            - admin
        - OAuth2:
            - okta.accessRequests.tasks.manage
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                value:
                  type: string
                  description: |
                    The value of the task resolution. Required for `APPROVAL` and `QUESTION` type tasks.
                      * For `APPROVAL` type tasks, the only supported values are `APPROVED` or `DENIED`.
                      * For `QUESTION` type tasks, the value is the answer to the question, and can be any string.
                      * For custom `TODO` type tasks, a value string isn't required.
      responses:
        '200':
          $ref: '#/components/responses/task-resolve-success'
        '400':
          $ref: '#/components/responses/task-resolve-failed'
        '401':
          $ref: '#/components/responses/authentication-error-response'
        '429':
          $ref: '#/components/responses/rate-limit-exceeded-response'
        '500':
          $ref: '#/components/responses/unexpected-error-response'
components:
  securitySchemes:
    OAuth2:
      type: oauth2
      description: 'Pass the `access_token` as the value of the Authorization header: `Authorization: Bearer {access_token}`. See [Make a request](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#make-a-request).'
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          tokenUrl: /oauth2/v1/token
          scopes:
            okta.governance.accessCertifications.manage: Allows the app to create and manage Access Certification Campaigns
            okta.governance.accessCertifications.read: Allows the app to read information about Access Certification Campaigns and Reviews in your Okta org
            okta.governance.accessRequests.manage: Allows the app to create and manage V1 Access Requests, Request Types, and Teams
            okta.governance.accessRequests.read: Allows the app to read information about V1 Access Requests, Request Types, and Teams in your Okta org
            okta.governance.entitlements.read: Allows the app to read information about Entitlements, Entitlement bundles, and Grants
            okta.governance.entitlements.manage: Allows the app to create and manage Entitlements, Entitlement bundles, and Grants
            okta.accessRequests.catalog.read: Allows the app to read information about Access Request Catalogs in your Okta org
            okta.accessRequests.condition.manage: Allows the app to create and manage Conditions for the Access Request Resource Catalog
            okta.accessRequests.condition.read: Allows the app to read information about Conditions for the Access Request Resource Catalog
            okta.accessRequests.request.manage: Allows the app to create and manage V2 Access Requests through the Access Request Resource Catalog
            okta.accessRequests.request.read: Allows the app to read information about V2 Access Requests created through the Access Requests Resource Catalog
            okta.governance.collections.manage: Allows the app to create and manage collections
            okta.governance.collections.read: Allows the app to read information about collections in your Okta org
            okta.governance.operations.read: Allows the app to read information about asynchronous operations in your Okta org
            okta.governance.riskRule.manage: Allows the app to create and manage rules
            okta.governance.riskRule.read: Allows the app to read information about rules in your Okta org
            okta.governance.resourceOwner.manage: Allows the app to create and manage resource owners
            okta.governance.resourceOwner.read: Allows the app to read information about resource owners in your Okta org
            okta.governance.labels.manage: Allows the user to create and manage labels
            okta.governance.labels.read: Allows the user to read information about labels in your Okta org
            okta.governance.securityAccessReviews.admin.manage: Allows the admin app to create and manage security access reviews
            okta.governance.securityAccessReviews.admin.read: Allows the admin app to read information about security access reviews
            okta.governance.securityAccessReviews.endUser.manage: Allows the end-user app to create and manage security access reviews
            okta.governance.securityAccessReviews.endUser.read: Allows the end-user app to read information about security access reviews
            okta.governance.principalSettings.manage: Allows the app to create and manage governance settings for any user in your Okta org
            okta.governance.principalSettings.read: Allows the app to read information about governance settings for any user in your Okta org
            okta.governance.settings.manage: Allows the app to create and manage governance settings for your Okta org
            okta.governance.settings.read: Allows the app to read information about governance settings for your Okta org
            okta.governance.delegates.read: Allows the app to read information about delegates in your Okta org
            okta.governance.reviewer.read: Allows the end user to read information about access certification reviews assigned to them
            okta.governance.reviewer.manage: Allows the end user to manage access certification reviews assigned to them
            okta.accessRequests.tasks.manage: Allows the user to manage tasks for access requests in your Okta org
            okta.accessRequests.tasks.read: Allows the user to read information about tasks for access requests in your Okta org
    ApiKey:
      type: apiKey
      name: Authorization
      in: header
      description: 'Pass the API token as the Authorization header value prefixed with SSWS: `Authorization: SSWS {API Token}`.'
  schemas:
    scim-filter:
      type: string
      format: scim-filter
    writable-standard-properties-request-condition:
      type: object
      properties:
        name:
          type: string
          nullable: false
          description: Writable unique key on create. Modifiable on update.
          maxLength: 255
          minLength: 1
        description:
          type: string
          nullable: false
          description: Human readable description
          maxLength: 2000
          minLength: 1
    created-by:
      description: The `id` of the Okta user who created the resource
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      readOnly: true
      minLength: 1
      maxLength: 20
      format: okta-user-id
    created:
      description: The ISO 8601 formatted date and time when the resource was created
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      format: date-time
      readOnly: true
    last-updated:
      description: The ISO 8601 formatted date and time when the object was last updated
      type: string
      format: date-time
      readOnly: true
    last-updated-by:
      description: The `id` of the Okta user who last updated the object
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      readOnly: true
      minLength: 1
      maxLength: 20
      format: okta-user-id
    link:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A link to a related RESTful resource
      required:
        - href
      properties:
        name:
          type: string
          description: Link name
        rel:
          type: string
          description: Link relation
        href:
          type: string
          minLength: 1
          description: Link URI
        type:
          type: string
          description: The media type of the link. If omitted, it's implicitly `application/json`.
        method:
          type: string
          deprecated: true
        templated:
          type: boolean
          description: Indicates whether the link object's `href` property is a URI template
        hints:
          type: object
          description: Link hints
          additionalProperties:
            type: array
            items:
              type: string
        title:
          type: string
          description: Link title or label
    read-only-standard-properties:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - id
        - createdBy
        - created
        - lastUpdated
        - lastUpdatedBy
      properties:
        id:
          description: Unique identifier for the object
          type: string
          minLength: 1
        createdBy:
          $ref: '#/components/schemas/created-by'
        created:
          $ref: '#/components/schemas/created'
        lastUpdated:
          $ref: '#/components/schemas/last-updated'
        lastUpdatedBy:
          $ref: '#/components/schemas/last-updated-by'
        _links:
          type: object
          description: Links to related resources
          additionalProperties:
            $ref: '#/components/schemas/link'
    request-condition-id:
      type: string
      maxLength: 20
      minLength: 20
      format: request-condition-id
      pattern: rco[0-9a-zA-Z]+
      description: The ID of the request condition
      example: rcord7d69lUIn7u5D1d5
    request-condition-status:
      type: string
      description: status indicating if this condition is active or not. Default status is INACTIVE
      enum:
        - ACTIVE
        - INACTIVE
        - INVALID
        - DELETED
    priority:
      type: integer
      description: The priority of the condition. The smaller the number, the higher the priority. The highest priority is 0. A new condition will default to the lowest priority.
      minimum: 0
    request-condition-links:
      type: object
      description: Links available on a single request condition representation.
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
    request-condition-read-only:
      type: object
      description: |
        Read only properties that are common to sparse and full condition representations.
      properties:
        id:
          $ref: '#/components/schemas/request-condition-id'
        status:
          $ref: '#/components/schemas/request-condition-status'
        priority:
          $ref: '#/components/schemas/priority'
        _links:
          $ref: '#/components/schemas/request-condition-links'
      required:
        - id
        - status
        - priority
        - _links
    requester-settings-type:
      type: string
      enum:
        - EVERYONE
        - GROUPS
        - TEAMS
    RequesterSettings:
      type: object
      description: |
        Sparse representaion of requester settings which define who may submit an access request for the related resource and access scopes.
      properties:
        type:
          $ref: '#/components/schemas/requester-settings-type'
    access-scope-settings-type:
      type: string
      enum:
        - RESOURCE_DEFAULT
        - ENTITLEMENT_BUNDLES
        - GROUPS
    AccessScopeSettings:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/access-scope-settings-type'
    access-duration-duration:
      type: string
      format: duration
      example: PT24H
      description: |-
        The duration set by the admin for access durations. Use the [ISO 8601](https://tc39.es/proposal-temporal/docs/duration.html) duration notation for duration values.
        You can configure up to 365 days (`P365D`) or 52 weeks (`P52W`) as the maximum access duration of a request.
    access-duration-settings-admin-fixed-duration:
      type: object
      description: Settings when the access duration is specified by the admin
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - ADMIN_FIXED_DURATION
        duration:
          $ref: '#/components/schemas/access-duration-duration'
      required:
        - type
        - duration
    access-duration-max-duration:
      type: string
      format: duration
      example: PT24H
      description: |-
        The maximum duration set by the requester for access durations. Use the [ISO 8601](https://tc39.es/proposal-temporal/docs/duration.html) duration notation for duration values.
        You can configure up to 365 days (`P365D`) or 52 weeks (`P52W`) as the maximum access duration of a request.
    access-duration-settings-requester-specified-duration:
      type: object
      description: Setting to specify the maximum duration that an end user can request access for when making a request
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - REQUESTER_SPECIFIED_DURATION
        maximumDuration:
          $ref: '#/components/schemas/access-duration-max-duration'
      required:
        - type
        - maximumDuration
    access-duration-settings-full:
      type: object
      description: |-
        Settings that control who may specify the access duration allowed by this request condition or risk settings, as well as what duration may be requested.

        > **Note:** The resource request settings affect which access duration settings are valid. See the `validAccessDurationSettings` property.
      discriminator:
        propertyName: type
        mapping:
          ADMIN_FIXED_DURATION: '#/components/schemas/access-duration-settings-admin-fixed-duration'
          REQUESTER_SPECIFIED_DURATION: '#/components/schemas/access-duration-settings-requester-specified-duration'
      oneOf:
        - $ref: '#/components/schemas/access-duration-settings-admin-fixed-duration'
        - $ref: '#/components/schemas/access-duration-settings-requester-specified-duration'
    approval-sequence-id-read-only:
      type: string
      description: If an approval sequence was deleted, then conditions referencing it will become invalid and the approvalSequenceId will not be present.
      minLength: 24
      maxLength: 24
    request-condition-sparse:
      type: object
      description: |
        A condition delineates the criteria governing access requests, specifying the requester's identity, the permitted access scope, and the manner in which access can be requested.
      allOf:
        - $ref: '#/components/schemas/writable-standard-properties-request-condition'
        - $ref: '#/components/schemas/read-only-standard-properties'
        - $ref: '#/components/schemas/request-condition-read-only'
      properties:
        requesterSettings:
          $ref: '#/components/schemas/RequesterSettings'
        accessScopeSettings:
          $ref: '#/components/schemas/AccessScopeSettings'
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-full'
        approvalSequenceId:
          $ref: '#/components/schemas/approval-sequence-id-read-only'
      required:
        - id
        - name
        - lastUpdated
        - lastUpdatedBy
        - requesterSettings
        - accessScopeSettings
        - status
        - priority
        - _links
    request-conditions-links:
      type: object
      description: Links available in request condition list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
    request-conditions-list:
      type: object
      required:
        - data
        - _links
      properties:
        data:
          description: All request conditions
          type: array
          items:
            $ref: '#/components/schemas/request-condition-sparse'
        _links:
          $ref: '#/components/schemas/request-conditions-links'
    error-cause:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A specific cause of an error
      required:
        - errorSummary
      properties:
        errorSummary:
          type: string
          description: A more specific summary for the error that contains the error cause
        reason:
          type: string
          description: An enumerated value to represent the reason why the error occurred. This enumeration allows codes to adapt to different conditions in which an error code can occur.
        location:
          type: string
          description: A value that represents the key where the error cause occurred. This is used with `locationType` to give a holistic view of where the error cause occurred. For example, if `locationType` is `body`, `location` is `username`, and the `reason` was `UNIQUE_CONSTRAINT`, you can derive that the username was already taken.
        locationType:
          type: string
          description: A value that represents where the error cause occurred. For example, in the body or header of the request. This value isn't required for cases where the request is correct, but there was another reason why the error occurred (server-side state conflict, rate limit violation, and so on).
        domain:
          type: string
          description: A value that represents the domain of the service in which the error occurs. This value is used to isolate the error cause reason.
    error:
      type: object
      description: An Error object
      required:
        - errorCode
        - errorId
        - errorSummary
      properties:
        errorCode:
          type: string
          description: An error code unique to the error
        errorId:
          type: string
          description: An error identifier useful for troubleshooting an error with support
        errorSummary:
          type: string
          description: An error code description detailing the error
        errorLink:
          type: string
          description: An indicator of where to look to troubleshoot the error
        errorCauses:
          type: array
          description: An optional array of string values that explain possible reasons for the error
          items:
            $ref: '#/components/schemas/error-cause'
    EveryoneRequesterSettings:
      type: object
      description: A requester settings indicating that access request can be submitted by anyone.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - EVERYONE
      required:
        - type
    group-id:
      type: string
      format: okta-group-id
      description: |
        Okta group ID.

        > **Note:** See [List all groups](https://developer.okta.com/docs/api/openapi/okta-management/management/group/listgroups) for more information on how to retrieve group IDs.
      pattern: 00g[0-9a-zA-Z]+
      maxLength: 20
      minLength: 20
    groups-array-full:
      type: array
      description: |
        A request condition may have a zero item array if it is in an INVALID state.
        Otherwise, there will be at least one item.
      items:
        type: object
        properties:
          id:
            $ref: '#/components/schemas/group-id'
        required:
          - id
        minItems: 0
        maxItems: 100
    GroupsRequesterSettings:
      type: object
      description: A requester settings indicating that access request can be submitted by specific groups.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - GROUPS
        groups:
          description: groups whos members can file an access request
          $ref: '#/components/schemas/groups-array-full'
      required:
        - type
        - groups
    team-id:
      type: string
      maxLength: 24
      minLength: 24
      pattern: ^[a-fA-F\d]{24}$
      format: team-id
      description: |
        Unique identifier for the access request team
    teams-array-full:
      type: array
      description: |
        A request condition may have a zero item array if it is in an INVALID state.
        Otherwise, there will be at least one item.
      items:
        type: object
        properties:
          id:
            $ref: '#/components/schemas/team-id'
        required:
          - id
        minItems: 0
        maxItems: 100
    TeamsRequesterSettings:
      type: object
      description: A requester settings indicating that access request can be submitted by specific teams.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - TEAMS
        teams:
          description: teams whos members can file an access request
          $ref: '#/components/schemas/teams-array-full'
      required:
        - type
        - teams
    requester-settings-full_RequesterSettings:
      type: object
      description: |
        Requester settings define who may submit an access request for the related resource and access scopes.
      discriminator:
        propertyName: type
        mapping:
          EVERYONE: '#/components/schemas/EveryoneRequesterSettings'
          GROUPS: '#/components/schemas/GroupsRequesterSettings'
          TEAMS: '#/components/schemas/TeamsRequesterSettings'
      oneOf:
        - $ref: '#/components/schemas/EveryoneRequesterSettings'
        - $ref: '#/components/schemas/GroupsRequesterSettings'
        - $ref: '#/components/schemas/TeamsRequesterSettings'
    ResourceDefaultAccessScopeSettings:
      type: object
      description: |
        Default Access scope settings associated with the condition's resource.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - RESOURCE_DEFAULT
      required:
        - type
    entitlement-bundle-id:
      type: string
      maxLength: 20
      minLength: 20
      format: entitlement-bundle-id
      pattern: enb[0-9a-zA-Z]+
      description: |
        The entitlement bundle `id`
    entitlement-bundles-array-full:
      type: array
      description: |
        A request condition may have a zero item array if it is in an INVALID state.
        Otherwise, there will be at least one item.
      items:
        type: object
        description: Entitlement bundle id and entitlement bundle name that is made requestable
        properties:
          id:
            $ref: '#/components/schemas/entitlement-bundle-id'
        required:
          - id
      minItems: 0
      maxItems: 100
    EntitlementBundleAccessScopeSettings:
      type: object
      description: Settings when the resource uses entitlement bundles for access scoping.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - ENTITLEMENT_BUNDLES
        entitlementBundles:
          $ref: '#/components/schemas/entitlement-bundles-array-full'
      required:
        - type
        - entitlementBundles
    GroupAccessScopeSettings:
      type: object
      description: Settings when the resource uses groups for access scoping.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - GROUPS
        groups:
          $ref: '#/components/schemas/groups-array-full'
      required:
        - type
        - groups
    access-scope-settings-full_AccessScopeSettings:
      type: object
      description: |
        Settings specifying if groups or entitlements may be used for requesting finer grained access
      discriminator:
        propertyName: type
        mapping:
          RESOURCE_DEFAULT: '#/components/schemas/ResourceDefaultAccessScopeSettings'
          ENTITLEMENT_BUNDLES: '#/components/schemas/EntitlementBundleAccessScopeSettings'
          GROUPS: '#/components/schemas/GroupAccessScopeSettings'
      oneOf:
        - $ref: '#/components/schemas/ResourceDefaultAccessScopeSettings'
        - $ref: '#/components/schemas/EntitlementBundleAccessScopeSettings'
        - $ref: '#/components/schemas/GroupAccessScopeSettings'
    request-condition-full:
      type: object
      description: |
        A condition delineates the criteria governing access requests, specifying the requester's identity, the permitted access scope, and the manner in which access can be requested.
      allOf:
        - $ref: '#/components/schemas/writable-standard-properties-request-condition'
        - $ref: '#/components/schemas/read-only-standard-properties'
        - $ref: '#/components/schemas/request-condition-read-only'
      properties:
        requesterSettings:
          $ref: '#/components/schemas/requester-settings-full_RequesterSettings'
        accessScopeSettings:
          $ref: '#/components/schemas/access-scope-settings-full_AccessScopeSettings'
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-full'
        approvalSequenceId:
          $ref: '#/components/schemas/approval-sequence-id-read-only'
      required:
        - id
        - name
        - lastUpdated
        - lastUpdatedBy
        - requesterSettings
        - accessScopeSettings
        - status
        - priority
        - _links
    groups-array-creatable:
      type: array
      description: |-
        List of requestable groups

        > **Note:** Both standard Okta groups and AD-sourced groups are supported in Access Requests.
        > Standard Okta groups have the `okta:user_group` value, whereas AD-sourced groups have the `okta:windows_security_principal` value in their `objectClass` property.
      items:
        type: object
        properties:
          id:
            $ref: '#/components/schemas/group-id'
        required:
          - id
      minItems: 1
    requester-settings-creatable_GroupsRequesterSettings:
      type: object
      description: A requester settings indicating that access request can be submitted by specific groups.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - GROUPS
        groups:
          description: Groups whose members can file an access request
          $ref: '#/components/schemas/groups-array-creatable'
      required:
        - type
        - groups
    teams-array-creatable:
      type: array
      items:
        type: object
        properties:
          id:
            $ref: '#/components/schemas/team-id'
        required:
          - id
        minItems: 1
    requester-settings-creatable_TeamsRequesterSettings:
      type: object
      description: A requester settings indicating that access request can be submitted by specific teams.
      additionalProperties: false
      properties:
        type:
          type: string
          enum:
            - TEAMS
        teams:
          description: Teams whose members can file an access request
          $ref: '#/components/schemas/teams-array-creatable'
      required:
        - type
        - teams
    requester-settings-creatable_RequesterSettings:
      type: object
      description: |
        Requester settings define who may submit an access request for the related resource and access scopes.
      discriminator:
        propertyName: type
        mapping:
          EVERYONE: '#/components/schemas/EveryoneRequesterSettings'
          GROUPS: '#/components/schemas/requester-settings-creatable_GroupsRequesterSettings'
          TEAMS: '#/components/schemas/requester-settings-creatable_TeamsRequesterSettings'
      oneOf:
        - $ref: '#/components/schemas/EveryoneRequesterSettings'
        - $ref: '#/components/schemas/requester-settings-creatable_GroupsRequesterSettings'
        - $ref: '#/components/schemas/requester-settings-creatable_TeamsRequesterSettings'
    access-scope-settings-creatable_ResourceDefaultAccessScopeSettings:
      type: object
      additionalProperties: false
      description: |
        Default access scope settings associated with the requesting resource
      properties:
        type:
          type: string
          description: Request for resource access
          enum:
            - RESOURCE_DEFAULT
      required:
        - type
    entitlement-bundles-array-creatable:
      type: array
      description: Entitlement bundles that are made requestable
      items:
        type: object
        description: Entitlement bundle ID that is made requestable
        properties:
          id:
            type: string
            description: Entitlement bundle ID
        required:
          - id
      minItems: 1
    access-scope-settings-creatable_EntitlementBundleAccessScopeSettings:
      type: object
      description: Access scope settings that resource permissions are entitlement bundles.
      additionalProperties: false
      properties:
        type:
          type: string
          description: Request for access to entitlement bundles
          enum:
            - ENTITLEMENT_BUNDLES
        entitlementBundles:
          $ref: '#/components/schemas/entitlement-bundles-array-creatable'
      required:
        - type
        - entitlementBundles
    access-scope-settings-creatable_GroupAccessScopeSettings:
      type: object
      description: Access scope settings that resource permissions are groups.
      additionalProperties: false
      properties:
        type:
          type: string
          description: Request for access to groups
          enum:
            - GROUPS
        groups:
          $ref: '#/components/schemas/groups-array-creatable'
      required:
        - type
        - groups
    access-scope-settings-creatable_AccessScopeSettings:
      type: object
      description: Settings for the access request scope (such as groups, entitlement bundles, or default resources)
      discriminator:
        propertyName: type
        mapping:
          RESOURCE_DEFAULT: '#/components/schemas/access-scope-settings-creatable_ResourceDefaultAccessScopeSettings'
          ENTITLEMENT_BUNDLES: '#/components/schemas/access-scope-settings-creatable_EntitlementBundleAccessScopeSettings'
          GROUPS: '#/components/schemas/access-scope-settings-creatable_GroupAccessScopeSettings'
      oneOf:
        - $ref: '#/components/schemas/access-scope-settings-creatable_ResourceDefaultAccessScopeSettings'
        - $ref: '#/components/schemas/access-scope-settings-creatable_EntitlementBundleAccessScopeSettings'
        - $ref: '#/components/schemas/access-scope-settings-creatable_GroupAccessScopeSettings'
    access-duration-settings-creatable:
      type: object
      description: |
        Settings that control who may specify the access duration allowed by this request condition or risk settings, as well as what duration may be requested.

        **Note:** The resource request settings affect what access duration settings are valid. See the `validAccessDurationSettings` property.
      discriminator:
        propertyName: type
        mapping:
          ADMIN_FIXED_DURATION: '#/components/schemas/access-duration-settings-admin-fixed-duration'
          REQUESTER_SPECIFIED_DURATION: '#/components/schemas/access-duration-settings-requester-specified-duration'
      oneOf:
        - $ref: '#/components/schemas/access-duration-settings-admin-fixed-duration'
        - $ref: '#/components/schemas/access-duration-settings-requester-specified-duration'
    approval-sequence-id:
      type: string
      description: Unique identifier for the approval sequence
      minLength: 24
      maxLength: 24
    request-condition-creatable:
      type: object
      description: |
        A condition defines who can request which resource (with what resource permissions) and what is the approval process if requested.
      allOf:
        - $ref: '#/components/schemas/writable-standard-properties-request-condition'
      properties:
        requesterSettings:
          $ref: '#/components/schemas/requester-settings-creatable_RequesterSettings'
        accessScopeSettings:
          $ref: '#/components/schemas/access-scope-settings-creatable_AccessScopeSettings'
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-creatable'
        approvalSequenceId:
          $ref: '#/components/schemas/approval-sequence-id'
        priority:
          $ref: '#/components/schemas/priority'
      required:
        - name
        - requesterSettings
        - approvalSequenceId
        - accessScopeSettings
    access-duration-settings-patchable:
      type: object
      nullable: true
      description: |-
        Settings that control who may specify the access duration allowed by this request condition, as well as what duration may be requested.

        > **Note:** The resource request settings affect which access duration settings are valid. See the `validAccessDurationSettings` property.
      discriminator:
        propertyName: type
        mapping:
          ADMIN_FIXED_DURATION: '#/components/schemas/access-duration-settings-admin-fixed-duration'
          REQUESTER_SPECIFIED_DURATION: '#/components/schemas/access-duration-settings-requester-specified-duration'
      oneOf:
        - $ref: '#/components/schemas/access-duration-settings-admin-fixed-duration'
        - $ref: '#/components/schemas/access-duration-settings-requester-specified-duration'
    request-condition-patchable:
      type: object
      description: |
        A condition defines who can request which resource (with what resource permissions) and what is the approval process if requested.
      allOf:
        - $ref: '#/components/schemas/writable-standard-properties-request-condition'
      properties:
        requesterSettings:
          $ref: '#/components/schemas/requester-settings-creatable_RequesterSettings'
        accessScopeSettings:
          $ref: '#/components/schemas/access-scope-settings-creatable_AccessScopeSettings'
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-patchable'
        approvalSequenceId:
          $ref: '#/components/schemas/approval-sequence-id'
        priority:
          $ref: '#/components/schemas/priority'
    request-condition-service-status-enum:
      type: string
      description: status describes the request condition service status for the current org.
      enum:
        - READY
        - LIVE
    request-condition-service-status:
      type: object
      description: An object describes the status of request condition service.
      properties:
        status:
          $ref: '#/components/schemas/request-condition-service-status-enum'
      required:
        - status
    valid-access-detail:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/access-scope-settings-type'
    valid-access-details:
      type: array
      description: Access scope settings that are eligible to be added to a request condition for the specified resource
      items:
        $ref: '#/components/schemas/valid-access-detail'
      minItems: 0
      maxItems: 3
    valid-requester-setting:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/requester-settings-type'
    valid-requester-settings-details:
      type: array
      description: Request scope settings that are eligible to be added to a request condition for the specified resource
      items:
        $ref: '#/components/schemas/valid-requester-setting'
      minItems: 0
      maxItems: 3
    access-duration-type:
      type: string
      description: Identifies by whom the time settings were specified
      enum:
        - ADMIN_FIXED_DURATION
        - REQUESTER_SPECIFIED_DURATION
    valid-access-duration-type:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/access-duration-type'
    valid-access-duration-settings-details:
      type: object
      description: Admin specified access duration settings added to a request condition or risk settings for the specified resource
      properties:
        supportedTypes:
          type: array
          description: Access duration settings that are eligible to be added to a request condition or risk settings for the specified resource.
          items:
            $ref: '#/components/schemas/valid-access-duration-type'
          minItems: 0
          maxItems: 2
        required:
          type: boolean
          description: Whether `accessDurationSetting` must be included in the request conditions or risk settings for the specified resource.
        maximumDays:
          type: number
          minimum: 1
          maximum: 365
          description: |
            The maximum number of days allowed from the `accessDurationSettings.duration` day expression for a request condition or risk settings, such as `P30D`.
            For example, if `accessDurationSettings.duration` is `P365D`, then the maximum number of days for this request is `365`.
        maximumHours:
          type: number
          minimum: 1
          maximum: 72
          description: |
            The minimum and maximum values allowed in `accessDurationSettings.duration` expression for a request condition or risk settings,
            when that expression contains hour units. For example: `P5H` is valid, and `P73H` is not.
        maximumWeeks:
          type: number
          minimum: 1
          maximum: 52
          description: |
            The maximum number of weeks allowed from the `accessDurationSettings.duration` week expression for request condition or risk settings, such as `P3W`.
            For example, if `accessDurationSettings.duration` is `P52W`, then the maximum number of weeks is `52`.
    request-on-behalf-of-type:
      type: string
      enum:
        - DIRECT_REPORT
    request-on-behalf-of-settings-details:
      type: object
      description: Specifies if and for whom a requester may request the resource for.
      required:
        - allowed
      properties:
        allowed:
          type: boolean
          description: Indicates that users who can request this resource could also request for another requester of the same resource
        onlyFor:
          type: array
          description: Which requesters the resource requester can request on behalf of. If onlyFor is not specified then any requester may request a resource on the behalf of any other user
          items:
            $ref: '#/components/schemas/request-on-behalf-of-type'
          minItems: 1
    valid-risk-settings-type:
      type: object
      properties:
        type:
          type: string
          enum:
            - DEFAULT_SETTING
    valid-risk-settings-details:
      type: object
      description: Risk settings that are eligible for the specified resource
      required:
        - supportedTypes
      properties:
        supportedTypes:
          type: array
          description: Risk settings that are eligible for the specified resource
          items:
            $ref: '#/components/schemas/valid-risk-settings-type'
    risk-settings-error:
      type: string
      description: |
        Error that has occurred with the risk settings. Currently, there is only error when an associated approval sequence was deleted.
      enum:
        - INVALID_SEQUENCE
    risk-settings-default-allowed-with-no-overrides-details:
      type: object
      description: Risk settings where request submission is allowed with no overrides.
      required:
        - requestSubmissionType
      properties:
        requestSubmissionType:
          type: string
          enum:
            - ALLOWED_WITH_NO_OVERRIDES
        error:
          type: array
          items:
            $ref: '#/components/schemas/risk-settings-error'
    risk-settings-default-allowed-with-overrides-details:
      type: object
      description: Risk settings where request submission is allowed with specified approval sequence and optional access duration settings
      required:
        - requestSubmissionType
        - approvalSequenceId
      properties:
        requestSubmissionType:
          type: string
          enum:
            - ALLOWED_WITH_OVERRIDES
        approvalSequenceId:
          $ref: '#/components/schemas/approval-sequence-id'
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-full'
        error:
          type: array
          items:
            $ref: '#/components/schemas/risk-settings-error'
    risk-settings-default-restricted-details:
      type: object
      description: Risk settings where request submission is restricted. Access duration settings can only be present when there is an error.
      required:
        - requestSubmissionType
      properties:
        requestSubmissionType:
          type: string
          enum:
            - RESTRICTED
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-full'
        error:
          type: array
          items:
            $ref: '#/components/schemas/risk-settings-error'
    risk-settings-default-details:
      type: object
      description: |
        Default risk settings that are valid for an access request when a risk has been detected for the resource and requesting user.
        Request submission indicates whether users are allowed or restricted to submit a request when there is any risk conflict. 
        An approval sequence must be selected with optional access duration settings here for `ALLOWED_WITH_OVERRIDES`, while the 
        settings from the matching request condition would apply for `ALLOWED_WITH_NO_OVERRIDES`. For `RESTRICTED`, access duration
        settings can only be present when there is an error.
      discriminator:
        propertyName: requestSubmissionType
        mapping:
          ALLOWED_WITH_NO_OVERRIDES: '#/components/schemas/risk-settings-default-allowed-with-no-overrides-details'
          ALLOWED_WITH_OVERRIDES: '#/components/schemas/risk-settings-default-allowed-with-overrides-details'
          RESTRICTED: '#/components/schemas/risk-settings-default-restricted-details'
      oneOf:
        - $ref: '#/components/schemas/risk-settings-default-allowed-with-no-overrides-details'
        - $ref: '#/components/schemas/risk-settings-default-allowed-with-overrides-details'
        - $ref: '#/components/schemas/risk-settings-default-restricted-details'
    risk-settings-details:
      type: object
      description: Risk settings that are valid for an access request when a risk has been detected for the resource and requesting user
      required:
        - defaultSetting
      properties:
        defaultSetting:
          $ref: '#/components/schemas/risk-settings-default-details'
    request-on-behalf-of-settings-type:
      type: string
      description: Resource that can request access on behalf of others
      enum:
        - EVERYONE
        - DIRECT_REPORT
    valid-request-on-behalf-of-setting:
      type: object
      properties:
        type:
          $ref: '#/components/schemas/request-on-behalf-of-settings-type'
    valid-request-on-behalf-of-settings-details:
      type: array
      description: Request on behalf of settings that are eligible to be added to a request condition for the specified resource
      items:
        $ref: '#/components/schemas/valid-request-on-behalf-of-setting'
      minItems: 0
      maxItems: 2
    request-settings:
      type: object
      description: |
        Request settings specify what conditions are valid for the given resource
      properties:
        validAccessScopeSettings:
          $ref: '#/components/schemas/valid-access-details'
        validRequesterSettings:
          $ref: '#/components/schemas/valid-requester-settings-details'
        validAccessDurationSettings:
          $ref: '#/components/schemas/valid-access-duration-settings-details'
        requestOnBehalfOfSettings:
          $ref: '#/components/schemas/request-on-behalf-of-settings-details'
        validRiskSettings:
          $ref: '#/components/schemas/valid-risk-settings-details'
        riskSettings:
          $ref: '#/components/schemas/risk-settings-details'
        validRequestOnBehalfOfSettings:
          $ref: '#/components/schemas/valid-request-on-behalf-of-settings-details'
      required:
        - validAccessScopeSettings
        - validRequesterSettings
        - validAccessDurationSettings
    request-on-behalf-of-settings-patchable:
      type: object
      nullable: true
      description: Specifies if and for whom a requester may request the resource for.
      required:
        - allowed
      properties:
        allowed:
          type: boolean
          description: Indicates that users who can request this resource could also request for another requester of the same resource. This property can only be `true`. If request on behalf of should not be allowed then `requestOnBehalfOfSettings` should be nullified.
        onlyFor:
          nullable: true
          type: array
          description: Which requesters the resource requester can request on behalf of. If onlyFor is not specified then any requester may request a resource on the behalf of any other user
          items:
            $ref: '#/components/schemas/request-on-behalf-of-type'
          minItems: 1
    risk-settings-default-allowed-with-no-overrides-patchable:
      type: object
      description: Risk settings where request submission is allowed with no overrides
      required:
        - requestSubmissionType
      properties:
        requestSubmissionType:
          type: string
          enum:
            - ALLOWED_WITH_NO_OVERRIDES
    risk-settings-default-allowed-with-overrides-patchable:
      type: object
      description: Risk settings where request submission is allowed with specified approval sequence and optional access duration settings
      required:
        - requestSubmissionType
        - approvalSequenceId
      properties:
        requestSubmissionType:
          type: string
          enum:
            - ALLOWED_WITH_OVERRIDES
        approvalSequenceId:
          $ref: '#/components/schemas/approval-sequence-id'
        accessDurationSettings:
          $ref: '#/components/schemas/access-duration-settings-patchable'
    risk-settings-default-restricted-patchable:
      type: object
      description: Risk settings where request submission is restricted
      required:
        - requestSubmissionType
      properties:
        requestSubmissionType:
          type: string
          enum:
            - RESTRICTED
    risk-settings-default-patchable:
      type: object
      description: |
        Default risk settings that are valid for an access request when a risk has been detected for the resource and requesting user.
        Request submission indicates whether users are allowed or restricted to submit a request when there is any risk conflict. 
        An approval sequence must be selected with optional access duration settings here for `ALLOWED_WITH_OVERRIDES`, while the 
        settings from the matching request condition would apply for `ALLOWED_WITH_NO_OVERRIDES`. For `RESTRICTED` and 
        `ALLOWED_WITH_NO_OVERRIDES`, access duration settings can only be present when there is an error.
      discriminator:
        propertyName: requestSubmissionType
        mapping:
          ALLOWED_WITH_NO_OVERRIDES: '#/components/schemas/risk-settings-default-allowed-with-no-overrides-patchable'
          ALLOWED_WITH_OVERRIDES: '#/components/schemas/risk-settings-default-allowed-with-overrides-patchable'
          RESTRICTED: '#/components/schemas/risk-settings-default-restricted-patchable'
      oneOf:
        - $ref: '#/components/schemas/risk-settings-default-allowed-with-no-overrides-patchable'
        - $ref: '#/components/schemas/risk-settings-default-allowed-with-overrides-patchable'
        - $ref: '#/components/schemas/risk-settings-default-restricted-patchable'
    risk-settings-patchable:
      type: object
      description: Risk settings that are valid for an access request when a risk has been detected for the resource and requesting user
      required:
        - defaultSetting
      properties:
        defaultSetting:
          $ref: '#/components/schemas/risk-settings-default-patchable'
    resource-request-settings-patchable:
      type: object
      description: |
        Resource request settings that specify various configurations and permissions at the resource level.
      properties:
        requestOnBehalfOfSettings:
          $ref: '#/components/schemas/request-on-behalf-of-settings-patchable'
        riskSettings:
          $ref: '#/components/schemas/risk-settings-patchable'
    subprocessors-acknowledged:
      type: boolean
      description: Indicates that Access Requests provisioning was triggered by the customer (such as in [Govern Okta admin roles](https://help.okta.com/okta_help.htm?type=oie&id=csh-governance-admin-roles))
    provisioning-status:
      type: string
      description: The Access Requests provisioning status in the org
      enum:
        - NOT_PROVISIONED
        - PROVISIONING_FAILED
        - PROVISIONED
    request-experience:
      type: string
      description: The request experience supported in the org
      enum:
        - ADMIN_ROLES
        - CATALOG
      x-enumDescriptions:
        ADMIN_ROLES: Govern Okta admin roles request experience
        CATALOG: Access Request with conditions request experience
    integration-id:
      type: string
      maxLength: 20
      minLength: 20
      format: integration-id
      pattern: goi[0-9a-zA-Z]+
      description: The integration ID
    slack-notification-settings:
      type: object
      description: Slack notification settings for the org
      properties:
        enabled:
          type: boolean
          description: Indicates that notifications are enabled for this Slack integration
    SlackIntegrationSettings:
      type: object
      description: Slack integration settings for the org
      additionalProperties: false
      properties:
        type:
          type: string
          description: The type of integration
          enum:
            - SLACK
        integrationId:
          $ref: '#/components/schemas/integration-id'
        notifications:
          $ref: '#/components/schemas/slack-notification-settings'
        canInitiateRequest:
          type: boolean
          description: Indicates whether requests can be initiated from this Slack integration
        canApproveRequest:
          type: boolean
          description: Indicates whether requests can be approved from this Slack integration
      required:
        - type
        - integrationId
    IntegrationSettings:
      type: object
      description: <x-lifecycle class="beta"></x-lifecycle><br> Access Requests integration settings for the org
      discriminator:
        propertyName: type
        mapping:
          SLACK: '#/components/schemas/SlackIntegrationSettings'
      oneOf:
        - $ref: '#/components/schemas/SlackIntegrationSettings'
    request-integrations:
      type: object
      description: <x-lifecycle class="beta"></x-lifecycle><br> Access Requests integration settings for the org
      properties:
        settings:
          type: array
          description: Integration settings
          items:
            $ref: '#/components/schemas/IntegrationSettings'
    org-request-settings:
      type: object
      description: Request settings for the org
      required:
        - subprocessorsAcknowledged
        - provisioningStatus
        - requestExperiences
        - longTimePastProvisioned
      properties:
        subprocessorsAcknowledged:
          $ref: '#/components/schemas/subprocessors-acknowledged'
        provisioningStatus:
          $ref: '#/components/schemas/provisioning-status'
        requestExperiences:
          type: array
          description: The supported request experiences in the org
          items:
            $ref: '#/components/schemas/request-experience'
          minItems: 0
        longTimePastProvisioned:
          type: boolean
          description: Indicates that Access Request provisioning was triggered more than 10 minutes ago
        integrations:
          $ref: '#/components/schemas/request-integrations'
    org-request-settings-patchable:
      type: object
      description: Request settings for the org for patch
      properties:
        subprocessorsAcknowledged:
          $ref: '#/components/schemas/subprocessors-acknowledged'
        integrations:
          $ref: '#/components/schemas/request-integrations'
    compatible-resource-types:
      type: string
      enum:
        - APP
        - GROUP
      description: A resource type the sequence is compatible with.
    request-sequence:
      type: object
      description: A sequence that decides what actions must be taken on a request
      properties:
        id:
          type: string
          description: Unique idenfitifer of the request sequence
        name:
          type: string
          description: Name of the request sequence
        description:
          type: string
          description: Description of the request sequence
        compatibleResourceTypes:
          type: array
          items:
            $ref: '#/components/schemas/compatible-resource-types'
        link:
          type: string
          description: Link to edit the request sequence
      required:
        - id
        - name
        - description
        - link
    request-sequences-list:
      type: object
      properties:
        data:
          type: array
          description: All resource request sequences
          items:
            $ref: '#/components/schemas/request-sequence'
        _links:
          type: object
          description: Links to related resources and actions
          properties:
            self:
              $ref: '#/components/schemas/link'
            newSequence:
              $ref: '#/components/schemas/link'
          required:
            - self
    sequence-id:
      type: string
      description: The sequence ID
      maxLength: 24
      minLength: 24
      pattern: ^[a-fA-F\d]{24}$
      format: sequence-id
      example: 673b6e662088ea0006d10ff3
    rcar-request-id:
      type: string
      format: rcar-request-id
      maxLength: 20
      minLength: 20
      pattern: req[0-9a-zA-Z]+
      example: reqp1pmpjhVdGEcVK1d5
    order-by:
      type: string
      format: order-by
      description: A property of items within the collection, optionally followed by a `%20asc` or `%20desc` suffix.
    request-status:
      type: string
      enum:
        - SUBMITTED
        - REJECTED
        - PENDING
        - APPROVED
        - DENIED
        - CANCELED
        - EXPIRED
      description: The status of the request
    request-resolved-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the request was resolved. The property may transition from having a value to null if the request is reopened.
    request-grant-status:
      type: string
      enum:
        - PENDING
        - GRANTED
        - FAILED
        - MANUAL_REQUIRED
      description: The grant status of the request
    request-granted-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the approved access was granted. Only set if request.status is APPROVED.
    request-revocation-status:
      type: string
      enum:
        - PENDING
        - REVOKED
        - FAILED
      description: The revocation status of the request
    request-revoked-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the granted access was revoked. Only set if request.grantStatus is GRANTED and request.revocationStatus is REVOKED.
    client-credential-principal:
      type: object
      description: A representation of a principal
      required:
        - externalId
        - type
      properties:
        externalId:
          type: string
          description: The principal ID
          maxLength: 20
          minLength: 20
          pattern: (00u|pca)[0-9a-zA-Z]+
        type:
          type: string
          description: The type of principal
          enum:
            - OKTA_USER
            - UNKNOWN
          x-enumDescriptions:
            OKTA_USER: The principal is an Okta user. `externalId` has the format `00u*`.
            UNKNOWN: The principal isn't a known Okta user. `externalId` has the format `pca*`. This option is for requests not made by a known Okta user, such as requests from a service using client credentials authentication.
    user-id:
      type: string
      x-okta-ignore-redocly-rules-for-sdk: true
      format: okta-user-id
      description: The Okta user `id`
      maxLength: 20
      minLength: 20
      pattern: 00u[0-9a-zA-Z]+
      example: 00ub0oNGTSWTBKOLGLNR
    principal-type:
      type: string
      description: The type of principal
      enum:
        - OKTA_USER
    target-principal:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: A representation of a principal
      required:
        - externalId
        - type
      properties:
        externalId:
          $ref: '#/components/schemas/user-id'
        type:
          $ref: '#/components/schemas/principal-type'
    catalog-entry-id:
      type: string
      maxLength: 20
      minLength: 20
      description: Unique identifier of the resource catalog entry
      example: cenp2rjyxK1Js2Fc41d5
    resource-id:
      type: string
      maxLength: 20
      minLength: 20
      description: the requested resource ID
    resource-type:
      type: string
      description: The requested resource type
      enum:
        - APPLICATION
        - REQUEST_TYPE
    access-scope-id:
      type: string
      description: ID of the access scope
      minLength: 20
      maxLength: 20
    access-scope-type:
      type: string
      description: The access scope type
      enum:
        - ENTITLEMENT_BUNDLE
        - GROUP
        - APPLICATION
        - REQUEST_TYPE
    requested:
      type: object
      description: A representation of the resource in request
      properties:
        entryId:
          $ref: '#/components/schemas/catalog-entry-id'
        resourceId:
          $ref: '#/components/schemas/resource-id'
        resourceType:
          $ref: '#/components/schemas/resource-type'
        accessScopeId:
          $ref: '#/components/schemas/access-scope-id'
        accessScopeType:
          $ref: '#/components/schemas/access-scope-type'
    request-links:
      type: object
      description: Links available on a single request representation
      required:
        - self
      properties:
        catalogEntry:
          $ref: '#/components/schemas/link'
        approvalCondition:
          $ref: '#/components/schemas/link'
        approvalSequence:
          $ref: '#/components/schemas/link'
        self:
          $ref: '#/components/schemas/link'
    request-minimal-read-only-fields:
      type: object
      description: Properties contained by default in sparse representation
      properties:
        status:
          $ref: '#/components/schemas/request-status'
        resolved:
          $ref: '#/components/schemas/request-resolved-date-time'
        grantStatus:
          $ref: '#/components/schemas/request-grant-status'
        granted:
          $ref: '#/components/schemas/request-granted-date-time'
        revocationStatus:
          $ref: '#/components/schemas/request-revocation-status'
        revoked:
          $ref: '#/components/schemas/request-revoked-date-time'
        requestedBy:
          $ref: '#/components/schemas/client-credential-principal'
        requestedFor:
          $ref: '#/components/schemas/target-principal'
        requested:
          $ref: '#/components/schemas/requested'
        _links:
          $ref: '#/components/schemas/request-links'
    request-sparse:
      type: object
      description: Sparse representation of a Request resource
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - $ref: '#/components/schemas/request-minimal-read-only-fields'
      required:
        - id
        - created
        - createdBy
        - lastUpdated
        - lastUpdatedBy
        - status
        - requestedBy
        - requestedFor
        - requested
        - _links
    request-list-links:
      type: object
      description: Links available in request list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
    request-list:
      type: object
      properties:
        data:
          description: All requests on the current page
          type: array
          items:
            $ref: '#/components/schemas/request-sparse'
        _links:
          $ref: '#/components/schemas/request-list-links'
    request-resource-catalog-entry-creatable:
      type: object
      description: A representation of a requestable resource
      required:
        - type
        - entryId
      properties:
        type:
          type: string
          enum:
            - CATALOG_ENTRY
        entryId:
          $ref: '#/components/schemas/catalog-entry-id'
    request-resource-creatable:
      description: |
        A representation of a resource that can be requested for access. 

        **Note:** The resources available for the request are subject to their permission settings. For example, the Okta Admin App 
        can only be requested by Super Admin users. 
      discriminator:
        propertyName: type
        mapping:
          CATALOG_ENTRY: '#/components/schemas/request-resource-catalog-entry-creatable'
      oneOf:
        - $ref: '#/components/schemas/request-resource-catalog-entry-creatable'
    request-field-type:
      type: string
      enum:
        - TEXT
        - SELECT
        - MULTISELECT
        - ISO_DATE
        - DURATION
        - OKTA_USER_ID
      description: Type of value for the requester field.
    field-option-value:
      type: string
      description: The value of a select option
      maxLength: 280
      minLength: 1
    request-field-value:
      type: object
      required:
        - id
      properties:
        id:
          type: string
          description: |
            The ID of a `requesterField`.

            For `OKTA` request approval, this is typically the ID of an input field defined in an approval sequence.

            For `EXTERNAL` request approval, this is the ID of an input field relevant to the external approval system.

            The following are reserved identifiers:
            - `ACCESS_DURATION`: An identifier used to specify the duration of the access being requested. (**Note:**
              This identifier is to be grandfathered. The new name will be `OKTA_ACCESS_DURATION`.)
            - `OKTA_REQUESTED_FOR`: An identifier used to specify who the resource is being requested for
            - `OKTA_ACCESS_DURATION`: An identifier used to specify the duration of the requested access. If a request 
              field is included in this ID, the field value must be a `DURATION` expression in ISO format. The maximum 
              length of this value is 5 characters. For example, `P1D` represents a duration of one day.
            - Any identifiers with `OKTA_` prefix are reserved for future use.
        label:
          type: string
          description: A human-readable description of `requesterField`. It's used for display purposes and is optional
        type:
          $ref: '#/components/schemas/request-field-type'
        value:
          type: string
          minLength: 1
          maxLength: 1000
          description: |
            The value of `requesterField`, which depends on the type of the field:
            - `TEXT`: A multi-line string
            - `SELECT`: An option predefined by the approval system
            - `ISO_DATE`: An ISO formatted date string. for example, `2022-05-05T14:15:22Z`
            - `DURATION`: An ISO format duration expression with a maximum length of 5 characters. For example, 
              `P1D` indicates a duration of one day.
            - `OKTA_USER_ID`: Okta User ID

            If the field type is one of the previously listed, this property is required.
        values:
          type: array
          items:
            $ref: '#/components/schemas/field-option-value'
          description: |
            The values of `requesterField` with the type `MULTISELECT`.

            If the field type is `MULTISELECT`, this property is required.
    request-field-values:
      type: array
      description: |
        The requester input fields required by the approval system.

        **Note:** The fields required are determined by the approval system.

        For the Okta approval system, the required fields are defined in the approval sequence. Ensure that the requester
        input fields match up with this definition to avoid request approval flow failure.

        For external approval systems, the requester input fields are for recording purposes only and do not affect the approval
        process.
      items:
        $ref: '#/components/schemas/request-field-value'
    request-creatable:
      type: object
      description: Properties which are mutable in mutation operations
      required:
        - requested
        - requestedFor
      properties:
        requested:
          $ref: '#/components/schemas/request-resource-creatable'
        requestedBy:
          $ref: '#/components/schemas/target-principal'
        requestedFor:
          $ref: '#/components/schemas/target-principal'
        requesterFieldValues:
          $ref: '#/components/schemas/request-field-values'
    request-duration:
      description: |
        How long the requester retains access after their request is approved and fulfilled.

        Specified in [ISO 8601 duration format](https://en.wikipedia.org/wiki/ISO_8601#Durations).

        #### Known limitation

        Only single time unit ISO 8601 duration formats (D, H, M) are supported for units (days, hours, minutes).

        ##### Supported

        | Unit       | Example |
        | ---------- | ------- |
        | D, days    | P40D    |
        | H, hours   | PT65H   |
        | M, minutes | PT90M   |

        > **Note:** Mixes of units, as well as month/year/week designations, aren't supported. For example, `P40DT65H`, `P40M`, `P1W`, and `P1Y` aren't supported.
      type: string
      example: P40D
      format: iso-duration
      nullable: true
      default: null
    request-revocation-scheduled-date-time:
      type: string
      format: date-time
      nullable: true
      description: The date the granted access is scheduled for recovation. Only set if request.accessDuration exists, and request.grantStatus is GRANTED.
    request-submission-type:
      type: string
      description: Whether a request submission is allowed or restricted in the risk settings
      enum:
        - ALLOWED_WITH_NO_OVERRIDES
        - ALLOWED_WITH_OVERRIDES
        - RESTRICTED
    risk-rule:
      type: object
      required:
        - name
      properties:
        name:
          type: string
          description: The name of a resource rule causing a conflict
          maxLength: 255
          minLength: 1
        description:
          type: string
          description: The human readable description
          maxLength: 1000
          minLength: 1
        resourceName:
          type: string
          description: Human readable name of the resource
    risk-rules:
      type: array
      items:
        $ref: '#/components/schemas/risk-rule'
      minItems: 0
      maxItems: 5
    risk-assessment:
      type: object
      description: A risk assessment that indicates whether request submission is allowed or restricted. It contains the risk rules that lead to possible conflicts for the requested resource.
      required:
        - requestSubmissionType
        - riskRules
      properties:
        requestSubmissionType:
          $ref: '#/components/schemas/request-submission-type'
        riskRules:
          $ref: '#/components/schemas/risk-rules'
    request-submission-full:
      type: object
      description: Full representation of a request submission
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - type: object
          properties:
            status:
              type: string
              enum:
                - SUBMITTED
              description: The status of the request
            resolved:
              $ref: '#/components/schemas/request-resolved-date-time'
            grantStatus:
              $ref: '#/components/schemas/request-grant-status'
            granted:
              $ref: '#/components/schemas/request-granted-date-time'
            revocationStatus:
              $ref: '#/components/schemas/request-revocation-status'
            revoked:
              $ref: '#/components/schemas/request-revoked-date-time'
            requestedBy:
              $ref: '#/components/schemas/client-credential-principal'
            requestedFor:
              $ref: '#/components/schemas/target-principal'
            requested:
              $ref: '#/components/schemas/requested'
            _links:
              $ref: '#/components/schemas/request-links'
            accessDuration:
              $ref: '#/components/schemas/request-duration'
            revocationScheduled:
              $ref: '#/components/schemas/request-revocation-scheduled-date-time'
            requesterFieldValues:
              $ref: '#/components/schemas/request-field-values'
            riskAssessment:
              $ref: '#/components/schemas/risk-assessment'
      required:
        - id
        - created
        - createdBy
        - lastUpdated
        - lastUpdatedBy
        - status
        - requestedBy
        - requestedFor
        - requested
        - _links
    approval-provider-type:
      type: string
      description: The approval system type
      enum:
        - OKTA
        - EXTERNAL
    approval-provider-name:
      type: string
      description: A human readable name of the request approval system, for example, Okta Access Requests or ServiceNow
      minLength: 1
      maxLength: 100
    approval-provider-description:
      type: string
      description: A description of the request approval system
      maxLength: 1000
    approval-external-request-id:
      type: string
      description: The external request `id` from a request approval system, for example, ServiceNow or JIRA
      minLength: 1
      maxLength: 200
    request-permalink-id:
      type: integer
      description: The immutable, persistent identifier that always resolves to the request
    request-approval-status:
      type: string
      enum:
        - APPROVED
        - DENIED
      description: The approver's decision.
    approval-decision-date:
      type: string
      format: date-time
      description: The date the approval decision is made.
    approval-decision-enum:
      type: string
      enum:
        - APPROVE
        - DENY
        - CANCEL
    request-approval-decision:
      type: object
      description: A completed access request approval decision
      required:
        - deciderId
        - decision
        - decided
      properties:
        deciderId:
          $ref: '#/components/schemas/user-id'
        deciderName:
          type: string
          description: Okta username of the decider
          maxLength: 100
        decision:
          $ref: '#/components/schemas/approval-decision-enum'
        decided:
          $ref: '#/components/schemas/approval-decision-date'
        originalDeciderId:
          $ref: '#/components/schemas/user-id'
        originalDeciderFullName:
          type: string
          description: Full name of the original decider
          maxLength: 100
        originalDeciderEmail:
          type: string
          description: Email of the original decider
          format: email
        deciderDelegated:
          type: boolean
          description: Indicates if the decision was made by a delegated decider
        deciderEscalated:
          type: boolean
          description: Indicates if the decision was made by an escalated decider
    request-approval:
      type: object
      description: A completed access request approval
      required:
        - type
        - providerName
      properties:
        type:
          $ref: '#/components/schemas/approval-provider-type'
        providerName:
          $ref: '#/components/schemas/approval-provider-name'
        providerDescription:
          $ref: '#/components/schemas/approval-provider-description'
        externalRequestId:
          $ref: '#/components/schemas/approval-external-request-id'
        permalinkId:
          $ref: '#/components/schemas/request-permalink-id'
        status:
          $ref: '#/components/schemas/request-approval-status'
        decided:
          $ref: '#/components/schemas/approval-decision-date'
        decisions:
          type: array
          description: The approval decisions
          minItems: 0
          maxItems: 10
          items:
            $ref: '#/components/schemas/request-approval-decision'
    request-full:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Full representation of a Request.
      allOf:
        - $ref: '#/components/schemas/read-only-standard-properties'
        - $ref: '#/components/schemas/request-minimal-read-only-fields'
        - type: object
          properties:
            accessDuration:
              $ref: '#/components/schemas/request-duration'
            revocationScheduled:
              $ref: '#/components/schemas/request-revocation-scheduled-date-time'
            requesterFieldValues:
              $ref: '#/components/schemas/request-field-values'
            requestApproval:
              $ref: '#/components/schemas/request-approval'
            riskAssessment:
              $ref: '#/components/schemas/risk-assessment'
      required:
        - id
        - created
        - createdBy
        - lastUpdated
        - lastUpdatedBy
        - status
        - requestedBy
        - requestedFor
        - requested
        - _links
    request-status-patchable:
      type: string
      enum:
        - CANCELED
      description: |-
        Specify the status of the request.

        Only `CANCELED` is supported. You can't cancel a request if any of its tasks have been resolved.
    request-update:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/request-status-patchable'
    request-message-message:
      type: string
      description: Message that will be created for the request. Newline can be specified by characters "\n". Message will be visible for all users who can view the request.
      minLength: 1
      maxLength: 5000
      nullable: false
    request-message-mutable:
      type: object
      required:
        - message
      properties:
        message:
          $ref: '#/components/schemas/request-message-message'
    request-message-creatable:
      type: object
      description: The properties expected in a request message create request
      allOf:
        - $ref: '#/components/schemas/request-message-mutable'
    request-resolution-terminal-state:
      type: string
      description: The terminal state for the access request in the request provider
      enum:
        - APPROVED
        - DENIED
        - CANCELED
        - EXPIRED
    user-email:
      type: string
      description: E-mail of the user
      format: email
    user-name:
      type: string
      description: Name of the user
    request-decision-creatable:
      type: object
      description: A completed access request approval decision
      required:
        - userId
        - decision
        - decided
        - userEmail
        - userName
      properties:
        userId:
          $ref: '#/components/schemas/user-id'
        userEmail:
          $ref: '#/components/schemas/user-email'
        userName:
          $ref: '#/components/schemas/user-name'
        decision:
          $ref: '#/components/schemas/approval-decision-enum'
        decided:
          $ref: '#/components/schemas/approval-decision-date'
        originalDeciderId:
          $ref: '#/components/schemas/user-id'
        originalDeciderFullName:
          $ref: '#/components/schemas/user-name'
        originalDeciderEmail:
          $ref: '#/components/schemas/user-email'
        deciderDelegated:
          type: boolean
          description: Indicates if the decision was made by a delegated decider
        deciderEscalated:
          type: boolean
          description: Indicates if the decision was made by an escalated decider
    request-resolution-creatable:
      type: object
      description: The properties expected in a request resolution create request
      properties:
        terminalState:
          $ref: '#/components/schemas/request-resolution-terminal-state'
        decisions:
          type: array
          minItems: 0
          maxItems: 10
          items:
            $ref: '#/components/schemas/request-decision-creatable'
    rcar-entry-requestable:
      type: boolean
      nullable: false
      description: Is the resource requestable
    rcar-entry-counts:
      type: object
      description: Entry count metadata
      properties:
        resourceCounts:
          type: object
          description: Collection resource counts
          properties:
            applications:
              type: integer
              description: Number of app resources in a collection
              minimum: 0
              example: 3
    rcar-entry-links:
      type: object
      description: |-
        Links available for a resource catalog entry.
        * `createRequest`: returns the link to create the request only if the entry is requestable
        * `parent`: returns the parent entry only if a parent exists
        * `submittedRequest`: returns the submitted request only if the authenticated user has a submitted request for the entry and it's not available for approval
        * `pendingRequest`: returns the pending request only if the authenticated user has a submitted request for the entry and the request is available for approval
        * `relatedEntity`: returns the resource that's requested
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        logo:
          type: array
          description: Links to the catalog entry logo resources
          minItems: 0
          maxItems: 3
          items:
            $ref: '#/components/schemas/link'
        parent:
          $ref: '#/components/schemas/link'
        createRequest:
          $ref: '#/components/schemas/link'
        submittedRequest:
          $ref: '#/components/schemas/link'
        pendingRequest:
          $ref: '#/components/schemas/link'
        relatedEntity:
          $ref: '#/components/schemas/link'
    rcar-entry:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Full representaion of a access request catalog entry
      properties:
        id:
          description: Unique identifier for the entry
          type: string
          minLength: 1
        name:
          type: string
          nullable: false
          description: Name of the entry
          maxLength: 255
          minLength: 1
        description:
          type: string
          description: Description of the entry
          maxLength: 2000
        label:
          type: string
          description: Label of the entry. Currently either `Application` or `Resource Collection`
        parent:
          type: string
          nullable: false
          description: Parent of the entry
        requestable:
          $ref: '#/components/schemas/rcar-entry-requestable'
        counts:
          $ref: '#/components/schemas/rcar-entry-counts'
        _links:
          $ref: '#/components/schemas/rcar-entry-links'
      required:
        - id
        - name
        - requestable
        - _links
    rcar-entries-links:
      type: object
      description: |-
        Links available for the list of catalog entries.
        * `atspoke`: returned only for top level entries and if request types is supported
        * `match`: returned only if match is supported
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
        atspoke:
          $ref: '#/components/schemas/link'
        match:
          $ref: '#/components/schemas/link'
    rcar-entries-list-v2:
      type: object
      properties:
        data:
          description: Catalog entries list
          type: array
          items:
            $ref: '#/components/schemas/rcar-entry'
        _links:
          $ref: '#/components/schemas/rcar-entries-links'
    rcar-entry-get:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      allOf:
        - $ref: '#/components/schemas/rcar-entry'
    field-required:
      type: boolean
      description: Whether a value to this field is required to advance the request
      example: true
      default: true
    request-field:
      type: object
      description: Fields to be filled out for a request
      required:
        - id
        - type
        - required
      properties:
        id:
          type: string
          description: |
            A `read-only` field ID.

            Useful for specifying requesterFieldValues when adding a request.
        type:
          $ref: '#/components/schemas/request-field-type'
        choices:
          type: array
          description: Valid choices when type is SELECT or MULTISELECT.
          items:
            $ref: '#/components/schemas/field-option-value'
        required:
          $ref: '#/components/schemas/field-required'
        label:
          type: string
          description: label of the requester field
        value:
          type: string
          description: An admin configured value for this field. Only applies to DURATION fields.
        maximumValue:
          type: string
          description: The maximum value allowed for this field. Only applies to DURATION fields.
        readOnly:
          type: boolean
          description: Indicates this field is immutable.
    catalog-entry-request-fields:
      type: object
      properties:
        data:
          type: array
          description: List of request fields
          items:
            $ref: '#/components/schemas/request-field'
        metadata:
          type: object
          description: Additional information about the request fields
          properties:
            riskAssessment:
              $ref: '#/components/schemas/risk-assessment'
    requesters-member:
      type: object
      required:
        - type
        - externalId
      properties:
        type:
          type: string
          example: OKTA_USER
        externalId:
          type: string
          example: 00ub0oNGTSWTBKOLGLNR
    requesters-add-patch:
      type: object
      required:
        - op
        - path
        - value
      properties:
        op:
          type: string
          enum:
            - add
          description: Operation to add a new member to the existing requester set
        path:
          type: string
          pattern: ^/members/-$
          description: JSON Pointer path that specifies adding to the members array
        value:
          description: The member to add to the requester set
          $ref: '#/components/schemas/requesters-member'
    requesters-member-list:
      type: array
      items:
        $ref: '#/components/schemas/requesters-member'
    requesters-replace-patch:
      type: object
      required:
        - op
        - path
        - value
      properties:
        op:
          type: string
          enum:
            - replace
          description: Operation to replace all existing members with a new set
        path:
          type: string
          pattern: ^/members$
          description: JSON Pointer path that specifies replacing the entire members array
        value:
          description: The complete list of members to replace the existing requester set
          $ref: '#/components/schemas/requesters-member-list'
    requesters-members-patch-operation:
      type: object
      oneOf:
        - $ref: '#/components/schemas/requesters-replace-patch'
        - $ref: '#/components/schemas/requesters-add-patch'
      required:
        - op
        - path
        - value
      properties:
        op:
          type: string
          enum:
            - add
            - replace
          description: The operation to perform on the requesters set
        path:
          type: string
          description: JSON Pointer path to the target location
      discriminator:
        propertyName: op
        mapping:
          add: '#/components/schemas/requesters-add-patch'
          replace: '#/components/schemas/requesters-replace-patch'
    requesters-members-patch-operations:
      type: array
      items:
        $ref: '#/components/schemas/requesters-members-patch-operation'
    requesters-full:
      type: object
      required:
        - id
        - members
      properties:
        id:
          type: string
          example: 6773596f7190a40006a1f9af
        members:
          type: array
          items:
            $ref: '#/components/schemas/requesters-member'
    task-id:
      type: string
      format: task-id
      description: The unique identifier for the task
      maxLength: 24
      minLength: 24
      pattern: ^[0-9a-f]{24}$
      example: 68b0a1576dd8db837f5ee55d
    okta-id:
      description: The Okta ID
      type: string
      maxLength: 20
      minLength: 20
    task-assignees:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - externalId
        - type
      description: A task assignee that performs actions on the task.
      properties:
        externalId:
          $ref: '#/components/schemas/okta-id'
        type:
          $ref: '#/components/schemas/principal-type'
    task-status:
      type: string
      enum:
        - OPEN
        - COMPLETED
        - ASSIGNING
        - LOCKED
      description: The status of the task
    task-request-id:
      type: string
      maxLength: 20
      minLength: 20
      description: The request ID associated with the task
    task-created-at:
      description: The ISO 8601 formatted date and time when the object was created
      type: string
      format: date-time
      readOnly: true
    task-updated-at:
      description: The ISO 8601 formatted date and time when the object was last updated
      type: string
      format: date-time
      readOnly: true
    task-type:
      type: string
      enum:
        - QUESTION
        - APPROVAL
        - TODO
      description: The type of the task
    task-sparse:
      type: object
      description: Sparse representation of a Task resource
      properties:
        id:
          $ref: '#/components/schemas/task-id'
        assignees:
          type: array
          description: List of task assignees that perform actions on the task
          items:
            $ref: '#/components/schemas/task-assignees'
        status:
          $ref: '#/components/schemas/task-status'
        label:
          type: string
          nullable: false
          description: Human readable label for the task
          minLength: 1
        requestId:
          $ref: '#/components/schemas/task-request-id'
        createdAt:
          $ref: '#/components/schemas/task-created-at'
        updatedAt:
          $ref: '#/components/schemas/task-updated-at'
        type:
          $ref: '#/components/schemas/task-type'
        value:
          type: string
          nullable: true
          description: The value of the task completion that's determined by the assignee
      required:
        - id
        - assignees
        - label
        - requestId
        - createdAt
        - updatedAt
        - status
        - type
    task-list-links:
      type: object
      description: Links available in task list response
      required:
        - self
      properties:
        self:
          $ref: '#/components/schemas/link'
        next:
          $ref: '#/components/schemas/link'
    task-list:
      type: object
      properties:
        data:
          description: All tasks on the current page
          type: array
          items:
            $ref: '#/components/schemas/task-sparse'
        _links:
          $ref: '#/components/schemas/task-list-links'
    task-is-escalated:
      type: boolean
      description: Indicates whether a task is escalated to another user. See [Escalate Tasks](https://help.okta.com/okta_help.htm?type=oie&id=csh-escl-task) in the product documentation.
    task-is-delegated:
      type: boolean
      description: Indicates whether a task is delegated to another user. See [Governance delegates](https://help.okta.com/okta_help.htm?type=oie&id=csh-governance-delegates) in the product documentation.
    task-completed-by:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      required:
        - externalId
        - type
      description: The assignee who fulfilled the task
      properties:
        externalId:
          $ref: '#/components/schemas/okta-id'
        type:
          $ref: '#/components/schemas/principal-type'
    task-full:
      type: object
      x-okta-ignore-redocly-rules-for-sdk: true
      description: Full representation of a task.
      allOf:
        - $ref: '#/components/schemas/task-sparse'
        - type: object
          properties:
            isEscalated:
              $ref: '#/components/schemas/task-is-escalated'
            isDelegated:
              $ref: '#/components/schemas/task-is-delegated'
            originalAssigneeId:
              type: string
              nullable: true
              description: ID of the original assignee before delegation or escalation
              minLength: 20
              format: okta-user-id
            completedBy:
              $ref: '#/components/schemas/task-completed-by'
      required:
        - id
        - assignees
        - label
        - requestId
        - createdAt
        - updatedAt
        - status
        - type
  parameters:
    conditions-list-filter:
      name: filter
      description: |
        Apply various filters by using supported condition filtering properties.

        **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/scim-filter'
      x-scim-filter:
        approvalSequenceId:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/approval-sequence-id'
      examples:
        FilterBySequence:
          summary: Filter conditions that reference the specified sequence id
          value: approvalSequenceId eq "61eb0f06c462d20007f051ac"
    request-condition-id:
      name: requestConditionId
      description: Unique identifier for the request condition
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/request-condition-id'
    resource-id-orn-or-okta:
      name: resourceId
      description: Unique identifier for the resource in Okta instance ID format or [ORN format](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#okta-resource-name-orn)
      in: path
      required: true
      schema:
        type: string
    sequence-id-parameter:
      name: sequenceId
      description: The `id` of the sequence
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/sequence-id'
    request-list-filter:
      name: filter
      description: |
        Apply various filters by using supported request filtering properties.

        **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/scim-filter'
      x-scim-filter:
        status:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/request-status'
        grantStatus:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/request-grant-status'
        lastUpdated:
          operators:
            - gt
          schema:
            $ref: '#/components/schemas/last-updated'
        requestedFor:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/user-id'
        resourceId:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/resource-id'
        resourceType:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/resource-type'
        accessScopeId:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/access-scope-id'
        accessScopeType:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/access-scope-type'
      examples:
        FilterByStatus:
          summary: Filter by status
          value: status eq "APPROVED"
        FilterByLastUpdated:
          summary: Filter by lastUpdated
          value: lastUpdated gt "2022-05-24T14:15:22Z"
        FilterByResourceId:
          summary: Filter by resourceId
          value: resourceId eq "0oafxqCAJWWGELFTYASJ"
        FilterByResourceType:
          summary: Filter by resourceType
          value: resourceType eq "APPLICATION"
        FilterByAccessScopeId:
          summary: Filter by accessScopeId
          value: accessScopeId eq "0oafxqCAJWWGELFTYASJ"
        FilterByAccessScopeType:
          summary: Filter by accessScopeType
          value: accessScopeType eq "APPLICATION"
        FilterByRequestedFor:
          summary: Filter by requestedFor
          value: requestedFor eq "00ub0oNGTSWTBKOLGLNR"
        FilterByStatus-ResourceId:
          summary: Filter by status, resourceId
          value: status eq "RESOLVED" AND resourceId eq "0oafxqCAJWWGELFTYASJ"
    request-list-after:
      name: after
      description: The after cursor provided by a prior request.
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/rcar-request-id'
    limit:
      name: limit
      description: The maximum number of records returned in a response
      in: query
      required: false
      schema:
        type: integer
        default: 20
        maximum: 200
        minimum: 1
    request-list-order-by:
      name: orderBy
      description: |
        Apply an ordering of requests by specifying a supported request property name with `%20asc` or `%20desc` suffix.

        **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding)
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/order-by'
      x-order-by:
        attributes:
          - created
          - lastUpdated
      examples:
        OrderByCreated:
          summary: Order by created
          value: created desc
        OrderByLastUpdated:
          summary: Order by lastUpdated
          value: lastUpdated desc
    rcar-request-id-parameter:
      name: requestId
      description: Unique identifier for the Resource-Centric Access Requests (RCAR) request
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/rcar-request-id'
    rcar-entries-list-filter-v2:
      name: filter
      description: |
        A required [filter](https://developer.okta.com/docs/api/#filter) expression that returns entries based on the [`parent`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Catalogs/#tag/Catalogs/operation/listAllDefaultEntriesV2!c=200&path=data/parent&t=response) property:
        * This filter expression only supports the `parent` property and the `eq` and `pr` [operators](https://developer.okta.com/docs/api/#operators).
        * If you want the query to return child entries, then you must specify the `parent` ID with the `eq` operator.

        > **Notes:**
        > * If you don't use the `parent` property in the filter expression, undesireable results are returned.
        > * Query parameter percent encoding is required. See [Special characters]( https://developer.okta.com/docs/api/#special-characters ).
      in: query
      required: true
      schema:
        type: string
        format: scim-filter
        example: not(parent pr)
      x-scim-filter:
        parent:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/catalog-entry-id'
    rcar-entries-list-after:
      name: after
      description: |-
        The [pagination](https://developer.okta.com/docs/api/#pagination) cursor that points to the last record of the previous response.

        The maximum number of entries returned in a response is determined by the [`limit`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.admin.v2/tag/Catalogs/#tag/Catalogs/operation/listAllDefaultEntriesV2!in=query&path=limit&t=request) query parameter.
        If there are more entries to return, the `_links.next.href` link contains the `after` cursor for the next page of results.
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/catalog-entry-id'
    rcar-entries-list-match:
      name: match
      description: Return catalog entries that match a substring value in the [`name`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.enduser.v2/tag/My-Catalogs/#tag/My-Catalogs/operation/listMyDefaultEntriesV2!c=200&path=data/name&t=response) or [`description`](https://developer.okta.com/docs/api/iga/openapi/governance.requests.enduser.v2/tag/My-Catalogs/#tag/My-Catalogs/operation/listMyDefaultEntriesV2!c=200&path=data/description&t=response) properties. At least three characters are required for fuzzy search.
      in: query
      required: false
      schema:
        type: string
        minLength: 3
        maxLength: 50
        example: figma
    rcar-entries-list-limit:
      name: limit
      description: The maximum number of records returned in a response
      in: query
      required: false
      schema:
        type: integer
        maximum: 200
        minimum: 1
        example: 20
    catalog-entry-id:
      name: entryId
      description: Unique identifier for the catalog entry
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/catalog-entry-id'
    user-id:
      name: userId
      description: Unique identifier for the user
      in: path
      required: true
      schema:
        type: string
        maxLength: 20
        minLength: 20
        example: 00ucvnr9rbONeZdRp1d7
    requesters-id:
      name: requesterSetId
      description: The unique `id` that represents a list of requesters for access requests
      in: path
      required: true
      schema:
        type: string
        maxLength: 50
        minLength: 20
        example: 6773596f7190a40006a1f9af
    task-list-filter:
      name: filter
      description: |
        A [filter](https://developer.okta.com/docs/api/#filter) expression that filters a collection of tasks in the response.
        The filter expression supports the following properties and [operators](https://developer.okta.com/docs/api/#operators):

        - `status`: The status of the task. Possible values: `OPEN`, `COMPLETED`, `ASSIGNING`, and `LOCKED`. Supports the `eq` operator.
        - `type`: The type of the task. Possible values: `QUESTION`, `APPROVAL`, and `TODO`. Supports the `eq` operator.
        - `assigneeId`: The Okta user ID of the task assignee. Supports the `eq` operator.
        - `requestId`: The ID of the request for the task. Supports the `eq` operator.
        - `createdAt`: The task created time. Supports the `gt`, `ge`, `le`, and `lt` operators.
        - `updatedAt`: The latest task updated time. Supports the `gt`, `ge`, `le`, and `lt` operators.

        > **Note**: Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/scim-filter'
      x-scim-filter:
        status:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/task-status'
        type:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/task-type'
        assigneeId:
          operators:
            - eq
          schema:
            type: string
            maxLength: 20
            minLength: 20
            description: the Okta ID of the task assignee
        requestId:
          operators:
            - eq
          schema:
            $ref: '#/components/schemas/task-request-id'
        createdAt:
          operators:
            - gt
            - ge
            - le
            - lt
          schema:
            $ref: '#/components/schemas/task-created-at'
        updatedAt:
          operators:
            - gt
            - ge
            - le
            - lt
          schema:
            $ref: '#/components/schemas/task-updated-at'
      examples:
        FilterByStatus:
          summary: Filter by status
          value: status eq "OPEN"
        FilterByType:
          summary: Filter by type
          value: type eq "QUESTION"
        FilterByAssigneeId:
          summary: Filter by assigneeId
          value: assigneeId eq "0oafxqCAJWWGELFTYASJ"
        FilterByRequestId:
          summary: Filter by requestId
          value: requestId eq "0oafxqCAJWWGELFTYASJ"
        FilterByCreatedAt:
          summary: Filter by createdAt
          value: createdAt gt "2022-05-24T14:15:22Z"
        FilterByUpdatedAt:
          summary: Filter by updatedAt
          value: updatedAt gt "2022-05-24T14:15:22Z"
    task-list-after:
      name: after
      description: |
        Specifies the pagination cursor for the next page of results. Treat this as an opaque value obtained through the standard link headers. See [pagination](https://developer.okta.com/docs/api/#pagination).
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/task-id'
    task-list-order-by:
      name: orderBy
      description: |
        Specifies a property to sort the results. The following properties are supported:
        - `createdAt`
        - `updatedAt`

        Append `desc` or `asc` to indicate the sorting direction.
        > **Note:** Query parameter percent encoding is required. See [Percent-encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
      in: query
      required: false
      schema:
        $ref: '#/components/schemas/order-by'
      x-order-by:
        attributes:
          - createdAt
          - updatedAt
      examples:
        OrderByCreated:
          summary: Order by created
          value: createdAt desc
        OrderByLastUpdated:
          summary: Order by updatedAt
          value: updatedAt desc
    task-id-parameter:
      name: taskId
      description: The `id` of the task
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/task-id'
  headers:
    link:
      required: false
      description: |-
        A link to `self` and `next`.
        > **Note:** `next` is only present if there's another page of results.
      schema:
        type: string
    rate-limit-limit:
      required: true
      description: The rate-limit ceiling for the current request
      schema:
        type: integer
        minimum: 1
        example: 60
    rate-limit-remaining:
      required: true
      description: The number of requests left for the current rate-limit window
      schema:
        type: integer
        minimum: 0
        example: 60
    rate-limit-reset:
      required: true
      description: The time when the rate limit resets, specified in UTC epoch time (in seconds)
      schema:
        type: integer
        minimum: 0
        example: 1609459200
  responses:
    request-conditions-get-success:
      description: A successful request condition list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-conditions-list'
    authentication-error-response:
      description: Authentication fails error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    authorization-error-response:
      description: Authorization fails error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000004
            errorSummary: You don't have permission to perform the requested action.
            errorLink: E0000004
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    resource-not-found-response:
      description: The requested resource wasn't found error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000007
            errorSummary: Resource not found exception
            errorLink: E0000007
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    rate-limit-exceeded-response:
      description: The rate limit has been exceeded error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000047
            errorSummary: The API call exceeded the rate limit due to too many requests.
            errorLink: E0000047
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    unexpected-error-response:
      description: Error response when a server fault occurs due to an unexpected error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
          example:
            errorCode: E0000009
            errorSummary: Internal Server Error
            errorLink: E0000009
            errorId: oaeWCGz73hpRCG75VHP6-RRXw
            errorCauses: []
    request-condition-get-success:
      description: A successful request condition get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-full'
    resource-request-conditions-get-success:
      description: A successful request condition list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-conditions-list'
    request-condition-create-success:
      description: A successful response for creating request condition
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-full'
    request-condition-create-bad-request:
      description: An invalid request to create a request type
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    resource-request-condition-get-success:
      description: A successful resource request condition get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-full'
    request-condition-delete-success-response:
      description: A successful request condition delete response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
    request-condition-patch-success-response:
      description: A successful request condition patch response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-full'
    request-condition-activate-success-response:
      description: A successful request condition activate response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-full'
    request-condition-activate-conflict-response:
      description: A conflict request condition activate response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-condition-deactivate-success-response:
      description: A successful request condition deactivate response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-full'
    request-condition-deactivate-conflict-response:
      description: A conflict request condition deactivate response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-condition-service-status-get-success:
      description: A successful request condition service status get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-condition-service-status'
    request-settings-get-success:
      description: A successful request settings get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-settings'
    resource-request-settings-patch-success:
      description: A successful request settings patch response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-settings'
    resource-request-settings-patch-bad-request-response:
      description: When request settings fails as bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    org-request-settings-get-success:
      description: A successful org request settings get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/org-request-settings'
    org-request-settings-patch-success:
      description: A successful org request settings patch response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/org-request-settings-patchable'
    request-sequences-get-success:
      description: A successful request sequences list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-sequences-list'
    request-sequence-get-success:
      description: A successful request sequence get response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-sequence'
    request-sequence-delete-success-response:
      description: A successful request sequence delete response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
    requests-list-success:
      description: A successful request list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-list'
    requests-list-bad-request:
      description: An invalid request to list requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-create-success-response:
      description: Response when create request is accepted
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-submission-full'
      headers:
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
    request-create-bad-request-response:
      description: An invalid request to create a request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-create-forbidden-response:
      description: When authorization fails
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-create-conflict-response:
      description: A conflict with the request type prevents the create request operation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    request-get-success:
      description: A successful get request response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-full'
    request-update-success:
      description: A successful update request response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/request-full'
    request-update-failed:
      description: When the update failed because the request status is terminal, or the request body is invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    catalog-entries-list-success-v2:
      description: List of all entries in the resource catalog
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/rcar-entries-list-v2'
    rcar-entries-list-bad-request:
      description: An invalid list request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    rcar-entry-get-success:
      description: List of all entries in the resource catalog
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/rcar-entry-get'
    list-bad-request:
      description: An invalid list request error response
      content:
        application/json:
          schema:
            x-okta-ignore-redocly-rules-for-sdk: true
            $ref: '#/components/schemas/error'
    request-fields-get-success:
      description: Get requester fields for an entry
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/catalog-entry-request-fields'
    requesters-by-id-patch-success:
      description: Requester members updated successfully response.
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/requesters-full'
    bad-request:
      description: A request failed validation
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    tasks-list-success:
      description: A successful tasks list response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-list'
    tasks-list-bad-request:
      description: An invalid request to list tasks
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    task-get-success:
      description: A successful get task response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-full'
    task-update-success:
      description: A successful update task response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-full'
    task-update-failed:
      description: When the task update fails due to closed task status or bad request body (e.g. invalid assignee ids)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'
    task-resolve-success:
      description: A successful resolve task response
      headers:
        Link:
          $ref: '#/components/headers/link'
        X-Rate-Limit-Limit:
          $ref: '#/components/headers/rate-limit-limit'
        X-Rate-Limit-Remaining:
          $ref: '#/components/headers/rate-limit-remaining'
        X-Rate-Limit-Reset:
          $ref: '#/components/headers/rate-limit-reset'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/task-full'
    task-resolve-failed:
      description: When the task resolution fails due to task already being closed or bad request body
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error'