opa-oneOfInheritance-noExamples.yaml

openapi: 3.0.2
info:
  contact:
    email: support@okta.com
    name: Okta Support
    url: https://support.okta.com
  description: The Okta Privileged Access API is a control plane used to request operations in Okta Privileged Access (formerly ScaleFT/Advanced Server Access)
  termsOfService: https://www.okta.com/agreements/
  title: Okta Privileged Access
  version: 1.0.0
servers:
  - url: https://{org_name}.pam.okta.com
    description: Production server
    variables:
      org_name:
        default: '{org_name}'
        description: The name of your Okta org
tags:
  - name: active-directory-accounts
    x-displayName: Active Directory Accounts
    description: |-
      <x-lifecycle class="ea"></x-lifecycle>

      The Active Directory (AD) Accounts API provides operations for managing discovered AD accounts and account mappings.
  - name: active-directory-connections
    x-displayName: Active Directory Connections
    description: |-
      <x-lifecycle class="ea"></x-lifecycle>

      The Active Directory (AD) Connections API provides create, read, update, and delete (CRUD) operations for AD connections.
  - name: attributes
    x-displayName: Attributes
    description: The Attributes API allows you to control specific settings for Okta Privileged Access users and groups.
  - name: clients
    x-displayName: Clients
    description: |-
      An Okta Privileged Access client corresponds to a specific device. Clients are the primary way users access Okta Privileged Access resources.

      See [Okta Privileged Access clients](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-clients).
  - name: gateways
    x-displayName: Gateways
    description: |-
      An Okta Privileged Access gateway controls access to servers in your project.

      See [Okta Privileged Access gateways](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-gateways).
  - name: groups
    x-displayName: Groups
    description: |-
      An Okta Privileged Access group is a collection of users that share permissions and access to resources.

      See [Groups](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-groups).
  - name: mfa-approvals
    x-displayName: MFA Approvals
    description: The MFA Approvals API provides operations to create MFA approvals and to check the state of an approval.
  - name: okta-universal-directory-accounts
    x-displayName: Okta Universal Directory Accounts
    description: The Okta Universal Directory Accounts API provides operations to manage Universal Directory accounts for Okta Privileged Access teams
  - name: projects
    x-displayName: Projects
    description: |-
      An Okta Privileged Access project is a collection of resources that share settings.

      See [Projects](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-projects).
  - name: random-password-generation
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    x-displayName: Random Password Generation
    description: The Random Password Generation API provides operations to generate a random password.
  - name: reports
    x-displayName: Access Reports
    description: The Access Reports API is a convenient way of generating reports on users and resources for your team. You can use Okta Workflows to interact with these operations and store generated reports in a Workflows Table.
  - name: resource-groups
    x-displayName: Resource groups
    description: |-
      An Okta Privileged Access resource group is a collection of projects.

      See [Resource groups](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-resource-groups).
  - name: saas-app-accounts
    x-displayName: SaaS Application Accounts
    description: The SaaS Application Accounts API provides operations to manage SaaS app accounts for Okta Privileged Access teams.
  - name: secrets
    x-displayName: Secrets
    description: |-
      The Secrets API provides operations to manage Secrets for Okta Privileged Access teams. Secrets are encrypted key-value pairs used to store sensitive information.

      See [Secrets](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-secrets).
  - name: security-policy
    x-displayName: Security Policy
    description: |-
      The Security Policy API provides operations to manage security policies for Okta Privileged Access teams. Security policies control which user groups can access resources and any methods they can use to connect. Security policy operations use several nested objects to correctly define a created policy.

      See [Security policy](https://help.okta.com/okta_help.htm?type=oie&id=ext-pam-policy).
  - name: server-accounts
    x-displayName: Server Accounts
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    description: The Server Accounts API provides operations to manage server accounts for Okta Privileged Access teams.
  - name: servers
    x-displayName: Servers
    description: The Servers API provides operations related to servers enrolled in an Okta Privileged Access project.
  - name: service-users
    x-displayName: Service Users
    description: An Okta Privileged Access service user is used to access the Okta Privileged Access API. Each service user is provided tokens, which authenticate and authorize against the service.
  - name: staged-service-accounts
    x-displayName: Staged Service Accounts
    description: The Staged Service Accounts API provides admin operations to set up SaaS app accounts and Universal Directory accounts for Okta Privileged Access teams.
  - name: sudo-commands
    x-displayName: Sudo Commands
    description: The Sudo Commands API provides operations to manage a set of sudo commands (sudo command bundles). You can create any number of bundles, but each bundle can only contain up to 64 commands. You control the order of sudo command bundles by the name of each bundle. See [Sudo command bundle](https://help.okta.com/oie/en-us/okta_help.htm#cshid=csh-pam-sudo-commands).
  - name: teams
    x-displayName: Teams
    description: The top-level organizational container. Each team maps to a single app in the Okta dashboard.
  - name: users
    x-displayName: Users
    description: A user corresponds to a human or service user in an Okta Privileged Access team
  - name: workload-connections
    x-displayName: Workload Connections
    description: The Workload Connections API provides operations to manage workload connections for Okta Privileged Access teams.
  - name: workload-roles
    x-displayName: Workload Roles
    description: The Workload Roles API provides operations to manage workload roles for Okta Privileged Access teams.
paths:
  /v1/resolve:
    post:
      summary: Resolve resource names
      description: Resolves enrolled resource names and returns any associated information and user access methods (UAMs)
      operationId: ResolveResource
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResolveResourceNamesRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResolveResourceNamesResponse'
          description: OK
      tags:
        - servers
  /v1/teams/{team_name}/access_reports:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all access reports
      description: Lists all access reports
      operationId: ListAccessReports
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAccessReportsResponse
                type: object
                properties:
                  list:
                    items:
                      type: array
                      items:
                        $ref: '#/components/schemas/AccessReport'
      tags:
        - reports
    post:
      x-okta-opa-roles:
        - security_admin
      summary: Create an access report
      description: Create an access report. Each report must be connected to a specific user or resource.
      operationId: CreateAccessReport
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessReportCreateTarget'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessReport'
      tags:
        - reports
  /v1/teams/{team_name}/access_reports/{access_report_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/access_report_id'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: Retrieve an access report
      description: Retrieve the metadata of the specified access report
      operationId: GetAccessReport
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessReport'
      tags:
        - reports
  /v1/teams/{team_name}/access_reports/{access_report_id}/report:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/access_report_id'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: Download an access report
      description: Downloads the specific access report for review. The CSV formatted report is included in the response.
      operationId: DownloadAccessReport
      responses:
        '200':
          description: OK
          content:
            text/csv:
              schema:
                type: string
                description: The CSV formatted access report
      tags:
        - reports
  /v1/teams/{team_name}/active_directory:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: List all Active Directory domains
      description: Lists all Active Directory domains that you (as the request user) can access based on the security policies
      operationId: ListActiveDirectoryDomains
      parameters:
        - description: Filter by domain name
          explode: true
          in: query
          name: domain
          required: false
          schema:
            type: string
            example: myokta.local
          style: simple
        - name: contains
          description: <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>Filters for domain name where the name contains the search string
          in: query
          required: false
          schema:
            type: string
            minLength: 1
            maxLength: 255
            pattern: ^[\w\-_.]+$
            example: admin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListActiveDirectoryDomainsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryDomain'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/active_directory/{ad_connection_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: Retrieve an Active Directory connection
      description: Retrieves an Active Directory connection that you (as the request user) can access
      operationId: GetActiveDirectoryDomainEndUser
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryDomain'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/active_directory/{ad_connection_id}/accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/account_name'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: List all Active Directory accounts within a connection
      description: Lists all Active Directory accounts within a connection that you (as the request user) can access
      operationId: ListActiveDirectoryAccountsEndUser
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListActiveDirectoryAccountsEndUserResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryAccountEndUserList'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/active_directory/{ad_connection_id}/accounts/{ad_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: Retrieve an Active Directory account
      description: Retrieves an Active Directory account that you (as the request user) can access
      operationId: GetActiveDirectoryAccountEndUser
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountEndUser'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/active_directory/{ad_connection_id}/accounts/{ad_account_id}/reveal_credentials:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_id'
    post:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: Reveal the password for Active Directory account
      description: Reveals the password belonging to an Active Directory account that you (as the request user) can access
      operationId: revealActiveDirectoryAccountPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryAccountsRevealCredentialsRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountsRevealCredentialsResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/active_directory/{ad_connection_id}/accounts/{ad_account_id}/rotate_password:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_id'
    post:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: Rotate the password for Active Directory account
      description: Rotates the password belonging to an Active Directory account that you (as the request user) can access
      operationId: rotateActiveDirectoryAccountPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryAccountsRotatePasswordRequest'
        required: true
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/active_directory/{ad_connection_id}/accounts/{ad_account_id}/user_access_methods:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: List all user access methods for an Active Directory account
      description: Lists all user access methods for an Active Directory (AD) account based on the security policies
      operationId: ListUAMForActiveDirectoryAccount
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListUAMForActiveDirectoryAccountResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/all_active_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/contains'
      - $ref: '#/components/parameters/ad_account_type'
      - $ref: '#/components/parameters/ad_connection_ids'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - security_admin
      summary: List all Active Directory accounts
      description: Lists all Active Directory accounts
      operationId: ListAllActiveDirectoryAccountsForSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllActiveDirectoryAccountsForSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryAccount'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/all_okta_universal_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/contains'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all Universal Directory accounts
      description: Lists all Universal Directory accounts
      operationId: ListAllOktaUniversalDirectoryAccountsForSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllOktaUniversalDirectoryAccountsForSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/OktaUniversalDirectoryAccount'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/all_saas_app_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/contains'
      - name: managed
        description: If `true`, only return SaaS app accounts that support password rotation. If `false`, only return SaaS app accounts that do not support password rotation.
        in: query
        schema:
          type: boolean
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/descending'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/prev'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all SaaS app accounts
      description: Lists all SaaS app accounts
      operationId: ListAllSaasAppAccountsForSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllSaasAppAccountsForSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SaasAppAccount'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/all_server_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all server account resources
      description: Lists all server account resources
      operationId: ListAllServerAccountResourcesForSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllServerAccountResourcesForSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServerAccounts'
      tags:
        - servers
  /v1/teams/{team_name}/all_servers:
    parameters:
      - $ref: '#/components/parameters/id'
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id_query'
      - $ref: '#/components/parameters/project_id_query'
      - $ref: '#/components/parameters/hostname'
      - $ref: '#/components/parameters/hostname_contains'
      - $ref: '#/components/parameters/os_type'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all servers
      description: Lists all servers for your team
      operationId: ListAllServersForAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllServersForAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Server'
      tags:
        - servers
  /v1/teams/{team_name}/attributes/conflicts:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
      summary: List all attribute conflicts for a team
      description: Lists all attribute conflicts for a team
      operationId: ListTeamUserAttributeConflicts
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListTeamUserAttributeConflictsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/TeamUserAttributeConflict'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - attributes
  /v1/teams/{team_name}/attributes/options:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all attribute options
      description: Lists all attribute options configured for the team, such as `unix_uid` or `unix_gid` ranges
      operationId: ListAttributeOptions
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListAttributeOptionsResponse
                type: object
                properties:
                  list:
                    type: array
                    items:
                      $ref: '#/components/schemas/AttributeOption'
                    description: List of attribute options for the team
          description: OK
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
      tags:
        - attributes
  /v1/teams/{team_name}/attributes/options/{namespace}/{attribute_name}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - in: path
        name: namespace
        required: true
        schema:
          type: string
        description: Namespace for the attribute option. Valid values are `user` or `group`.
      - in: path
        name: attribute_name
        required: true
        schema:
          type: string
        description: |
          Attribute name. Valid values:
          * `unix_uid`, `unix_gid` (for `user` namespace)
          * `unix_gid` (for `group` namespace)
    get:
      x-okta-opa-roles:
        - security_admin
      summary: Retrieve an attribute option
      description: Retrieves the attribute range option for the specified namespace and attribute
      operationId: FetchAttributeOption
      parameters:
        - in: query
          name: exclude_defaults
          schema:
            type: boolean
            default: false
          required: false
          description: Specify `true` to return the non-default option. If only the default option exists, an HTTP 404 error is returned. Specify `false` to return any option available, including the default option.
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttributeOption'
          description: OK
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
      tags:
        - attributes
    put:
      x-okta-opa-roles:
        - security_admin
      summary: Upsert an attribute option
      description: Creates or updates the attribute option (the minimum and maximum range) for the specified namespace and attribute
      operationId: UpsertAttributeOption
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AttributeOption'
            example:
              namespace: user
              attribute_name: unix_uid
              details:
                min: 1001
                max: 4294967295
        required: true
      responses:
        '201':
          description: Created or updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AttributeOption'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
      tags:
        - attributes
    delete:
      x-okta-opa-roles:
        - security_admin
      summary: Delete an attribute option
      description: Deletes the attribute option for the specified namespace and attribute
      operationId: DeleteAttributeOption
      responses:
        '204':
          description: No Content
      tags:
        - attributes
  /v1/teams/{team_name}/checked_out_resources:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List all resources checked out by a user
      description: Lists all resources checked out by the current user
      operationId: ListAllCheckedOutResourcesByUser
      parameters:
        - name: resource_type
          description: 'If specified, only returns resources with a matching type. Valid resource types: `server_account_password_login`.'
          in: query
          schema:
            type: string
          required: false
        - name: include_pending_checkin
          description: If specified, also returns resources that have already started the checkin process. These are not included by default.
          in: query
          schema:
            type: boolean
          required: false
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllCheckedOutResourcesByUserResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/CheckedOutResourceByUserDetails'
      tags:
        - teams
  /v1/teams/{team_name}/checkin_resource:
    parameters:
      - $ref: '#/components/parameters/team_name'
    post:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - end_user
      summary: Check in a resource
      description: Checks in a resource that was previously checked out by a user
      operationId: SelfCheckinResource
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckinResourceRequest'
      responses:
        '204':
          description: No Content
      tags:
        - teams
  /v1/teams/{team_name}/clients:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - end_user
      summary: List all clients
      description: Returns a list of clients for your team. By default, this only returns clients associated with the requesting user. Use query parameters to adjust the list of returned clients.
      operationId: ListClients
      parameters:
        - name: all
          description: When `true`, returns all clients for the team
          in: query
          schema:
            type: boolean
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - name: state
          description: 'Only return clients with the specified state. Valid statuses: `ACTIVE`, `PENDING`, or `DELETED`.'
          in: query
          schema:
            type: string
        - name: username
          description: Only return clients assigned to the specified user. An empty string returns unassigned clients.
          in: query
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListClientsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Client'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - clients
  /v1/teams/{team_name}/clients/{client_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/client_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - end_user
      summary: Retrieve a client
      description: Retrieves the properties of a specified client
      operationId: FetchClient
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Client'
          description: OK
      tags:
        - clients
    put:
      x-okta-opa-roles:
        - resource_admin
      summary: Update a client
      description: Updates the state or assigned user for a specified client. This is required for some enrollment policies. See [Silently enroll the Client](https://help.okta.com/okta_help.htm?type=asa&id=ext-asa-enroll-sft-silent).
      operationId: UpdateClient
      requestBody:
        content:
          application/json:
            example:
              state: ACTIVE
              user_name: Jason.Compson.IV
            schema:
              $ref: '#/components/schemas/ClientUpdateRequest'
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - clients
    delete:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - end_user
      summary: Revoke access to a client
      description: Revokes access to a specified client from your team
      operationId: RemoveClient
      responses:
        '204':
          description: No Content
      tags:
        - clients
  /v1/teams/{team_name}/connections/active_directory:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - security_admin
      summary: List all Active Directory connections
      description: Lists all Active Directory connections
      operationId: listActiveDirectoryConnections
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                title: ListActiveDirectoryConnectionsResponse
                properties:
                  list:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryConnection'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-connections
  /v1/teams/{team_name}/connections/active_directory/{ad_connection_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - security_admin
      summary: Retrieve an Active Directory connection
      description: Retrieves an Active Directory connection
      operationId: getActiveDirectoryConnection
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryConnection'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-connections
  /v1/teams/{team_name}/connections/active_directory/{ad_connection_id}/status:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    put:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Update the status of an Active Directory connection
      description: Updates the status of an Active Directory connection. You can't create account assignment rules for this connection if the status is `disconnected`.
      operationId: updateActiveDirectoryConnectionStatus
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  $ref: '#/components/schemas/UpdateableADConnectionStatus'
      responses:
        '204':
          description: No content. Status successfully updated.
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-connections
  /v1/teams/{team_name}/connections/saas_apps:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/prev'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/descending'
      - $ref: '#/components/parameters/contains'
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: List all connected app instances for a team
      description: List all connected app instances for a team
      operationId: ListAppInstancesForTeam
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAppInstancesForTeamResponse
                properties:
                  list:
                    type: array
                    items:
                      $ref: '#/components/schemas/SaasApplicationInstance'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/connections/saas_apps/{saas_app_instance_id}:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve a single app instance
      description: Retrieves a single app instance connected to OPA for a team based on the app instance ID
      operationId: GetAppInstanceForTeam
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SaasApplicationInstance'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - saas-app-accounts
    patch:
      x-okta-opa-roles:
        - resource_admin
      summary: Update an app instance's password rotation strategy
      description: |-
        Updates the password rotation strategy for the app instance. Returns the updated app instance.
        > **Notes**:
        > Each app instance supports only one password rotation strategy. Don't change this strategy unless you fully understand the consequences. If you misconfigure it, you make accounts inaccessible and require manual recovery.
        > For most deployments, `USING_ADMIN` is the recommended default. Use `USING_EXISTING_PASSWORD` only for on-premise apps managed by the Okta Provisioning Agent that explicitly require the previous password to set a new one.
      operationId: PatchAppInstance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppPasswordRotationStrategyPatch'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SaasApplicationInstance'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/connections/workloads:
    x-okta-lifecycle:
      lifecycle: GA
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - devops_admin
        - security_admin
      summary: List all workload connections
      description: Lists all workload connections
      operationId: ListWorkloadConnections
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListWorkloadConnectionsResponse
                properties:
                  list:
                    type: array
                    description: The list of workload connections
                    items:
                      $ref: '#/components/schemas/WorkloadConnection'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
      tags:
        - workload-connections
    post:
      x-okta-opa-roles:
        - devops_admin
        - security_admin
      summary: Create a workload connection
      description: Creates a workload connection
      operationId: CreateWorkloadConnection
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkloadConnection'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadConnection'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
      tags:
        - workload-connections
  /v1/teams/{team_name}/connections/workloads/{workload_connection_id}:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/workload_connection_id'
    get:
      x-okta-opa-roles:
        - devops_admin
        - security_admin
      summary: Retrieve a workload connection
      description: Retrieves a workload connection by its ID
      operationId: GetWorkloadConnection
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadConnection'
          headers:
            ETag:
              description: Entity tag that identifies the resource version
              schema:
                type: string
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - workload-connections
    put:
      x-okta-opa-roles:
        - devops_admin
        - security_admin
      summary: Update a workload connection
      description: Updates a workload connection by its ID
      operationId: UpdateWorkloadConnection
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkloadConnection'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadConnection'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - workload-connections
    delete:
      x-okta-opa-roles:
        - devops_admin
        - security_admin
      summary: Delete a workload connection
      description: Deletes a workload connection by its ID
      operationId: DeleteWorkloadConnection
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - workload-connections
  /v1/teams/{team_name}/connections/workloads/{workload_connection_id}/status:
    x-okta-lifecycle:
      lifecycle: GA
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/workload_connection_id'
      - name: If-Match
        in: header
        required: true
        schema:
          type: string
        description: |
          The ETag value returned during the **Retrieve a workload connection** (GET) request for the workload connection
    put:
      x-okta-opa-roles:
        - security_admin
      summary: Update the status of a workload connection
      description: Updates the status of a workload connection
      operationId: UpdateWorkloadConnectionStatus
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateWorkloadConnectionStatusRequest'
      responses:
        '204':
          description: No content
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '412':
          description: Precondition failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionFailedResponse'
        '428':
          description: Precondition required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionRequiredResponse'
      tags:
        - workload-connections
  /v1/teams/{team_name}/current_user:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      summary: Retrieve user details
      description: Retrieves details about the current user
      operationId: GetCurrentUserInfo
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CurrentUserInfo'
          description: OK
      tags:
        - users
  /v1/teams/{team_name}/gateway_setup_tokens:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: List all gateway setup tokens
      description: Lists all gateway setup tokens for your team
      operationId: ListGatewaySetupTokens
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListGatewaySetupTokensResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/GatewaySetupToken'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - gateways
    post:
      x-okta-opa-roles:
        - resource_admin
      summary: Create a gateway setup token
      description: Creates a gateway setup token for your team
      operationId: CreateGatewaySetupToken
      requestBody:
        content:
          application/json:
            example:
              labels:
                env: dev
                region: us-west-2
            schema:
              $ref: '#/components/schemas/GatewaySetupToken'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GatewaySetupToken'
          description: Created
      tags:
        - gateways
  /v1/teams/{team_name}/gateway_setup_tokens/{gateway_setup_token_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/gateway_setup_token_id'
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve a gateway setup token
      description: Retrieves the specified gateway setup token
      operationId: FetchGatewaySetupToken
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GatewaySetupToken'
          description: OK
      tags:
        - gateways
    delete:
      x-okta-opa-roles:
        - resource_admin
      summary: Delete a gateway setup token
      description: Deletes the specified gateway setup token
      operationId: DeleteGatewaySetupToken
      responses:
        '204':
          description: No Content
      tags:
        - gateways
  /v1/teams/{team_name}/gateway_setup_tokens/{gateway_setup_token_id}/token:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/gateway_setup_token_id'
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve a gateway setup token
      description: Retrieves the specified gateway setup token
      operationId: FetchGatewaySetupTokenAsAgentToken
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GatewaySetupToken'
          description: OK
      tags:
        - gateways
  /v1/teams/{team_name}/gateways:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all gateways
      description: Lists all gateways for your team
      operationId: ListGateways
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListGatewaysResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/GatewayAgent'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - gateways
  /v1/teams/{team_name}/gateways/{gateway_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/gateway_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a gateway
      description: Retrieves the properties of a specified gateway
      operationId: GetGatewayInstance
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GatewayAgent'
          description: OK
      tags:
        - gateways
    put:
      x-okta-opa-roles:
        - resource_admin
      summary: Update a gateway
      description: Updates a specified gateway
      operationId: UpdateGatewayInstance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GatewayAgent'
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - gateways
    delete:
      x-okta-opa-roles:
        - resource_admin
      summary: Delete a gateway
      description: Deletes the specified gateway from your team
      operationId: DeleteGatewayInstance
      responses:
        '204':
          description: No Content
      tags:
        - gateways
  /v1/teams/{team_name}/gateways/{gateway_id}/status:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/gateway_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a status report for a gateway
      description: Retrieve a status report for the specified gateway
      operationId: GetGatewayStatusReport
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GatewayStatusReport'
          description: OK
      tags:
        - gateways
  /v1/teams/{team_name}/groups:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
        - delegated_resource_admin
      summary: List all groups for a team
      description: Lists all groups for your team
      operationId: ListGroups
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/id'
        - $ref: '#/components/parameters/ignore'
        - $ref: '#/components/parameters/include_deleted'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/only_include_deleted'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListGroupsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Group'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - groups
    post:
      x-okta-opa-roles:
        - pam_admin
      summary: Create a group
      description: Creates a group for your team. Groups allow you to assign RBAC roles to users and manage user access to resource groups and projects. To assign the `delegated_resource_admin` role, you need to add the group to the `delegated_resource_admin_groups` list for a specific resource group. See [Resource Groups](/openapi/opa/opa/tag/resource-groups).
      operationId: CreateGroup
      requestBody:
        content:
          application/json:
            example:
              deleted_at: null
              id: ''
              name: compsons
              roles:
                - pam_admin
                - resource_admin
            schema:
              $ref: '#/components/schemas/GroupCreate'
      responses:
        '201':
          content:
            application/json:
              example:
                deleted_at: '0001-01-01T00:00:00Z'
                id: b5a346c5-bafa-40eb-bb9f-401c0f57db36
                name: compsons
                roles:
                  - pam_admin
                  - resource_admin
              schema:
                $ref: '#/components/schemas/Group'
          description: Created
      tags:
        - groups
  /v1/teams/{team_name}/groups/{group_name}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/group_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
        - delegated_resource_admin
      summary: Retrieve a group
      description: Retrieves a specified group
      operationId: GetGroup
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
          description: OK
      tags:
        - groups
    put:
      x-okta-opa-roles:
        - pam_admin
      summary: Update a group
      description: Updates the access privileges of the specified group. To assign the `delegated_resource_admin` role, you need to add the group to the `delegated_resource_admin_groups` list for a specific resource group. See [Resource Groups](/openapi/opa/opa/tag/resource-groups).
      operationId: UpdateGroup
      requestBody:
        content:
          application/json:
            example:
              roles:
                - pam_admin
                - resource_admin
            schema:
              $ref: '#/components/schemas/GroupUpdate'
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - groups
    delete:
      x-okta-opa-roles:
        - pam_admin
      summary: Delete a group from a team
      description: Removes a group from your team. This also removes the group from any associated projects.
      operationId: RemoveGroup
      responses:
        '204':
          description: No Content
      tags:
        - groups
  /v1/teams/{team_name}/groups/{group_name}/attributes:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/group_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
      summary: List all attributes for a group
      description: Lists all attributes for a specified group
      operationId: ListGroupAttributes
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - $ref: '#/components/parameters/conflicting'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListGroupAttributesResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/TeamGroupAttribute'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - attributes
  /v1/teams/{team_name}/groups/{group_name}/attributes/{attribute_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/group_name'
      - $ref: '#/components/parameters/attribute_id'
    get:
      x-okta-opa-roles:
        - security_admin
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a group attribute
      description: Retrieves an attribute for a group.
      operationId: FetchGroupAttribute
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamGroupAttribute'
          description: OK
      tags:
        - attributes
    put:
      x-okta-opa-roles:
        - security_admin
      summary: Update a group attribute
      description: Updates an attribute for a group
      operationId: UpdateGroupAttribute
      requestBody:
        content:
          application/json:
            example:
              attribute_name: unix_group_name
              attribute_value: new_name
            schema:
              $ref: '#/components/schemas/UpdateGroupAttribute'
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - attributes
  /v1/teams/{team_name}/groups/{group_name}/users:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/group_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
        - delegated_resource_admin
      summary: List all users for a group
      description: Lists all users in a specified group
      operationId: ListUsersInGroup
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - $ref: '#/components/parameters/starts_with'
        - $ref: '#/components/parameters/status'
        - name: user_type
          description: 'Only return users of the specified type. Valid types: `human` and `service`.'
          in: query
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListUsersInGroupResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/User'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - groups
    post:
      x-okta-opa-roles:
        - pam_admin
      summary: Add a user to a group
      description: Adds a user to a group
      operationId: AddUserToGroup
      requestBody:
        content:
          application/json:
            example:
              name: Jason.Compson.IV
            schema:
              type: object
              properties:
                name:
                  description: The username of the user
                  maxLength: 255
                  minLength: 1
                  type: string
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - groups
  /v1/teams/{team_name}/groups/{group_name}/users/{user_name}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/group_name'
      - $ref: '#/components/parameters/user_name'
    delete:
      x-okta-opa-roles:
        - pam_admin
      summary: Remove a user from a group
      description: Removes a user from a group
      operationId: RemoveUserFromGroup
      responses:
        '204':
          description: No Content
      tags:
        - groups
  /v1/teams/{team_name}/mfa_approvals:
    parameters:
      - $ref: '#/components/parameters/team_name'
    post:
      summary: Create an MFA approval
      description: Creates an MFA approval
      operationId: createMFAApproval
      requestBody:
        content: {}
      responses:
        '201':
          description: Created
          content: {}
      tags:
        - mfa-approvals
  /v1/teams/{team_name}/okta_universal_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/prev'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/descending'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List all accessible Universal Directory service accounts
      description: Lists all Universal Directory service accounts that you (as the request user) can access based on the security policies
      operationId: ListOktaUDServiceAccountsEndUser
      parameters:
        - name: contains
          description: Filters for service accounts where the name contains the search string
          in: query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListServiceAccountsEndUserResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServiceAccountEndUser'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/okta_universal_directory_accounts/{okta_universal_directory_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/okta_universal_directory_account_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: Retrieve an Okta Universal Directory service account
      description: Retrieves an Okta Universal Directory service account that the user has access to based on the security policies
      operationId: GetOktaUDServiceAccountEndUser
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountEndUser'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/okta_universal_directory_accounts/{okta_universal_directory_account_id}/reveal_credentials:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/okta_universal_directory_account_id'
    post:
      x-okta-opa-roles:
        - end_user
      summary: Reveal the password for Universal Directory account
      description: Reveals the password for a Universal Directory account (managed and unmanaged) that you (as the request user) can access
      operationId: revealOktaUniversalDirectoryAccountPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountsRevealCredentialsRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountsRevealCredentialsResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenUAMResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/okta_universal_directory_accounts/{okta_universal_directory_account_id}/rotate_password:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/okta_universal_directory_account_id'
    post:
      x-okta-opa-roles:
        - end_user
      summary: Rotate a Universal Directory account password
      description: Rotates the password for a Universal Directory account that the end user has access to
      operationId: oktaUDAccountRotatePassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountsRotateCredentialsRequest'
        required: true
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenUAMResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/okta_universal_directory_accounts/{okta_universal_directory_account_id}/user_access_methods:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/okta_universal_directory_account_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List the Universal Directory account user access methods
      description: Lists the user access methods for a Universal Directory account based on the security policies
      operationId: ListUAMForOktaUDAccount
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListUAMForServiceAccountResponse'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/random_password:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
    post:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: Generate a random password
      description: Generates a random password based on the request parameters provided
      operationId: CreateRandomPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RandomPasswordCreateRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RandomPasswordCreateResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
      tags:
        - random-password-generation
  /v1/teams/{team_name}/resolve_secret:
    parameters:
      - $ref: '#/components/parameters/team_name'
    post:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Resolve a secret or folder
      description: |-
        Resolves the ID or path for a secret or secret folder. Users must be authorized to perform this action by an existing security policy.

        To resolve the ID, the request must include the named path. To resolve the path, the request must include the ID.
      operationId: ResolveSecretOrFolder
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResolveSecretOrFolderRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResolveSecretOrFolderResponse'
          description: OK
      tags:
        - secrets
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: List all discovered Active Directory accounts
      description: Lists all discovered Active Directory accounts
      operationId: listActiveDirectoryAccounts
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - name: contains_account_name_or_assigned_opa_user
          description: <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>Filters for AD accounts where the User Principal Name (UPN), Security Account Manager (SAM) name, or assigned user name that contains the search string
          in: query
          required: false
          schema:
            type: string
            minLength: 1
            maxLength: 255
            pattern: ^[\w\-_.]+$
            example: admin
          x-okta-lifecycle:
            lifecycle: EA
            isGenerallyAvailable: false
            SKUs: []
        - $ref: '#/components/parameters/include_user_access_methods'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListActiveDirectoryAccountsResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/accounts/{ad_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve a discovered Active Directory account
      description: Retrieves a particular discovered Active Directory account by ID
      operationId: getActiveDirectoryAccount
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountWithPasswordAndCheckoutDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/accounts/{ad_account_id}/match:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve an Active Directory account match
      description: |-
        Retrieves information about an Active Directory (AD) account that's matched with an Okta Privileged Access (OPA) user.
        This request is only valid for individual AD accounts, not shared accounts.
        AD account rules for this connection control the match between AD accounts and OPA users.
      operationId: getActiveDirectoryAccountMatch
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountMatchResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
    put:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Update an Active Directory account match
      description: |-
        Updates the Okta Privileged Access (OPA) user to match an Active Directory (AD) account
        and overrides any match configured from an AD account rule. This match override persists across any updates
        to the connection account rules.
      operationId: updateActiveDirectoryAccountMatch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryAccountMatchRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountMatchResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/force_sync:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    put:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Start Active Directory account force sync
      description: |-
        Starts Active Directory account force sync:
          * Updates the state of an Active Directory account managed by Okta Privileged Access with the state in Universal Directory AD apps
          * Performs account matching through configured account rules
          * Returns a conflict error if a sync is already running
      operationId: startActiveDirectoryAccountForceSync
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictResponse'
      tags:
        - active-directory-connections
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/rule_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve the Active Directory account rule settings
      description: Retrieves the Active Directory account rule settings
      operationId: getActiveDirectoryAccountRuleSettings
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountRuleSettings'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
    post:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Configure the Active Directory account rule settings
      description: Configures the Active Directory account rule settings that apply to the entire list of required account rules
      operationId: configureActiveDirectoryAccountRuleSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryAccountRuleSettings'
        required: true
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/rules:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: List all Active Directory account rules
      description: Lists all Active Directory account rules
      operationId: listActiveDirectoryAccountRules
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                title: ListActiveDirectoryAccountRulesResponse
                properties:
                  list:
                    type: array
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryAccountRuleResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
    post:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Create an Active Directory account rule
      description: Creates an Active Directory account rule
      operationId: createActiveDirectoryAccountRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryAccountRuleRequest'
        required: true
      responses:
        '200':
          description: No Content
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountRuleResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/rules/reorder:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    post:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Set the priority of Active Directory account rules
      description: Sets the priority of Active Directory account rules
      operationId: reorderActiveDirectoryAccountRules
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/ReorderActiveDirectoryAccountRuleRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                title: ReorderActiveDirectoryAccountRulesResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryAccountRuleResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/rules/{ad_account_rule_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
      - $ref: '#/components/parameters/ad_account_rule_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve an Active Directory account rule
      description: Retrieves an Active Directory account rule
      operationId: GetActiveDirectoryAccountRule
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountRuleResponse'
      tags:
        - active-directory-accounts
    put:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Update an Active Directory account rule
      description: Updates an Active Directory account rule
      operationId: UpdateActiveDirectoryAccountRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryAccountRuleRequest'
      responses:
        '204':
          description: No Content
      tags:
        - active-directory-accounts
    delete:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Delete an Active Directory account rule
      description: Deletes an Active Directory account rule
      operationId: DeleteActiveDirectoryAccountRule
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/active_directory/{ad_connection_id}/sync_status:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/ad_connection_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
      summary: Retrieve the Active Directory account sync status
      description: Retrieves the Active Directory account sync status
      operationId: getActiveDirectoryAccountSyncStatus
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ADAccountSyncStatus'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_assignment/universal_directory/accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - name: managed
        description: If `true`, only return staged accounts that support password rotation. If `false`, only return staged accounts that do not support password rotation.
        in: query
        schema:
          type: boolean
      - name: app_instance_id
        description: Only return staged accounts with the specified app instance IDs
        in: query
        schema:
          type: array
          items:
            type: string
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: List all staged service accounts from Okta Universal Directory
      description: Lists all SaaS and Okta service accounts from Okta Universal Directory that have not been assigned to a project or resource group
      operationId: ListStagedServiceAccounts
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListStagedServiceAccountsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/StagedServiceAccount'
      tags:
        - staged-service-accounts
  /v1/teams/{team_name}/resource_assignment/universal_directory/accounts/{staged_service_account_id}/assign/{project_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/staged_service_account_id'
      - $ref: '#/components/parameters/project_id'
    put:
      x-okta-opa-roles:
        - resource_admin
      summary: Assign a SaaS or Okta service account to a resource group and project
      description: |-
        Assigns a SaaS or Okta service account to a resource group and project.
        If the account can be actively managed, rotates the password for the account immediately.
      operationId: AssignStagedServiceAccount
      parameters:
        - name: skipRotation
          in: query
          description: If true, skips immediate password rotation when assigning the account
          schema:
            type: boolean
            default: false
          required: false
      responses:
        '204':
          description: No Content
      tags:
        - staged-service-accounts
  /v1/teams/{team_name}/resource_groups:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all resource groups
      description: Lists all resource groups available to the requesting user
      operationId: ListResourceGroups
      parameters:
        - name: order_by
          description: 'The field to sort the resource groups. Supported values: `name` or `id`'
          in: query
          schema:
            type: string
          required: false
        - name: for_policy_only
          description: Only list resource groups that this user may assign policies to
          in: query
          schema:
            type: boolean
          required: false
        - name: contains
          description: Only list resource groups whose name contains this substring
          in: query
          schema:
            type: string
          required: false
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ListResourceGroup'
                    type: array
                type: object
      tags:
        - resource-groups
    post:
      x-okta-opa-roles:
        - resource_admin
      summary: Create a resource group
      description: Creates a resource group for your team. To assign the `delegated_resource_admin` role, specify an existing group in the `delegated_resource_admin_groups` parameter.
      operationId: CreateResourceGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourceGroup'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceGroup'
      tags:
        - resource-groups
  /v1/teams/{team_name}/resource_groups/{resource_group_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a resource group
      description: Retrieves the specified resource group
      operationId: GetResourceGroup
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceGroup'
      tags:
        - resource-groups
    put:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Update a resource group
      description: Updates the specified resource group. To assign the `delegated_resource_admin` role, specify an existing group in the `delegated_resource_admin_groups` parameter.
      operationId: UpdateResourceGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourceGroup'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceGroup'
      tags:
        - resource-groups
    delete:
      x-okta-opa-roles:
        - resource_admin
      summary: Delete a resource group
      description: Deletes the specified resource group
      operationId: DeleteResourceGroup
      responses:
        '204':
          description: No Content
      tags:
        - resource-groups
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/all_active_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/contains'
      - $ref: '#/components/parameters/ad_account_type'
      - $ref: '#/components/parameters/ad_connection_ids'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: List all Active Directory accounts in a resource group
      description: Lists all Active Directory accounts in a resource group
      operationId: ListAllActiveDirectoryAccountsForDelegatedSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllActiveDirectoryAccountsForDelegatedSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryAccount'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/all_okta_universal_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/contains'
    get:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: List all Universal Directory account in a resource group
      description: Lists all Universal Directory accounts in a resource group
      operationId: ListAllOktaUniversalDirectoryAccountsForDelegatedSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllOktaUniversalDirectoryAccountsForDelegatedSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/OktaUniversalDirectoryAccount'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/all_saas_app_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/contains'
      - name: managed
        description: If `true`, only return SaaS app accounts that support password rotation. If `false`, only return SaaS app accounts that do not support password rotation.
        in: query
        schema:
          type: boolean
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/descending'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/prev'
    get:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: List all SaaS app accounts in a resource group
      description: Lists all SaaS app accounts in a resource group
      operationId: ListAllSaasAppAccountsForDelegatedSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllSaasAppAccountsForDelegatedSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SaasAppAccount'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/all_server_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
    get:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: List all server account resources in a resource group
      description: Lists all server account resources in a resource group
      operationId: ListAllServerAccountResourcesForDelegatedSecurityAdmin
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllServerAccountResourcesForDelegatedSecurityAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServerAccounts'
      tags:
        - servers
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/all_servers:
    parameters:
      - $ref: '#/components/parameters/id'
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id_query'
      - $ref: '#/components/parameters/hostname'
      - $ref: '#/components/parameters/hostname_contains'
      - $ref: '#/components/parameters/os_type'
    get:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: List all servers in a resource group
      description: Lists all servers in a resource group
      operationId: ListAllServersForResourceGroup
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupServersResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Server'
      tags:
        - servers
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all projects in a resource group
      description: Lists all projects in the specified resource group
      operationId: ListResourceGroupProjects
      parameters:
        - name: contains
          description: Only list projects whose name contains this substring
          in: query
          schema:
            type: string
            minLength: 1
            maxLength: 255
          required: false
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupProjects
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Project'
      tags:
        - projects
    post:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Create a project in a resource group
      description: Creates a project in the specified resource group
      operationId: CreateResourceGroupProject
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Project'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Project'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a project from a resource group
      description: Retrieves a project from a resource group
      operationId: FetchResourceGroupProject
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Project'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Update a project in a resource group
      description: Updates a project in a resource group
      operationId: UpdateResourceGroupProject
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Project'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Project'
      tags:
        - projects
    delete:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Delete a project from a resource group
      description: Deletes a project from a resource group
      operationId: RemoveResourceGroupProject
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/active_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/contains'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: List all Active Directory accounts in a project
      description: |-
        Lists all Active Directory accounts in a project in a resource group. The `contains` URL parameter
        filters by UPN.
      operationId: ListResourceGroupProjectActiveDirectoryAccounts
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupProjectActiveDirectoryAccountsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ActiveDirectoryAccountWithSettings'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/active_directory_accounts/{ad_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/ad_account_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve an Active Directory account in a resource group
      description: Retrieves an Active Directory account in a resource group project
      operationId: GetActiveDirectoryAccountDetails
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryAccountWithPasswordAndCheckoutDetails'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - active-directory-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/active_directory_checkout_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve the checkout settings for an Active Directory account resource group project
      description: Retrieves the checkout settings configured for a resource group project that's specific to the Active Directory account
      operationId: FetchResourceGroupActiveDirectoryBasedProjectCheckoutSettings
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryCheckoutSettings'
      tags:
        - projects
    put:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Update the checkout settings for an Active Directory account resource group project
      description: Updates the checkout settings configured for a resource group project that's specific to the Active Directory account
      operationId: UpdateResourceGroupActiveDirectoryBasedProjectCheckoutSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryCheckoutSettings'
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/active_directory_password_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a project password policy for Active Directory resources
      description: Retrieves a project password policy for Active Directory resources in a resource group
      operationId: GetProjectPasswordPolicyForActiveDirectoryResources
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryPasswordPolicy'
      tags:
        - projects
    put:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Update a project password policy for Active Directory resources
      description: Updates a project password policy for Active Directory resources in a resource group
      operationId: UpdateProjectPasswordPolicyForActiveDirectoryResources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActiveDirectoryPasswordPolicy'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActiveDirectoryPasswordPolicy'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/checked_out_resources:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: List all resources checked out in a project
      description: Lists all the resources that are currently checked out within a specified resource group project
      operationId: ListAllCheckedOutResourcesByAdmin
      parameters:
        - name: resource_type
          description: 'If specified, only returns resources with a matching type. Valid resource types: `server_account_password_login`, `managed_saas_app_account_password_login`, `okta_universal_directory_account_password_login`.'
          in: query
          schema:
            type: string
          required: false
        - name: include_pending_checkin
          description: If specified, also returns resources that have already started the checkin process. These are not included by default.
          in: query
          schema:
            type: boolean
          required: false
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListAllCheckedOutResourcesByAdminResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/CheckedOutResourceByAdminDetails'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/checkin_resource:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    post:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Check in a resource
      description: Checks in a resource (forcefully). As an admin, use this request to return a resource that any user has checked out.
      operationId: AdminCheckinResource
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CheckinResourceRequest'
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/okta_universal_directory_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/contains'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all Universal Directory accounts in a resource group project
      description: Lists all Universal Directory accounts in a resource group project
      operationId: ListResourceGroupProjectOktaUniversalDirectoryAccounts
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupProjectOktaUniversalDirectoryAccountsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/OktaUniversalDirectoryAccountWithSettings'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/okta_universal_directory_accounts/{okta_universal_directory_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/okta_universal_directory_account_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve a Universal Directory account
      description: Retrieves a Universal Directory account from a resource group project
      operationId: GetOktaUniversalDirectoryAccountDetails
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OktaUniversalDirectoryAccountDetails'
      tags:
        - okta-universal-directory-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/okta_universal_directory_checkout_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve the checkout settings for a Universal Directory resource group project
      description: Retrieves the checkout settings configured for a resource group project that's specific to the Universal Directory
      operationId: FetchResourceGroupOktaUniversalDirectoryBasedProjectCheckoutSettings
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIServiceAccountCheckoutSettings'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Update the checkout settings for a Universal Directory resource group project
      description: Updates the checkout settings configured for a resource group project that's specific to the Universal Directory
      operationId: UpdateResourceGroupOktaUniversalDirectoryBasedProjectCheckoutSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APIServiceAccountCheckoutSettings'
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/okta_universal_directory_password_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a project password policy for Universal Directory resources
      description: Retrieves a project password policy for Universal Directory resources in a resource group
      operationId: GetProjectPasswordPolicyForOktaUniversalDirectoryResources
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordPolicyWithExclude'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Update a project password policy for Universal Directory resources
      description: Updates a project password policy for Universal Directory resources in a resource group
      operationId: UpdateProjectPasswordPolicyForOktaUniversalDirectoryResources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicyWithExclude'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordPolicyWithExclude'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/rotate_resource:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    post:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Rotate the password for a given resource in a project
      description: Rotates the password for a resource within a specified resource group and project
      operationId: AdminRotateResource
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RotateResourceRequest'
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/saas_app_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/contains'
      - name: managed
        description: If `true`, only return SaaS app accounts that support password rotation. If `false`, only return SaaS app accounts that do not support password rotation.
        in: query
        schema:
          type: boolean
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all SaaS app accounts in a project
      description: Lists all SaaS app accounts in a project in a resource group
      operationId: ListResourceGroupProjectSaasAppAccounts
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupProjectSaasAppAccountsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SaasAppAccountWithSettings'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/saas_app_accounts/{saas_app_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/saas_app_account_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve a SaaS app account
      description: Retrieves a SaaS app account from a project in a resource group.
      operationId: GetSaasAppAccountDetails
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SaasAppAccountDetails'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/saas_app_checkout_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve the checkout settings for a SaaS app resource group project
      description: Retrieves the checkout settings configured for a resource group project that's specific to the SaaS app
      operationId: FetchResourceGroupSaasAppBasedProjectCheckoutSettings
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIServiceAccountCheckoutSettings'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Update the checkout settings for a SaaS app resource group project
      description: Updates the checkout settings configured for a resource group project that's specific to the SaaS app
      operationId: UpdateResourceGroupSaasAppBasedProjectCheckoutSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APIServiceAccountCheckoutSettings'
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/saas_app_password_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a project password policy for SaaS app resources
      description: Retrieves a project password policy for SaaS app resources in a resource group
      operationId: GetProjectPasswordPolicyForSaasAppResources
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordPolicyWithExclude'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Update a project password policy for SaaS app resources
      description: Updates a project password policy for SaaS app resources in a resource group
      operationId: UpdateProjectPasswordPolicyForSaasAppResources
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicyWithExclude'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordPolicyWithExclude'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List top-level secret folders for a project
      description: Lists all top-level secret folders for a project. Users must be authorized to perform this action by an existing security policy.
      operationId: ListTopLevelSecretFoldersForProject
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListTopLevelSecretFoldersForProjectResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SecretOrFolderListResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                title: ListTopLevelSecretFoldersForProjectForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
    post:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
        - end_user
      summary: Create a secret folder
      description: |-
        Creates a secret folder. Users must be authorized to perform this action by a security policy.

        > **Notes:**
        > * When `parent_folder_id` is omitted, creates a top-level folder. This requires the `resource_admin` or `delegated_resource_admin` role.
        > * When `parent_folder_id` is provided, creates a nested folder. This requires a security policy with the [`folder_create`](/openapi/opa/opa/tag/security-policy) privilege.
      operationId: CreateSecretFolder
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretFolderCreateRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretFolderResponse'
          description: Created
        '403':
          content:
            application/json:
              schema:
                title: CreateSecretFolderForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders/{secret_folder_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/secret_folder_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: Retrieve a secret folder
      description: Retrieves the specified secret folder. Users must be authorized to perform this action by an existing security policy.
      operationId: GetSecretFolder
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretFolderResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                title: GetSecretFolderForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
    put:
      x-okta-opa-roles:
        - end_user
      summary: Update a secret folder
      description: Updates the specified secret folder. Users must be authorized to perform this action by an existing security policy.
      operationId: UpdateSecretFolder
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretFolderUpdateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretFolderResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                title: UpdateSecretFolderForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
    delete:
      x-okta-opa-roles:
        - end_user
      summary: Delete a secret folder
      description: Deletes the specified secret folder. Users must be authorized to perform this action by an existing security policy.
      operationId: DeleteSecretFolder
      responses:
        '204':
          description: No Content
        '403':
          content:
            application/json:
              schema:
                title: DeleteSecretFolderForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secret_folders/{secret_folder_id}/items:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/secret_folder_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List all items in a secret folder
      description: Lists all items in a secret folder. Users must be authorized to perform this action by an existing security policy.
      operationId: ListSecretFolderItems
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListSecretFolderItemsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SecretOrFolderListResponse'
          description: OK
        '403':
          content:
            application/json:
              schema:
                title: ListSecretFolderItemsForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    post:
      x-okta-opa-roles:
        - end_user
      summary: Create a secret
      description: Creates a secret. Users must be authorized to perform this action by an existing security policy.
      operationId: CreateSecret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretCreateOrUpdateRequest'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '403':
          content:
            application/json:
              schema:
                title: CreateSecretForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/secrets/{secret_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/secret_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: Retrieve a secret
      description: Retrieves the specified secret. Users must be authorized to perform this action by an existing security policy.
      operationId: GetSecret
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '403':
          content:
            application/json:
              schema:
                title: GetSecretForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
    post:
      x-okta-opa-roles:
        - end_user
      summary: Reveal a secret
      description: |-

        Reveals the specified secret. Users must be authorized to perform this action by an existing security policy.
      operationId: RevealSecret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretRevealRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecretRevealResponse'
        '403':
          content:
            application/json:
              schema:
                title: RevealSecretForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
    put:
      x-okta-opa-roles:
        - end_user
      summary: Update a Secret
      description: Updates the specified secret. Users must be authorized to perform this action by an existing security policy.
      operationId: UpdateSecret
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecretCreateOrUpdateRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Secret'
        '403':
          content:
            application/json:
              schema:
                title: UpdateSecretForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
    delete:
      x-okta-opa-roles:
        - end_user
      summary: Delete a Secret
      description: Deletes the specified secret. Users must be authorized to perform this action by an existing security policy.
      operationId: DeleteSecret
      responses:
        '204':
          description: No Content
        '403':
          content:
            application/json:
              schema:
                title: DeleteSecretForbiddenResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/UserAccessMethod'
          description: Forbidden
      tags:
        - secrets
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all server accounts in a project
      description: Lists all server accounts in a resource group project
      operationId: ListServerAccountsForProject
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListServerAccountsForProjectResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServerAccounts'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_accounts/{server_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/server_account_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a server account
      description: Retrieves a server account from a project in a resource group
      operationId: GetServerAccountDetails
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: GetServerAccountDetailsResponse
                properties:
                  items:
                    $ref: '#/components/schemas/ServerAccounts'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_checkout_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_resource_admin
        - delegated_security_admin
      summary: Retrieve the checkout settings for a server resource group project
      description: Retrieves the checkout settings configured for a resource group project that's specific to the server
      operationId: FetchResourceGroupServerBasedProjectCheckoutSettings
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceCheckoutSettings'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Update the checkout settings for a server resource group project
      description: Updates the checkout settings configured for a resource group project that's specific to the server
      operationId: UpdateResourceGroupServerBasedProjectCheckoutSettings
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ResourceCheckoutSettings'
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_enrollment_tokens:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all server enrollment tokens in a project
      description: Lists all server enrollment tokens in a resource group project
      operationId: ListResourceGroupProjectServerEnrollmentTokens
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupProjectServerEnrollmentTokensResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServerEnrollmentToken'
      tags:
        - projects
    post:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Create a server enrollment token
      description: Creates a server enrollment token for a project in a resource group
      operationId: CreateResourceGroupProjectServerEnrollmentToken
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServerEnrollmentToken'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerEnrollmentToken'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_enrollment_tokens/{server_enrollment_token_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/server_enrollment_token_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a server enrollment token
      description: Retrieves a server enrollment token from a project in a resource group
      operationId: GetResourceGroupProjectServerEnrollmentToken
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServerEnrollmentToken'
      tags:
        - projects
    delete:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Delete a server enrollment token
      description: Deletes a server enrollment token from a project in a resource group
      operationId: RemoveResourceGroupProjectServerEnrollmentToken
      responses:
        '204':
          description: No Content
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/server_password_settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve project password policy for server accounts
      description: Retrieves a password policy for a project in a resource group
      operationId: GetPasswordPolicyForProject
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordPolicy'
      tags:
        - projects
    put:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Update project password policy for server accounts
      description: Updates a password policy for a project in a resource group
      operationId: UpdatePasswordPolicyForProject
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasswordPolicy'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasswordPolicy'
      tags:
        - projects
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/servers:
    parameters:
      - $ref: '#/components/parameters/id'
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/hostname'
      - $ref: '#/components/parameters/hostname_contains'
      - $ref: '#/components/parameters/os_type'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all servers in a project
      description: Lists all servers in a project in a resource group
      operationId: ListResourceGroupProjectServers
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListResourceGroupProjectServersResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Server'
      tags:
        - servers
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/servers/{server_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/server_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Retrieve a server from a project
      description: Retrieves a server from a project in a resource group
      operationId: GetResourceGroupProjectServer
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Server'
      tags:
        - servers
    delete:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: Delete a server from a project
      description: Deletes a server from a project in a resource group
      operationId: DeleteResourceGroupProjectServer
      responses:
        '204':
          description: No Content
      tags:
        - servers
  /v1/teams/{team_name}/resource_groups/{resource_group_id}/projects/{project_id}/servers/{server_id}/server_accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/resource_group_id'
      - $ref: '#/components/parameters/project_id'
      - $ref: '#/components/parameters/server_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - delegated_resource_admin
      summary: List all server accounts for a server
      description: Lists all server accounts for a server in a project
      operationId: ListServerAccountsForServer
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListServerAccountsForServerResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServerAccounts'
      tags:
        - projects
  /v1/teams/{team_name}/roles:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - pam_admin
      summary: List all roles
      description: Lists all roles available to your team
      operationId: ListRoles
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListRolesResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Roles'
      tags:
        - teams
  /v1/teams/{team_name}/saas_apps:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/prev'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/descending'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List the end-user SaaS app instances
      description: Lists the SaaS app instances that an end user has access to through at least one account based on the security policies
      operationId: ListSaasApplicationsAccessibleByUser
      parameters:
        - name: contains
          description: Filters for SaaS app instances where the name contains the search string
          in: query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListSaasApplicationsAccessibleByUserResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SaasApplicationInstance'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: Retrieve an end-user SaaS app instance
      description: Retrieves a SaaS app instance that an end user has access to through at least one account based on the security policies
      operationId: GetSaasApplicationAccessibleByUser
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SaasApplicationInstance'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}/accounts:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
      - $ref: '#/components/parameters/count'
      - $ref: '#/components/parameters/prev'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/descending'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List all end-user SaaS app service accounts
      description: Lists all SaaS app service accounts that the end user has access to based on the security policies
      operationId: ListSaaSApplicationServiceAccountsEndUser
      parameters:
        - name: contains
          description: Filters for service accounts where the name contains the search string
          in: query
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListServiceAccountsEndUserResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServiceAccountEndUser'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}/accounts/{saas_app_account_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
      - $ref: '#/components/parameters/saas_app_account_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: Retrieve an end-user SaaS app service account
      description: Retrieves a SaaS app service account that the end user has access to based on the security policies
      operationId: GetSaaSApplicationServiceAccountEndUser
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountEndUser'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}/accounts/{saas_app_account_id}/credentials:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
      - $ref: '#/components/parameters/saas_app_account_id'
    put:
      x-okta-opa-roles:
        - end_user
      summary: Update the SaaS app account password
      description: Updates the password belonging to a SaaS app account (managed and unmanaged) that the end user has access to
      operationId: updateSaasAppAccountPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountsUpdateCredentialsRequest'
        required: true
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenUAMResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}/accounts/{saas_app_account_id}/reveal_credentials:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
      - $ref: '#/components/parameters/saas_app_account_id'
    post:
      x-okta-opa-roles:
        - end_user
      summary: Reveal the SaaS app account password
      description: Reveals the password belonging to a SaaS app account (managed and unmanaged) that the end user has access to
      operationId: revealSaasAppAccountPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountsRevealCredentialsRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountsRevealCredentialsResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenUAMResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}/accounts/{saas_app_account_id}/rotate_password:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
      - $ref: '#/components/parameters/saas_app_account_id'
    post:
      x-okta-opa-roles:
        - end_user
      summary: Rotate a managed SaaS app account password
      description: Rotates the password for a managed SaaS app account that the end user has access to
      operationId: saasAppAccountRotatePassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountsRotateCredentialsRequest'
        required: true
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenUAMResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/saas_apps/{saas_app_instance_id}/accounts/{saas_app_account_id}/user_access_methods:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/saas_app_instance_id'
      - $ref: '#/components/parameters/saas_app_account_id'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List all SaaS app account user access methods
      description: Lists all user access methods for a SaaS app account based on the security policies
      operationId: ListUAMForSaaSApplicationAccount
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListUAMForServiceAccountResponse'
      tags:
        - saas-app-accounts
  /v1/teams/{team_name}/secret_folders:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List top-level secret folders for team
      description: Lists all top-level secret folders for a team
      operationId: ListTopLevelSecretFoldersForTeam
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListTopLevelSecretFoldersForTeamResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SecretOrFolderListResponse'
          description: OK
      tags:
        - secrets
  /v1/teams/{team_name}/secrets:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List top-level secret folders for user
      description: Lists all top-level secret folders for a user. Users must be authorized to perform this action by an existing security policy.
      operationId: ListTopLevelSecretFoldersForUser
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - name: search
          description: |-
            Search term to find secrets and folders by `name` or `description` properties:
            * Only secrets and folders are returned if you have access to them and if they're not protected by MFA or Access Requests.
            * If you have the `security_admin` role, then all secret and folder search results are returned (even if you don't have explicit access to them).
            * If you have the `resource_admin` role and you don't have permission to access the secret in the results, then only the top-level folders are returned.

            The returned results are ordered by a closest-similar matching score: exact string matches are ranked higher than partial matches.

            > **Note:** The search term is case-insensitive.
          in: query
          schema:
            type: string
            maxLength: 1000
            example: svc
          required: false
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
        - name: parent_folder_id
          description: The UUID of the parent folder to search secrets and folders within
          in: query
          schema:
            type: string
          required: false
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListTopLevelSecretFoldersForUserResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SecretOrFolderListResponse'
          description: OK
      tags:
        - secrets
  /v1/teams/{team_name}/security_policy:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all security policies
      description: Lists all security policies
      operationId: ListSecurityPolicies
      parameters:
        - name: contains
          description: Filters for security policies where the name or description contains the search string
          in: query
          schema:
            type: string
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListSecurityPoliciesResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SecurityPolicy'
      tags:
        - security-policy
    post:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Create a security policy
      description: Creates a security policy
      operationId: CreateSecurityPolicy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityPolicy'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPolicy'
      tags:
        - security-policy
  /v1/teams/{team_name}/security_policy/{security_policy_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/security_policy_id'
    get:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Retrieve a security policy
      description: Retrieves the specified security policy.
      operationId: GetSecurityPolicy
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityPolicy'
      tags:
        - security-policy
    put:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Update a security policy
      description: Updates the specified security policy
      operationId: UpdateSecurityPolicy
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecurityPolicy'
      responses:
        '204':
          description: No Content
      tags:
        - security-policy
    delete:
      x-okta-opa-roles:
        - security_admin
        - delegated_security_admin
      summary: Delete a security policy
      description: Deletes the specified security policy
      operationId: DeleteSecurityPolicy
      responses:
        '204':
          description: No Content
      tags:
        - security-policy
  /v1/teams/{team_name}/server_accounts/{server_account_id}/reveal_credentials:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/server_account_id'
    post:
      x-okta-opa-roles:
        - end_user
      summary: Reveal the password for a server account
      description: Reveals the JWE-encrypted password for the specified server account
      operationId: revealServerAccountPassword
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServerAccountsRevealCredentialsRequest'
        required: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountsRevealCredentialsResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenUAMResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '412':
          description: Precondition failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PreconditionFailedResponse'
      tags:
        - server-accounts
  /v1/teams/{team_name}/servers:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - end_user
      summary: List all servers for a team
      description: Lists all servers in your team. This only returns servers available to the requesting user.
      operationId: ListServers
      parameters:
        - name: AdServers
          description: If `true`, only return Active Directory servers. If `false`, only return Non-Active Directory servers.
          in: query
          schema:
            type: boolean
        - name: alt_names_contains
          description: Only return servers that contain the specified alternate name
          in: query
          schema:
            type: string
        - name: bastion
          description: Only return servers associated with the specified bastion
          in: query
          schema:
            type: string
        - name: canonical_name
          description: A canonical name
          in: query
          schema:
            type: string
        - name: cloud_account
          description: Only return servers associated with the specified cloud account
          in: query
          schema:
            type: string
        - name: cloud_provider
          description: 'Only return servers associated with the specified cloud provider. Possible values: `aws` or `gce`.'
          in: query
          schema:
            type: string
        - $ref: '#/components/parameters/count'
        - name: credentialed
          description: If `true`, only return unmanaged servers with credential issuance enabled. If `false`, only return unmanaged servers with credential issuance disabled.
          in: query
          schema:
            type: boolean
        - $ref: '#/components/parameters/descending'
        - name: hostname
          description: Only return servers that contain the specified hostname
          in: query
          schema:
            type: string
        - name: id
          description: Only return servers with the specified IDs. Only usable for PAM administrative views of servers, not end-user server views.
          explode: true
          in: query
          schema:
            type: string
        - name: instance_id
          description: Only return servers that contain the specified instance ID
          explode: true
          in: query
          schema:
            type: string
        - name: managed
          description: If `true`, only return managed servers. If `false`, only return unmanaged servers.
          in: query
          schema:
            type: boolean
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - name: project_name
          description: Only return servers that belong to the specified project
          explode: true
          in: query
          schema:
            type: string
        - name: state
          description: 'Include servers with the specified state. Valid statuses: `ACTIVE` or `INACTIVE`.'
          in: query
          schema:
            type: string
        - name: selector
          description: Only return servers that contain the specified server selectors.
          example: selector=key1=value1,key2=value2
          in: query
          schema:
            type: string
        - name: include_labels
          description: If `true`, includes server labels in the results.
          example: true
          in: query
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListServersResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Server'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - teams
  /v1/teams/{team_name}/service_token:
    parameters:
      - $ref: '#/components/parameters/team_name'
    post:
      x-okta-opa-roles:
        - resource_admin
      summary: Issue a service user token
      description: |-
        Most calls to the Okta Privileged Access API require an HTTP `Authorization` header with a value of `Bearer ${AUTH_TOKEN}`.
        To retrieve an auth token, you need to create an API key for a service user and pass the API key information to this endpoint.
        Auth tokens may expire at any time, so code that uses them should be prepared to handle a 401 response code by creating a new auth token.
      operationId: IssueServiceToken
      requestBody:
        content:
          application/json:
            example:
              key_id: 6052868b-1b04-4a14-8288-e6496d7f2f4b
              key_secret: uF0SoVBVQP/hJmQSLUZdM2a7ArYzjD8ykzvG7n4tKaOEfSErcwMUUDWpEf4Q42/HaVKPZUfILkzy/bsQFv7WRg==
            schema:
              $ref: '#/components/schemas/IssueServiceTokenRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthTokenResponse'
          description: OK
      security: []
      tags:
        - service-users
  /v1/teams/{team_name}/service_users:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
        - delegated_resource_admin
      summary: List all service users for a team
      description: Lists all service users for your team
      operationId: ListServiceUsers
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/id'
        - $ref: '#/components/parameters/include_service_users'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - $ref: '#/components/parameters/starts_with'
        - $ref: '#/components/parameters/status'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListServiceUsersResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/User'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - service-users
    post:
      x-okta-opa-roles:
        - resource_admin
      summary: Create a service user
      description: Creates a service user that can be used to automate interactions with the Okta Privileged Access API
      operationId: CreateServiceUser
      requestBody:
        content:
          application/json:
            example:
              name: OPA User
            schema:
              $ref: '#/components/schemas/CreateServiceUserBody'
        required: true
      responses:
        '201':
          content:
            application/json:
              example:
                deleted_at: null
                details: null
                id: aa225c16-af6e-4ab4-9150-456fd472e2d7
                name: OPA User
                status: ACTIVE
                team_name: william-faulkner
                user_type: service
              schema:
                $ref: '#/components/schemas/User'
          description: Created
      tags:
        - service-users
  /v1/teams/{team_name}/service_users/{user_name}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
        - delegated_resource_admin
      summary: Retrieve a service user
      description: Retrieve a specified service user
      operationId: GetServiceUser
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
          description: OK
      tags:
        - service-users
    put:
      x-okta-opa-roles:
        - resource_admin
      summary: Update a service user
      description: Updates a specified service user
      operationId: ServiceUserUpdate
      requestBody:
        content:
          application/json:
            example:
              status: DISABLED
            schema:
              $ref: '#/components/schemas/UpdateServiceUserBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
          description: OK
      tags:
        - service-users
  /v1/teams/{team_name}/service_users/{user_name}/keys:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
    get:
      x-okta-opa-roles:
        - resource_admin
      summary: List all API keys
      description: Lists all API keys for a specified service user. This doesn't return the corresponding secret for each API key.
      operationId: ListServiceUserKeys
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListServiceUserKeysResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/ServiceUserKey'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - service-users
    post:
      x-okta-opa-roles:
        - resource_admin
      summary: Rotate all API keys
      description: Rotates all API keys for a specified service user. This also sets an expiration date for the existing API keys.
      operationId: RotateServiceUserKey
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUserKeyWithSecret'
          description: OK
      tags:
        - service-users
  /v1/teams/{team_name}/service_users/{user_name}/keys/{key_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
      - $ref: '#/components/parameters/key_id'
    delete:
      x-okta-opa-roles:
        - resource_admin
      summary: Delete an API key
      description: Deletes an API key for a service user. The service user can no longer authenticate with this API key.
      operationId: DeleteServiceUserKey
      responses:
        '204':
          description: No Content
      tags:
        - service-users
  /v1/teams/{team_name}/settings:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - end_user
      summary: Retrieve settings for a team
      description: Retrieves team-level settings for your team
      operationId: GetTeamSettings
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamSettings'
          description: OK
      tags:
        - teams
    put:
      x-okta-opa-roles:
        - resource_admin
      summary: Update settings for a team
      description: Updates team-level settings for your team. Partial updates are permitted. To disable a setting, set the value to `null`.
      operationId: UpdateTeamSettings
      requestBody:
        content:
          application/json:
            example:
              approve_device_without_interaction: false
              client_session_duration: 3600
              post_device_enrollment_url: null
              post_login_url: null
              post_logout_url: null
              reactivate_users_via_idp: false
              team: Your_OPA_Team
              user_provisioning_exact_username: null
              web_session_duration: 1800
            schema:
              $ref: '#/components/schemas/TeamSettings'
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - teams
  /v1/teams/{team_name}/sudo_command_bundles:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_security_admin
      summary: List all sudo command bundles
      description: Lists all sudo command bundles for your team
      operationId: ListSudoCommandBundles
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - name: contains
          in: query
          description: |-
            Filters for sudo command bundles where the name contains the search string
            > **Note**: This parameter is case-sensitive.
          required: false
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListSudoCommandBundleResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/SudoCommandBundle'
      tags:
        - sudo-commands
    post:
      x-okta-opa-roles:
        - resource_admin
      summary: Create a sudo command bundle
      description: Creates a sudo command bundle
      operationId: CreateSudoCommandBundle
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SudoCommandBundle'
            example:
              name: create_directories
              description: can be empty
              structured_commands:
                - command_type: executable
                  command: /bin/mkdir
                  args_type: any
              no_passwd: true
              no_exec: false
              set_env: false
              add_env: null
              sub_env: null
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SudoCommandBundle'
              example:
                id: 4c218c35-b8fd-45f5-9e43-1c392c9079b0
                created_at: '2024-07-29T23:15:38.203054971Z'
                created_by: name.username
                updated_at: '2024-07-29T23:15:38.203054971Z'
                updated_by: name.username
                name: create_directories
                description: can be empty
                structured_commands:
                  - command_type: executable
                    command: /bin/mkdir
                    args_type: any
                    args: null
                    rendered_command: /bin/mkdir *
                run_as: ''
                no_passwd: true
                no_exec: false
                set_env: false
                add_env: null
                sub_env: null
      tags:
        - sudo-commands
  /v1/teams/{team_name}/sudo_command_bundles/{sudo_command_bundle_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/sudo_command_bundle_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
        - delegated_security_admin
      summary: Retrieve a sudo command bundle
      description: Retrieves a specified sudo command bundle
      operationId: GetSudoCommandBundle
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SudoCommandBundle'
          description: OK
      tags:
        - sudo-commands
    put:
      x-okta-opa-roles:
        - resource_admin
      summary: Update a sudo command bundle
      description: Updates a specified sudo command bundle. You cannot modify a sudo command bundle that's referenced by an Okta Privileged Access security policy.
      operationId: UpdateSudoCommandBundle
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SudoCommandBundle'
            example:
              name: create_directories
              description: can be empty
              structured_commands:
                - command_type: executable
                  command: /bin/mkdir
                  args_type: any
              no_passwd: true
              no_exec: false
              set_env: false
              add_env: null
              sub_env: null
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - sudo-commands
    delete:
      x-okta-opa-roles:
        - resource_admin
      summary: Delete a sudo command bundle
      description: Deletes the specified sudo command bundle. You can't delete a sudo command bundle that's referenced by an Okta Privileged Access security policy.
      operationId: DeleteSudoCommandBundle
      responses:
        '204':
          description: No Content
      tags:
        - sudo-commands
  /v1/teams/{team_name}/team_stats:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
      summary: Retrieve statistics for a team
      description: Retrieves statistics about your team
      operationId: FetchStatsForTeam
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamStats'
          description: OK
      tags:
        - teams
  /v1/teams/{team_name}/templates:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      x-okta-opa-roles:
        - end_user
      summary: List all secret templates
      description: Lists all secret templates
      operationId: ListSecretTemplates
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListSecretTemplatesResponse
                properties:
                  list:
                    type: array
                    items:
                      $ref: '#/components/schemas/SecretTemplateResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - secrets
  /v1/teams/{team_name}/users:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
      summary: List all users for a team
      description: Lists all users for your team
      operationId: ListUsers
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/id'
        - $ref: '#/components/parameters/include_service_users'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - $ref: '#/components/parameters/starts_with'
        - $ref: '#/components/parameters/status'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListUsersResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/User'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - users
  /v1/teams/{team_name}/users/{user_name}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
      summary: Retrieve a user
      description: Retrieves a user from your team
      operationId: GetUser
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
          description: OK
      tags:
        - users
  /v1/teams/{team_name}/users/{user_name}/attributes:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
      summary: List all attributes for a user
      description: Lists all attributes for a specified user
      operationId: ListUserAttributes
      parameters:
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
        - $ref: '#/components/parameters/conflicting'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListUserAttributesResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/TeamUserAttribute'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - attributes
  /v1/teams/{team_name}/users/{user_name}/attributes/{attribute_id}:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
      - $ref: '#/components/parameters/attribute_id'
    get:
      x-okta-opa-roles:
        - resource_admin
        - security_admin
      summary: Retrieve a user attribute
      description: Retrieves an attribute for a user
      operationId: FetchUserAttribute
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TeamUserAttribute'
          description: OK
      tags:
        - attributes
    put:
      x-okta-opa-roles:
        - security_admin
      summary: Update a user attribute
      description: Updates an attribute for a user
      operationId: UpdateUserAttribute
      requestBody:
        content:
          application/json:
            example:
              attribute_name: unix_user_name
              attribute_value: ada_lovelace
            schema:
              $ref: '#/components/schemas/UpdateAttribute'
        required: true
      responses:
        '204':
          description: No Content
      tags:
        - attributes
  /v1/teams/{team_name}/users/{user_name}/groups:
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/user_name'
    get:
      x-okta-opa-roles:
        - pam_admin
        - resource_admin
        - security_admin
      summary: List all groups for a user
      description: Lists all groups for a specified user
      operationId: ListUserGroups
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/id'
        - $ref: '#/components/parameters/ignore'
        - $ref: '#/components/parameters/include_deleted'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/only_include_deleted'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          content:
            application/json:
              schema:
                title: ListUserGroupsResponse
                properties:
                  list:
                    items:
                      $ref: '#/components/schemas/Group'
                    type: array
                type: object
          description: OK
          headers:
            Link:
              description: |-
                Link Header defined by RFC 8288.

                A Link header with rel="next" indicates that a subsequent page is available and contains the URL which should be used to fetch it.

                A Link header with rel="prev" indicates that a previous page is available and contains the URL which should be used to fetch it.
              schema:
                type: string
      tags:
        - users
  /v1/teams/{team_name}/vault/jwks.json:
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      summary: Retrieve the vault JWKS
      description: Retrieves the vault JWKS. Data sent to the vault must be encrypted to this key.
      operationId: GetVaultJWKS
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: GetVaultJWKSResponse
                properties:
                  keys:
                    items:
                      $ref: '#/components/schemas/RawJSONWebKey'
      tags:
        - teams
  /v1/teams/{team_name}/workload-roles:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: List all workload roles
      description: Lists all workload roles defined for this team
      operationId: ListWorkloadRoles
      parameters:
        - $ref: '#/components/parameters/contains'
        - $ref: '#/components/parameters/count'
        - $ref: '#/components/parameters/descending'
        - $ref: '#/components/parameters/offset'
        - $ref: '#/components/parameters/prev'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                title: ListWorkloadRolesResponse
                properties:
                  list:
                    type: array
                    description: The list of workload roles
                    items:
                      $ref: '#/components/schemas/WorkloadRoleWithServerUsername'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
      tags:
        - workload-roles
    post:
      x-okta-opa-roles:
        - security_admin
      summary: Create a workload role
      description: Creates a workload role
      operationId: CreateWorkloadRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkloadRole'
        required: true
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadRole'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
      tags:
        - workload-roles
  /v1/teams/{team_name}/workload-roles/{workload_role_id}:
    x-okta-lifecycle:
      lifecycle: GA
      isGenerallyAvailable: false
      SKUs: []
    parameters:
      - $ref: '#/components/parameters/team_name'
      - $ref: '#/components/parameters/workload_role_id'
    get:
      x-okta-opa-roles:
        - security_admin
      summary: Retrieve a workload role
      description: Retrieves a workload role by its ID
      operationId: GetWorkloadRole
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadRoleWithServerUsername'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - workload-roles
    put:
      x-okta-opa-roles:
        - security_admin
      summary: Update a workload role
      description: Updates a workload role by its ID
      operationId: UpdateWorkloadRole
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkloadRole'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkloadRole'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - workload-roles
    delete:
      x-okta-opa-roles:
        - security_admin
      summary: Delete a workload role
      description: Deletes a workload role by its ID
      operationId: DeleteWorkloadRole
      responses:
        '204':
          description: No Content
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedAccessResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
      tags:
        - workload-roles
components:
  parameters:
    access_report_id:
      description: The UUID of an access report
      in: path
      name: access_report_id
      required: true
      schema:
        type: string
    account_name:
      description: Active Directory account name
      in: query
      name: account_name
      required: false
      schema:
        type: string
    ad_account_id:
      description: The UUID of an Active Directory account
      in: path
      name: ad_account_id
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    ad_account_rule_id:
      description: The UUID of an Active Directory account rule
      in: path
      name: ad_account_rule_id
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    ad_account_type:
      description: The type of Active Directory account
      in: query
      name: ad_account_type
      required: false
      schema:
        type: string
        enum:
          - SHARED
          - INDIVIDUAL
    ad_connection_id:
      description: The UUID of an Active Directory connection
      in: path
      name: ad_connection_id
      required: true
      schema:
        $ref: '#/components/schemas/UUID'
    ad_connection_ids:
      description: The UUIDs of Active Directory connections
      in: query
      name: ad_connection_id
      required: false
      schema:
        type: array
        items:
          $ref: '#/components/schemas/UUID'
    attribute_id:
      description: The UUID of an attribute
      in: path
      name: attribute_id
      required: true
      schema:
        type: string
    client_id:
      description: The UUID of a client
      in: path
      name: client_id
      required: true
      schema:
        type: string
    conflicting:
      description: When `true`, only returns attributes that conflict with other attributes on your team
      in: query
      name: conflicting
      schema:
        type: boolean
    contains:
      description: Filter results to include only those that contain the specified value
      in: query
      name: contains
      schema:
        type: string
    count:
      description: The number of objects per page
      in: query
      name: count
      schema:
        type: integer
        format: int32
    descending:
      description: The object order
      in: query
      name: descending
      schema:
        type: boolean
    gateway_id:
      description: The UUID of a gateway
      in: path
      name: gateway_id
      required: true
      schema:
        type: string
    gateway_setup_token_id:
      description: The UUID of a gateway setup token
      in: path
      name: gateway_setup_token_id
      required: true
      schema:
        type: string
    group_name:
      description: The name of a group
      in: path
      name: group_name
      required: true
      schema:
        type: string
    hostname:
      name: hostname
      in: query
      description: Only return servers whose hostname equals the specified string (case sensitive)
      schema:
        type: string
        example: host
    hostname_contains:
      name: hostname_contains
      in: query
      description: Only return servers whose hostname contains the specified string (case-insensitive)
      schema:
        type: string
        minLength: 1
        maxLength: 255
        example: host
    id:
      description: Only returns results with the specified IDs
      explode: true
      in: query
      name: id
      schema:
        type: array
        items:
          type: string
    if_none_match:
      name: If-None-Match
      in: header
      required: false
      schema:
        type: string
      description: |-
        The ETag value determines if the resource has changed.
        If the value matches the current ETag on the server, a `304 Not Modified` response is returned.
    ignore:
      description: Ignore groups with the specified names. This is case sensitive.
      explode: true
      in: query
      name: ignore
      schema:
        type: string
    include_deleted:
      description: If `true`, include deleted groups in the results
      in: query
      name: include_deleted
      schema:
        type: boolean
    include_service_users:
      description: Only return service users in the results
      in: query
      name: include_service_users
      schema:
        type: string
    include_user_access_methods:
      description: If `true`, the response includes the user access methods for the resource
      in: query
      name: include_user_access_methods
      schema:
        type: boolean
    key_id:
      description: The UUID of a service user key
      in: path
      name: key_id
      required: true
      schema:
        type: string
    offset:
      description: The offset value for pagination. The **rel="next"** and **rel="prev"** `Link` headers define the offset for subsequent or previous pages.
      in: query
      name: offset
      schema:
        type: string
    okta_universal_directory_account_id:
      description: The UUID of a Universal Directory account
      in: path
      name: okta_universal_directory_account_id
      required: true
      schema:
        type: string
    only_include_deleted:
      description: If `true`, only return deleted groups in the results
      in: query
      name: only_include_deleted
      schema:
        type: boolean
    os_type:
      name: os_type
      in: query
      description: 'Only return servers with the specified OS type. Possible values: `linux` or `windows`.'
      schema:
        type: string
        enum:
          - windows
          - linux
        example: windows
    prev:
      description: The direction of paging
      in: query
      name: prev
      schema:
        type: boolean
    project_id:
      description: The UUID of a project
      in: path
      name: project_id
      required: true
      schema:
        type: string
    project_id_query:
      description: Only returns results with the specified UUID of a project
      in: query
      name: project_id
      required: false
      schema:
        type: string
    querySearchFilter:
      name: search
      description: |-
        Search for secrets and folders based on the specified property value
        > **Note:** The search term is matched in a case-insensitive fuzzy manner.
      in: query
      required: false
      schema:
        type: string
        minLength: 3
        maxLength: 255
    querySecretType:
      description: The type of secret (used for filtering secrets)
      in: query
      name: secret_type
      required: false
      schema:
        $ref: '#/components/schemas/SecretType'
    resource_group_id:
      description: The UUID of a resource group
      in: path
      name: resource_group_id
      required: true
      schema:
        type: string
    resource_group_id_query:
      description: Only returns results with the specified UUID of a resource group
      in: query
      name: resource_group_id
      required: false
      schema:
        type: string
    saas_app_account_id:
      description: The UUID of a SaaS app account
      in: path
      name: saas_app_account_id
      required: true
      schema:
        type: string
    saas_app_instance_id:
      description: The app instance ID of a SaaS app provisioned to an Okta org
      in: path
      name: saas_app_instance_id
      required: true
      schema:
        type: string
    secret_folder_id:
      description: The UUID of a secret folder
      in: path
      name: secret_folder_id
      required: true
      schema:
        type: string
    secret_id:
      description: The UUID of a Secret
      in: path
      name: secret_id
      required: true
      schema:
        type: string
    security_policy_id:
      description: The UUID of a security policy
      in: path
      name: security_policy_id
      required: true
      schema:
        type: string
    server_account_id:
      description: The UUID of a server account
      in: path
      name: server_account_id
      required: true
      schema:
        type: string
    server_enrollment_token_id:
      description: The UUID of a server enrollment token
      in: path
      name: server_enrollment_token_id
      required: true
      schema:
        type: string
    server_id:
      description: The UUID of an enrolled server
      in: path
      name: server_id
      required: true
      schema:
        type: string
    staged_service_account_id:
      description: The UUID of a `STAGED` service account
      in: path
      name: staged_service_account_id
      required: true
      schema:
        type: string
    starts_with:
      description: Only return users with a name that begins with the specified value
      in: query
      name: starts_with
      schema:
        type: string
    status:
      description: 'Only return users with the specified status. Valid statuses: `ACTIVE`, `DISABLED`, and `DELETED`.'
      explode: true
      in: query
      name: status
      schema:
        type: string
    sudo_command_bundle_id:
      description: The UUID of a sudo command bundle
      in: path
      name: sudo_command_bundle_id
      required: true
      schema:
        type: string
    team_name:
      description: The name of your team
      in: path
      name: team_name
      required: true
      schema:
        type: string
    user_name:
      description: The username for an existing user
      in: path
      name: user_name
      required: true
      schema:
        type: string
    workload_connection_id:
      name: workload_connection_id
      in: path
      required: true
      description: The ID of the workload connection
      schema:
        $ref: '#/components/schemas/schemas-UUID'
    workload_role_id:
      name: workload_role_id
      in: path
      required: true
      description: The ID of the workload role
      schema:
        $ref: '#/components/schemas/schemas-UUID'
  schemas:
    ADAccountSyncStatus:
      description: The AD account sync status
      type: string
      enum:
        - NOT_SYNCED
        - SYNC_COMPLETED
        - SYNC_FAILED
        - SYNC_IN_PROGRESS
      x-enumDescriptions:
        NOT_SYNCED: Indicates that there is no sync of AD accounts in progress
        SYNC_IN_PROGRESS: Indicates that there is a sync of AD accounts in progress
        SYNC_FAILED: Indicates that a sync of AD accounts has failed
        SYNC_COMPLETED: Indicates that a sync of AD accounts has successfully completed
    ADConnectionStatus:
      description: All possible statuses of a connection.
      type: string
      enum:
        - connected
        - disconnected
        - inactive
      x-enumDescriptions:
        connected: Indicates that the connection is in use and can be used to define account assignment rules
        disconnected: Indicates that the connection is not in use and cannot be used to define account assignment rules
        inactive: Indicates that the connection is deactivated in the Okta Admin Console. Regardless of its previous connection state within OPA, it remains `inactive` as per the source system.
    APIServiceAccountCheckoutSettings:
      type: object
      properties:
        checkout_duration_in_seconds:
          description: The duration in seconds for the checkout. If the checkout is enabled, the duration is the maximum time a user can access the resource before the checkout expires.
          type: integer
          maximum: 604800
          minimum: 900
          format: int32
        checkout_required:
          description: Indicates whether a checkout is mandatory for accessing resources within the project. If `true`, checkout is enforced by default for all applicable resources. If `false`, checkout isn't required, and resources are accessible without it.
          type: boolean
        exclude_list:
          description: If provided, only the account identifiers listed are excluded from the checkout requirement. This list is only considered if `checkout_required` is set to `true`. Only one of `include_list` and `exclude_list` can be specified in a request since they are mutually exclusive.
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccountSettingNameObject'
        include_list:
          description: If provided, only the account identifiers listed are required to perform a checkout to access the resource. This list is only considered if `checkout_required` is set to `true`. Only one of `include_list` and `exclude_list` can be specified in a request since they are mutually exclusive.
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccountSettingNameObject'
      required:
        - checkout_required
        - checkout_duration_in_seconds
    AccessCredentialType:
      description: The type of credential used to access the resource
      type: string
      enum:
        - encrypted-ad-rdp-password
        - encrypted-ad-rdp-password-with-admin
        - encrypted-ad-rdp-password-with-remote-access
        - encrypted-ad-ssh-password
        - encrypted-rdp-password
        - encrypted-ssh-password
        - managed
        - password
        - rdp-broker-certificate
        - rdp-broker-certificate-admin
        - ssh-certificate
        - ssh-certificate-admin
        - ssh-certificate-sudo
    AccessReport:
      type: object
      properties:
        created_at:
          description: A timestamp indicating when the access report was created
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
        details:
          oneOf:
            - $ref: '#/components/schemas/AccessReportTargetUser'
            - $ref: '#/components/schemas/AccessReportTargetResource'
        id:
          $ref: '#/components/schemas/AccessReportID'
        status:
          $ref: '#/components/schemas/AccessReportJobStatus'
        updated_at:
          description: A timestamp indicating when the access report was last updated
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
    AccessReportCreateTarget:
      oneOf:
        - $ref: '#/components/schemas/AccessReportTargetUser'
        - $ref: '#/components/schemas/AccessReportTargetResource'
      type: object
    AccessReportID:
      description: The UUID of an access report
      format: regex
      example: 5fdf5ae9-e71b-423e-8a87-c2ebffe407f6
      type: string
      pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
      readOnly: true
    AccessReportJobStatus:
      description: The status of the job
      type: string
      enum:
        - COMPLETED
        - COMPLETED_BUT_EMPTY
        - CREATED
        - ERROR
        - IN PROGRESS
      readOnly: true
    AccessReportTargetID:
      description: The UUID of an existing Okta Privileged Access user or resource
      format: regex
      example: 5fdf5ae9-e4db-4aae-8127-c2ebffe747f6
      type: string
      pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
    AccessReportTargetResource:
      title: Resource
      properties:
        resource:
          type: object
          properties:
            id:
              $ref: '#/components/schemas/AccessReportTargetID'
            resource_type:
              $ref: '#/components/schemas/AccessReportTargetResourceType'
    AccessReportTargetResourceType:
      description: The type of resource associated with the access report
      type: string
      enum:
        - server
    AccessReportTargetUser:
      title: User
      properties:
        user:
          type: object
          properties:
            id:
              $ref: '#/components/schemas/AccessReportTargetID'
            resource_type_filter:
              $ref: '#/components/schemas/AccessReportTargetResourceType'
    AccessRequestCreateRequest:
      type: object
      properties:
        identity:
          type: string
          description: The name of the server account in the access request. Set this parameter if `resource_type` is `server_account_password_login`.
        project_id:
          description: The UUID of the project
          type: string
        request_type_id:
          description: Request type ID
          type: string
        resource_group_id:
          description: The UUID of a resource group
          type: string
        resource_id:
          type: string
          description: The resource ID that's set from the security policy rule. For servers, `resource_id` is the server account ID. For secrets, `resource_id` is the ID from the closest policy for a secret.
        resource_type:
          description: Type of the resource access request is created for
          type: string
          enum:
            - server
            - server_account_password_login
            - secret
            - service_account
            - active_directory_account
        rule_ids:
          description: A list of rule IDs
          type: array
          items:
            type: string
      required:
        - resource_type
        - resource_id
    AccessRequestCreateResponse:
      type: object
      properties:
        access_request_id:
          description: The UUID of the access request
          type: string
    AccountPasswordChangeDetails:
      description: Common struct that contains all password change metadata fields including number of rotations and rotation reason
      type: object
      properties:
        last_password_change_error_metadata:
          description: The error message metadata reported during the most recent failure to change the account password
          type: string
        last_password_change_error_report_timestamp:
          description: A timestamp indicating when the remote system last reported a failure to change to the account password
          type: string
          format: date-time
        last_password_change_error_system_timestamp:
          description: A timestamp reported from the remote system indicating when the remote system last failed to change the account password
          type: string
          format: date-time
        last_password_change_error_type:
          description: The type of error message reported during the most recent failure to change the account password
          type: string
        last_password_change_success_report_timestamp:
          description: A timestamp indicating when OPA last reported a change to the account password
          type: string
          format: date-time
        last_password_change_system_timestamp:
          description: A timestamp reported from the remote system indicating when the remote system last changed the account password
          type: string
          format: date-time
        password_change_error_count:
          description: The number of times an account's password change resulted in failure
          type: integer
          format: int32
        password_change_error_count_since_last_success:
          description: The number of times an account's password change failed after the last successful attempt
          type: integer
          format: int32
        password_change_success_count:
          description: The number of times an account's password was successfully changed
          type: integer
          format: int32
    AccountSelectorMode:
      description: Controls how accounts are selected
      type: string
      enum:
        - ALL
        - EXCLUDE
        - INCLUDE
      x-enumDescriptions:
        ALL: Select all accounts
        INCLUDE: Only select accounts in the relevant include list
        EXCLUDE: Only select accounts in the relevant exclude list
    AccountSetting:
      description: A project level account setting that may be enabled for an account
      type: string
      enum:
        - CHECKOUT
        - ROTATION_SCHEDULE
      x-enumDescriptions:
        CHECKOUT: Manages account access by requiring users to check in and check out
        ROTATION_SCHEDULE: Periodically rotates the credential associated with the account
    ActiveDirectoryAccount:
      type: object
      properties:
        account_name:
          description: The name of the Active Directory account
          type: string
        account_status_detail_message:
          description: Optional additional information about the account status
          type: string
        account_type:
          description: The type of Active Directory account
          type: string
          enum:
            - SHARED
            - INDIVIDUAL
        brought_under_management_at:
          description: Timestamp indicating when the Active Directory account was managed by Okta Privileged Access
          type: string
          format: date-time
        display_name:
          description: The display name of this Active Directory user, if set
          type: string
        distinguished_name:
          description: The Distinguished Name (DN) referencing the Active Directory account
          type: string
        domain:
          $ref: '#/components/schemas/NamedObject'
        email:
          description: The email of this Active Directory user, if set
          type: string
        first_name:
          description: The first name of this Active Directory user, if set
          type: string
        id:
          description: The UUID of the Active Directory account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        last_name:
          description: The last name of this Active Directory user, if set
          type: string
        last_rotation_at:
          description: A timestamp indicating the last password rotation for the Active Directory Account
          type: string
          format: date-time
        match_status:
          description: The match status of the Active Directory Account
          type: string
          enum:
            - MATCH
            - PARTIAL MATCH
            - NO MATCH
            - DUPLICATE
            - MANUAL MATCH
        matched_user:
          $ref: '#/components/schemas/NamedObject'
        project:
          $ref: '#/components/schemas/NamedObject'
        resource_group:
          $ref: '#/components/schemas/NamedObject'
        sam_account_name:
          description: The `sAMAccountName` field for this Active Directory account
          type: string
        sid:
          description: The Security Identifier (SID) for the Active Directory account
          type: string
        upn:
          description: The User Principal Name (UPN) for the Active Directory account
          type: string
    ActiveDirectoryAccountCheckoutDetails:
      description: Checkout details for an Active Directory account that the current user has some level of access to.
      allOf:
        - $ref: '#/components/schemas/ResourceCheckoutDetails'
      type: object
      properties:
        last_checked_out_by:
          description: The user who last checked out this Active Directory account
          type: string
    ActiveDirectoryAccountCheckoutDetailsList:
      description: Checkout details for an Active Directory account that the current user has some level of access to.
      allOf:
        - $ref: '#/components/schemas/ResourceCheckoutDetails'
      type: object
    ActiveDirectoryAccountEndUser:
      description: Information for an Active Directory account that the current user has some level of access to
      type: object
      properties:
        account:
          type: object
          description: Active Directory account details
          properties:
            id:
              description: The UUID of the Active Directory account
              allOf:
                - $ref: '#/components/schemas/UUID'
              readOnly: true
            username:
              description: The username of the Active Directory account
              type: string
              readOnly: true
            account_type:
              $ref: '#/components/schemas/ActiveDirectoryAccountType'
            availability_status:
              $ref: '#/components/schemas/ActiveDirectoryAccountStatus'
            first_name:
              description: The first name of this Active Directory user
              type: string
            last_name:
              description: The last name of this Active Directory user
              type: string
            email:
              description: The email of this Active Directory user
              type: string
            display_name:
              description: The display name of this Active Directory user
              type: string
            sam_account_name:
              description: The `sAMAccountName` field for this Active Directory account
              type: string
            brought_under_management_at:
              description: Timestamp when the Active Directory account was managed by Okta Privileged Access
              type: string
              format: date-time
            distinguished_name:
              description: The Distinguished Name (DN) referencing the Active Directory account
              type: string
            sid:
              description: The Security Identifier (SID) for the Active Directory account
              type: string
        checkout_details:
          $ref: '#/components/schemas/ActiveDirectoryAccountCheckoutDetails'
        rotation:
          type: object
          description: Active Directory account password rotation details
          properties:
            last_password_change_success_report_timestamp:
              description: Timestamp when the last successful password change was reported
              type: string
              format: date-time
            last_password_change_system_timestamp:
              description: Timestamp when the last password change was performed
              type: string
              format: date-time
            last_password_change_error_report_timestamp:
              description: Timestamp when the last password-change error was reported
              type: string
              format: date-time
            last_password_change_error_system_timestamp:
              description: Timestamp when the last password-change error was logged by the system
              type: string
              format: date-time
            last_password_change_error_type:
              description: The last password-change error type
              type: string
              nullable: true
            password_change_success_count:
              description: Total number of successful password changes
              type: integer
            password_change_error_count:
              description: Total number of password-change errors
              type: integer
            password_change_error_count_since_last_success:
              description: Number of password-change errors since the last successful password change
              type: integer
    ActiveDirectoryAccountEndUserList:
      description: Information for an Active Directory account that the current user has some level of access to
      type: object
      properties:
        account:
          type: object
          description: Active Directory account details
          properties:
            id:
              description: The UUID of the Active Directory account
              allOf:
                - $ref: '#/components/schemas/UUID'
              readOnly: true
            username:
              description: The username of the Active Directory account
              type: string
              readOnly: true
            account_type:
              $ref: '#/components/schemas/ActiveDirectoryAccountType'
            availability_status:
              $ref: '#/components/schemas/ActiveDirectoryAccountStatus'
        checkout_details:
          $ref: '#/components/schemas/ActiveDirectoryAccountCheckoutDetailsList'
    ActiveDirectoryAccountFieldNameFilter:
      description: Filter expression for Active Directory accounts
      type: object
      properties:
        field:
          $ref: '#/components/schemas/ActiveDirectoryAccountFieldNameFilterField'
        operator:
          $ref: '#/components/schemas/ActiveDirectoryFieldNameFilterOperator'
        value:
          type: string
      required:
        - field
        - operator
        - value
    ActiveDirectoryAccountFieldNameFilterField:
      description: Field name for filter expression
      type: string
      enum:
        - account_name
        - okta_group_name
    ActiveDirectoryAccountMatchRequest:
      description: |-
        Details about how the resource administrator would like to update the match between an Active Directory account
        and an Okta Privileged Access user
      type: object
      properties:
        force_no_match:
          type: boolean
          description: |-
            If true, don't match an OPA user to this Active Directory account. If
            `match_override_user_id` is set, this property must be unset or false.
        match_override_user_id:
          type: string
          description: |-
            The resource admin OPA user ID that you want to match to the specified AD account.
            If this property is null, empty, or unset, any existing override on the AD account is removed. You can only set one of
            `match_override_user_id` or `force_no_match`.
    ActiveDirectoryAccountMatchResponse:
      description: Details about the mapping between an Active Directory account and an Okta Privileged Access user
      type: object
      properties:
        ad_account_id:
          description: The UUID of the Active Directory account
          allOf:
            - $ref: '#/components/schemas/UUID'
          readOnly: true
        force_no_match:
          type: boolean
          description: |-
            If true, a resource admin has configured this AD account to not match with any
            OPA user. This overrides any automatic match from an AD account rule. Only
            one of `match_override_user_id` or `force_no_match` can be set.
        match_override_user_id:
          type: string
          description: |-
            The OPA user ID to match this AD account that's specified by a resource admin, overriding the automatic match.
            If set, this takes precedence over the
            `rule_match_user_id`. You can only set one of `match_override_user_id` or `force_no_match`.
          readOnly: true
        rule_match_user_id:
          type: string
          description: |-
            The OPA user ID that's automatically matched to this AD
            account based on the AD account rules configured on the connection. If unset, the AD user didn't
            match any OPA user based on the rule configuration that was last evaluated.
          readOnly: true
    ActiveDirectoryAccountPrivilegeContainer:
      description: Privileges granted to a user for an Active Directory account
      type: object
      properties:
        privilege_type:
          $ref: '#/components/schemas/SecurityPolicyRulePrivilegeTypeForActiveDirectoryAccounts'
        privilege_value:
          type: object
          description: The value of the privilege
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyPasswordCheckoutRDPPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyRotatePasswordPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyPasswordCheckoutSSHPrivilege'
          discriminator:
            propertyName: _type
            mapping:
              reveal_password: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
              password_checkout_rdp: '#/components/schemas/SecurityPolicyPasswordCheckoutRDPPrivilege'
              rotate_password: '#/components/schemas/SecurityPolicyRotatePasswordPrivilege'
              password_checkout_ssh: '#/components/schemas/SecurityPolicyPasswordCheckoutSSHPrivilege'
    ActiveDirectoryAccountRuleRequest:
      type: object
      properties:
        enable_import_okta_users:
          type: boolean
          default: false
          description: If `false`, the Active Directory accounts in the organizational unit (OU) targeted by this rule are no longer active Okta users. If `true` and Okta Active Directory integration is configured, then the accounts can become active Okta users. See [Import Active Directory users on demand](https://help.okta.com/okta_help.htm?type=oie&id=ext-ad-agent-import-users).
        enable_initial_password_rotation:
          type: boolean
          default: true
          description: If `true`, the initial password rotation is enabled for discovered Active Directory accounts
        enhanced_filters:
          type: array
          description: One list per OU. The index aligns with 'organizational_units'. Each inner list contains field-based filter expressions. If it's omitted or empty, no per-OU conditions are applied.
          items:
            type: array
            items:
              $ref: '#/components/schemas/ActiveDirectoryAccountFieldNameFilter'
            maxItems: 10
        name:
          type: string
          description: The name of the Active Directory account rule
        organizational_units:
          type: array
          description: The list of organizational units to discover individual accounts from
          items:
            type: string
        project:
          $ref: '#/components/schemas/NamedObject'
        resource_group:
          $ref: '#/components/schemas/NamedObject'
        rule_type:
          type: string
          description: The type of the Active Directory account rule
          enum:
            - SHARED
            - INDIVIDUAL
    ActiveDirectoryAccountRuleResponse:
      type: object
      properties:
        enable_import_okta_users:
          type: boolean
          description: If `false`, the Active Directory accounts in the organizational unit (OU) targeted by this rule are no longer active Okta users. If `true` and Okta Active Directory integration is configured, then the accounts can become active Okta users. See [Import Active Directory users on demand](https://help.okta.com/okta_help.htm?type=oie&id=ext-ad-agent-import-users).
        enable_initial_password_rotation:
          type: boolean
          description: If `true`, the initial password rotation is enabled for discovered Active Directory accounts
        enhanced_filters:
          type: array
          description: One list per OU. The index aligns with 'organizational_units'. Each inner list contains field-based filter expressions. If it's omitted or empty, no per-OU conditions are applied.
          items:
            type: array
            items:
              $ref: '#/components/schemas/ActiveDirectoryAccountFieldNameFilter'
            maxItems: 10
        id:
          description: The UUID of the Active Directory account rule
          allOf:
            - $ref: '#/components/schemas/UUID'
          readOnly: true
        name:
          type: string
          description: The name of the Active Directory account rule
        organizational_units:
          type: array
          description: The list of organizational units to discover individual accounts from
          items:
            type: string
        priority:
          type: integer
          description: The priority of the Active Directory account rule
          readOnly: true
        project:
          $ref: '#/components/schemas/NamedObject'
        resource_group:
          $ref: '#/components/schemas/NamedObject'
        rule_type:
          type: string
          description: The type of the Active Directory account rule
          enum:
            - SHARED
            - INDIVIDUAL
    ActiveDirectoryAccountRuleSettings:
      type: object
      properties:
        allow_partial_matches:
          description: Allow partial matches for the defined criteria
          type: boolean
        is_configured:
          description: If false, the account matching settings haven't been configured
          type: boolean
          readOnly: true
        matching_criteria:
          description: |-
            This matching criteria only applies to individual account rules.
            Imported users are recognized as an exact match if they match all of the following attributes.
          type: object
          allOf:
            - $ref: '#/components/schemas/ActiveDirectoryMatchingCriteria'
        partial_matching_criteria:
          description: Conditions for partial matching on Active Directory account and Okta user names
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectoryPartialMatchingCondition'
    ActiveDirectoryAccountStatus:
      description: Describes the current status of an Active Directory account
      type: string
      enum:
        - AVAILABLE
        - CHECKED_OUT
        - CHECKED_OUT_BY_OTHER_USER
        - UNAVAILABLE
      x-enumDescriptions:
        AVAILABLE: The account is available to the user
        UNAVAILABLE: The account is unavailable to the user
        CHECKED_OUT: The account is checked out by the user
        CHECKED_OUT_BY_OTHER_USER: The account is checked out by another user
      readOnly: true
    ActiveDirectoryAccountType:
      description: Describes the type of an Active Directory account
      type: string
      enum:
        - INDIVIDUAL
        - SHARED
      readOnly: true
    ActiveDirectoryAccountWithPasswordAndCheckoutDetails:
      allOf:
        - $ref: '#/components/schemas/ActiveDirectoryAccount'
        - $ref: '#/components/schemas/AccountPasswordChangeDetails'
      type: object
      properties:
        checkout_expiry_at:
          description: The timestamp when a user's exclusive access to the Active Directory account expires
          type: string
          format: date-time
        checkout_status:
          allOf:
            - $ref: '#/components/schemas/ResourceAvailabilityStatus'
          description: The Active Directory account's exclusive checkout status
        last_checkout_user:
          description: The username of the user who last accessed the Active Directory account through exclusive checkout
          type: string
        next_scheduled_password_rotation_reason:
          description: The reason for scheduling the next password rotation for the Active Directory account
          type: string
        next_scheduled_password_rotation_timestamp:
          description: The timestamp indicating when is the next scheduled Active Directory account password rotation
          type: string
          format: date-time
    ActiveDirectoryAccountWithSettings:
      allOf:
        - $ref: '#/components/schemas/ActiveDirectoryAccount'
      type: object
      properties:
        account_settings_enabled:
          description: The project level account settings that are enabled for this account
          type: array
          items:
            $ref: '#/components/schemas/AccountSetting'
    ActiveDirectoryAccountWithUAMs:
      description: Active Directory account with user access methods
      allOf:
        - $ref: '#/components/schemas/ActiveDirectoryAccount'
        - type: object
          properties:
            user_access_methods:
              description: User access methods available for the Active Directory account
              type: array
              nullable: true
              items:
                $ref: '#/components/schemas/UserAccessMethod'
      type: object
    ActiveDirectoryAccountsRevealCredentialsRequest:
      type: object
      properties:
        public_key:
          $ref: '#/components/schemas/RawJSONWebKey'
        user_access_method:
          $ref: '#/components/schemas/UserAccessMethodWithRuleIds'
      required:
        - public_key
        - user_access_method
    ActiveDirectoryAccountsRevealCredentialsResponse:
      type: object
      properties:
        password_jwe:
          type: string
      required:
        - password_jwe
    ActiveDirectoryAccountsRotatePasswordRequest:
      type: object
      properties:
        user_access_method:
          $ref: '#/components/schemas/UserAccessMethodWithRuleIds'
      required:
        - user_access_method
    ActiveDirectoryCheckoutSettings:
      type: object
      properties:
        checkout_duration_in_seconds:
          description: The duration in seconds for the checkout. If the checkout is enabled, the duration is the maximum time a user can access the resource before the checkout expires.
          type: integer
          maximum: 604800
          minimum: 900
          format: int32
        checkout_required:
          description: Indicates whether a checkout is mandatory for accessing resources within the project. If `true`, checkout is enforced by default for all applicable resources. If `false`, checkout is not required, and resources are accessible without it.
          type: boolean
        exclude_list:
          description: If provided, only the account identifiers listed are excluded from the checkout requirement. This list is only considered if `checkout_required` is set to `true`. Only one of `include_list` and `exclude_list` can be specified in a request since they are mutually exclusive.
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectorySettingNameObject'
        include_list:
          description: If provided, only the account identifiers listed are required to perform a checkout to access the resource. This list is only considered if `checkout_required` is set to `true`. Only one of `include_list` and `exclude_list` can be specified in a request since they are mutually exclusive.
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectorySettingNameObject'
      required:
        - checkout_required
        - checkout_duration_in_seconds
    ActiveDirectoryConnection:
      type: object
      properties:
        app_instance_id:
          description: The instance ID of the Active Directory app in your Okta org. This is a unique identifier assigned to each app in your Okta org.
          type: string
          readOnly: true
        domain:
          description: The name of the domain
          type: string
          readOnly: true
        id:
          description: The UUID of the Active Directory connection
          allOf:
            - $ref: '#/components/schemas/UUID'
          readOnly: true
        status:
          $ref: '#/components/schemas/ADConnectionStatus'
      required:
        - id
        - domain
        - app_instance_id
        - status
    ActiveDirectoryDomain:
      description: Information for an Active Directory domain that the current user has some level of access to
      type: object
      properties:
        domain:
          description: The name of the Active Directory domain
          type: string
          readOnly: true
        id:
          description: The UUID of the Active Directory domain
          allOf:
            - $ref: '#/components/schemas/UUID'
          readOnly: true
        okta_app_instance_id:
          description: The instance ID of the Active Directory app in your Okta org
          type: string
          readOnly: true
        status:
          $ref: '#/components/schemas/ADConnectionStatus'
      required:
        - id
        - domain
        - okta_app_instance_id
        - status
    ActiveDirectoryFieldNameFilterOperator:
      description: Filter expression operator
      type: string
      enum:
        - CONTAINS
        - ENDS_WITH
        - EQUALS
        - STARTS_WITH
    ActiveDirectoryMatchingCriteria:
      type: object
      properties:
        display_name:
          description: If set, display name attribute must match
          type: boolean
        email:
          description: If set, email attribute must match
          type: boolean
        first_and_last_name:
          description: If set, first and last name attributes must match
          type: boolean
        username:
          description: If set, username attribute must match
          type: boolean
    ActiveDirectoryPartialMatchingCondition:
      description: Partial matching condition
      type: object
      properties:
        match_value:
          description: String value for the partial matching condition
          type: string
        operator:
          $ref: '#/components/schemas/ActiveDirectoryPartialMatchingOperator'
    ActiveDirectoryPartialMatchingOperator:
      description: Partial matching operator for Active Directory account and Okta user names
      type: string
      enum:
        - ENDS WITH
        - STARTS WITH
    ActiveDirectoryPasswordPolicy:
      type: object
      properties:
        character_options:
          description: The specific characters rules required by the password policy
          type: object
          properties:
            upper_case:
              type: boolean
              description: If `true`, passwords can include one or more uppercase characters
            lower_case:
              type: boolean
              description: If `true`, passwords can include one or more lowercase characters
            digits:
              type: boolean
              description: If `true`, passwords can include one or more numbers
            punctuation:
              type: boolean
              description: If `true`, passwords can include one or more symbols
            exclude_certain_symbols:
              description: Symbols to exclude from generated passwords. Each item must be a single punctuation character. This property applies only when `punctuation` is `true`.
              type: array
              items:
                type: string
        enable_periodic_rotation:
          description: If `true`, rotates account passwords between the specified time period. You must also set the `periodic_rotation_duration_in_seconds` and `periodic_rotation_account_selector_mode` properties.
          type: boolean
        max_length_in_bytes:
          description: The maximum length allowed for the password
          type: integer
        min_length_in_bytes:
          description: The minimum length allowed for the password
          type: integer
        modified_at:
          description: A timestamp indicating when the password policy was last modified
          type: string
          format: date-time
          readOnly: true
        periodic_rotation_account_exclude_list:
          description: If `periodic_rotation_account_selector_mode` is set to `EXCLUDE`, all of the actively managed accounts in the project, except those listed, will have their password periodically rotated
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectorySettingNameObject'
        periodic_rotation_account_include_list:
          description: If `periodic_rotation_account_selector_mode` is set to `INCLUDE`, only the actively managed accounts listed will have their password periodically rotated
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectorySettingNameObject'
        periodic_rotation_account_selector_mode:
          $ref: '#/components/schemas/AccountSelectorMode'
        periodic_rotation_duration_in_seconds:
          description: Specifies how often the Okta Privileged Access platform rotates account passwords
          type: integer
      required:
        - enable_periodic_rotation
        - min_length_in_bytes
        - max_length_in_bytes
        - character_options
    ActiveDirectorySettingNameObject:
      type: object
      properties:
        account_name:
          description: The name of the Active Directory account
          type: string
          readOnly: true
        account_sid:
          description: The security identifier (SID) of the selected Active Directory account
          type: string
          minLength: 1
          maxLength: 256
        domain:
          description: The domain of the selected Active Directory account
          type: string
          minLength: 1
          maxLength: 255
        missing:
          description: Indicates if the selected Active Directory account isn't found
          type: boolean
          readOnly: true
      required:
        - domain
        - account_sid
    AppPasswordRotationStrategy:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      description: Determines the method to use for rotating a password for a SaaS app instance
      type: string
      enum:
        - USING_ADMIN
        - USING_EXISTING_PASSWORD
      x-enumDescriptions:
        USING_ADMIN: Rotate using an admin account
        USING_EXISTING_PASSWORD: Rotate using the account's current password
    AppPasswordRotationStrategyPatch:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        password_rotation_strategy:
          $ref: '#/components/schemas/AppPasswordRotationStrategy'
    AppServiceAccount:
      type: object
      properties:
        containerGlobalName:
          description: The key name of the app in the Okta Integration Network (OIN)
          readOnly: true
          type: string
          example: salesforce
        containerInstanceName:
          description: The app instance label
          readOnly: true
          type: string
          example: salesforce Prod 5
        containerOrn:
          description: |-
            The [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) of the relevant resource.

            Use the specific app ORN format (`orn:{partition}:idp:{yourOrgId}:apps:{appType}:{appId}`) to identify an Okta app instance in your org.
          type: string
          example: orn:okta:idp:00o1n8sbwArJ7OQRw406:apps:salesforce:0oa1gjh63g214q0Hq0g4
        created:
          type: string
          format: date-time
          description: Timestamp when the app service account was created
          readOnly: true
        description:
          description: The description of the app service account
          format: regex
          maxLength: 255
          minLength: 0
          type: string
          example: This is for accessing salesforce Prod-5
        id:
          description: The UUID of the app service account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
          example: a747a818-a4c4-4446-8a87-704216495a08
        lastUpdated:
          type: string
          format: date-time
          description: Timestamp when the app service account was last updated
          readOnly: true
        name:
          description: The user-defined name for the app service account
          format: regex
          maxLength: 50
          minLength: 1
          pattern: ^[\w\-_. ]+$
          type: string
          example: salesforce Prod-5 account
        ownerGroupIds:
          description: A list of IDs of the Okta groups who own the app service account
          type: array
          items:
            type: string
          minItems: 0
          maxItems: 10
          example:
            - 00g57qp78yZT2XBA40g7
        ownerUserIds:
          description: A list of IDs of the Okta users who own the app service account
          type: array
          items:
            type: string
          minItems: 0
          maxItems: 10
          example:
            - 00u11s48P9zGW8yqm0g5
        password:
          type: string
          writeOnly: true
          description: The app service account password. Required when creating an app service account.
          format: password
          minLength: 1
          maxLength: 255
        username:
          type: string
          description: The username that serves as the direct link to your managed app account. Ensure that this value precisely matches the identifier of the target app account.
          minLength: 1
          maxLength: 100
          example: testuser-salesforce-5@example.com
      required:
        - name
        - containerOrn
        - username
        - password
    AppServiceAccountForUpdate:
      type: object
      properties:
        description:
          description: The description of the app service account
          format: regex
          maxLength: 255
          minLength: 0
          type: string
          example: This is for accessing salesforce Prod-5
        name:
          description: The user-defined name for the app service account
          format: regex
          maxLength: 50
          minLength: 1
          pattern: ^[\w\-_. ]+$
          type: string
          example: salesforce Prod-5 account
        ownerGroupIds:
          description: A list of IDs of the Okta groups who own the app service account
          type: array
          items:
            type: string
          minItems: 0
          maxItems: 10
          example:
            - 00g57qp78yZT2XBA40g7
        ownerUserIds:
          description: A list of IDs of the Okta users who own the app service account
          type: array
          items:
            type: string
          minItems: 0
          maxItems: 10
          example:
            - 00u11s48P9zGW8yqm0g5
    AttributeOption:
      description: Attribute option entry configured for a team.
      type: object
      properties:
        attribute_name:
          type: string
          enum:
            - unix_uid
            - unix_gid
          example: unix_uid
          description: |
            The attribute name. Valid values:
            * `unix_uid`, `unix_gid` (for `user` namespace)
            * `unix_gid` (for `group` namespace)
        details:
          $ref: '#/components/schemas/AttributeOptionDetails'
        namespace:
          type: string
          enum:
            - user
            - group
          example: user
          description: Namespace for the attribute option. Valid values are `user` or `group`.
        team_id:
          type: string
          format: uuid
          description: The team that the attribute option belongs to
          readOnly: true
        updated_at:
          type: string
          format: date-time
          description: Timestamp of when the attribute option was last updated
      required:
        - namespace
        - attribute_name
        - details
    AttributeOptionDetails:
      description: Attribute option details (the range for UID or GID attributes)
      type: object
      properties:
        max:
          type: integer
          format: int64
          minimum: 1001
          maximum: 4294967295
          description: The maximum value of the attribute range. Must be greater than 1000 or greater than the `min` value.
        min:
          type: integer
          format: int64
          minimum: 1001
          maximum: 4294967295
          description: The minimum value for the attribute range. Must be greater than 1000 and less than the `max` value.
      required:
        - min
        - max
    AuthTokenResponse:
      type: object
      properties:
        bearer_token:
          description: The JSON Web Token used to authenticate against the API
          maxLength: 4096
          minLength: 1
          readOnly: true
          type: string
        expires_at:
          description: A timestamp for when the token expires. Formatted in accordance with [RFC 3339](https://tools.ietf.org/html/rfc3339).
          format: date-time
          readOnly: true
          type: string
        team_name:
          description: The name of the associated team
          maxLength: 4096
          minLength: 1
          readOnly: true
          type: string
      required:
        - bearer_token
        - expires_at
        - team_name
    BadRequestResponse:
      description: JSON response for a bad request
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 400
        message:
          type: string
          description: A short description of what caused the error. A dynamic description is sometimes generated for the specific error.
          example: Bad Request
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - bad_request
    CheckedOutResourceByAdminDetails:
      allOf:
        - $ref: '#/components/schemas/CheckedOutResourceByUserDetails'
        - type: object
          properties:
            checkout_by_username:
              description: The username of the user who checked out the resource
              type: string
              readOnly: true
            resource_status:
              allOf:
                - $ref: '#/components/schemas/ResourceAvailabilityStatus'
              readOnly: true
    CheckedOutResourceByUserDetails:
      type: object
      properties:
        checkin_by:
          description: The UUID of the user or system responsible for the last checkin
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
        checkin_start_at:
          description: The timestamp when the resource checkin process started
          format: date-time
          type: string
          readOnly: true
        checkin_type:
          allOf:
            - $ref: '#/components/schemas/CheckinType'
          readOnly: true
        checkout_at:
          description: The timestamp when the resource was checked out
          format: date-time
          type: string
          readOnly: true
        checkout_expiry_at:
          description: The timestamp when the resource lease expires
          format: date-time
          type: string
          readOnly: true
        resource_details:
          description: The additional details of the resource. Only returned if a `resource_type` query was specified.
          oneOf:
            - $ref: '#/components/schemas/ServerAccountCheckedOutResourceDetails'
            - $ref: '#/components/schemas/SaasAppAccountCheckedOutResourceDetails'
            - $ref: '#/components/schemas/OktaUniversalDirectoryAccountCheckedOutResourceDetails'
          discriminator:
            propertyName: _type
            mapping:
              server_account_password_login: '#/components/schemas/ServerAccountCheckedOutResourceDetails'
              managed_saas_app_account_password_login: '#/components/schemas/SaasAppAccountCheckedOutResourceDetails'
              okta_universal_directory_account_password_login: '#/components/schemas/OktaUniversalDirectoryAccountCheckedOutResourceDetails'
        resource_id:
          description: The UUID of the resource
          type: string
          readOnly: true
        resource_name:
          description: The name of the resource. Only returned if a `resource_type` query was specified.
          type: string
          readOnly: true
        resource_type:
          allOf:
            - $ref: '#/components/schemas/CheckoutResourceType'
          readOnly: true
      required:
        - resource_id
        - resource_type
        - checkout_at
        - checkout_expiry_at
    CheckinResourceRequest:
      type: object
      properties:
        resource_id:
          description: The UUID or ORN of the resource
          type: string
        resource_type:
          $ref: '#/components/schemas/CheckoutResourceType'
      required:
        - resource_id
        - resource_type
    CheckinType:
      description: Identifies the trigger for the checkin process
      type: string
      enum:
        - admin
        - self
        - system_checkout_expired
        - system_user_lost_access
    CheckoutRequirements:
      description: Checkout requirements
      type: object
      properties:
        max_checkout_duration_in_seconds:
          description: The maximum duration (in seconds) that a resource can be checked out. If the security policy checkout duration configuration is overridden, the maximum duration is based on the project's checkout settings.
          type: integer
        required:
          description: Indicates if checkout is required
          type: boolean
    CheckoutResourceType:
      description: The type of resource that was checked out
      type: string
      enum:
        - managed_saas_app_account_password_login
        - okta_universal_directory_account_password_login
        - server_account_password_login
    Client:
      type: object
      properties:
        deleted_at:
          description: The date the client was deleted
          format: date-time
          readOnly: true
          type: string
        description:
          description: A description of the client
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        encrypted:
          description: If `true`, the client has detected that the local device is encrypted
          readOnly: true
          type: boolean
        hostname:
          description: The hostname of the local device running the client
          maxLength: 256
          minLength: 1
          readOnly: true
          type: string
        id:
          description: The UUID of the client
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        os:
          description: The OS of the local device running the client
          maxLength: 256
          minLength: 1
          readOnly: true
          type: string
        state:
          description: 'The state of the client: `ACTIVE`, `PENDING`, or `DELETED`'
          maxLength: 255
          nullable: true
          readOnly: true
          type: string
        user_name:
          description: The user associated with the client
          maxLength: 32
          minLength: 1
          nullable: true
          readOnly: true
          type: string
      required:
        - id
        - user_name
        - description
        - hostname
        - os
        - encrypted
        - deleted_at
        - state
    ClientUpdateRequest:
      type: object
      properties:
        state:
          description: 'The state of the client: `ACTIVE`, `PENDING`, or `DELETED`'
          maxLength: 255
          nullable: true
          type: string
        user_name:
          description: The user associated with the client
          maxLength: 255
          nullable: true
          type: string
    CloudProviderType:
      description: If available, the name of cloud provider used by the gateway
      maxLength: 255
      minLength: 1
      nullable: true
      type: string
      enum:
        - aws
        - azure
        - gce
      readOnly: true
    ConditionsAccessRequests:
      title: access_request
      description: Identifies an existing Request Type in Access Requests
      type: object
      properties:
        expires_after_seconds:
          type: integer
          format: int32
          description: The number of seconds the approval remains valid
          example: 900
        request_type_id:
          type: string
          description: The ID for a specific Request Type
          readOnly: true
          example: 949311bf-d06b-4891-8044-e166f00e3f8c
        request_type_name:
          type: string
          description: The name of a specific Request Type
          example: Dev Manager Approval
        _type:
          type: string
          readOnly: true
          enum:
            - access_request
      required:
        - _type
        - request_type_id
        - request_type_name
        - expires_after_seconds
    ConditionsGateway:
      title: gateway
      description: Configures traffic settings for an existing OPA Gateway
      type: object
      properties:
        session_recording:
          type: boolean
          description: Whether to record sessions made through an OPA Gateway
          example: false
        traffic_forwarding:
          type: boolean
          description: Whether to forward traffic through an OPA Gateway
          example: true
        _type:
          type: string
          readOnly: true
          enum:
            - gateway
      required:
        - _type
    ConditionsMFA:
      title: mfa
      description: Configures MFA requirements for the security policy
      type: object
      properties:
        acr_values:
          $ref: '#/components/schemas/ConditionsMFAACRValues'
        re_auth_frequency_in_seconds:
          type: integer
          format: int32
          description: Defines the number of seconds an MFA verification remains valid. After this time, users need to reauthenticate before they can open new connections to resources. Defining a value of `0` requires users to authenticate for every connection.
          default: 1800
          minimum: 300
          maximum: 43200
        _type:
          type: string
          readOnly: true
          enum:
            - mfa
      required:
        - _type
        - re_auth_frequency_in_seconds
    ConditionsMFAACRValues:
      description: Defines the authentication context class reference (ACR) for this policy. See [Step-up authentication using ACR values](https://developer.okta.com/docs/guides/step-up-authentication/main/).
      type: string
      enum:
        - phr
        - urn:okta:loa:2fa:any
      x-enumDescriptions:
        urn:okta:loa:2fa:any: Any two factors. Allows two factor authentication with no requirements on which factors.
        phr: <x-lifecycle class="oie"></x-lifecycle> Phishing-Resistant. Requires users to provide possession factors that cryptographically verify the sign-in server (the origin). Currently, only the Passkey (FIDO2 WebAuthn) authenticator satisfies this requirement. Because phishing resistance implies [device binding](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-authenticators), that constraint is selected automatically when `phr` is specified.
    ConflictResponse:
      description: JSON response for a request conflicting with the current state
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 409
        message:
          type: string
          description: A short description of what caused the error. A dynamic description is sometimes generated for the specific error.
          example: Conflict
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - conflict
    CreateServiceUserBody:
      type: object
      properties:
        name:
          description: The name of the service user
          format: regex
          maxLength: 255
          minLength: 1
          type: string
      required:
        - name
    CurrentUserInfo:
      type: object
      properties:
        id:
          description: The UUID of the user
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        name:
          description: The name of the user
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        team_name:
          description: The name of the team
          type: string
          readOnly: true
      required:
        - team_name
        - name
        - id
    ForbiddenUAMResponse:
      description: JSON response for a request which contained a user access method that does not currently authorize the user to perform the requested action
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 403
        message:
          type: string
          description: A short description of what caused the error. A dynamic description is sometimes generated for the specific error.
          example: The selected user access method has some conditions that are not met
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - forbidden
    GatewayAgent:
      type: object
      properties:
        access_address:
          description: The IP address used to access the gateway
          type: string
          example: 192.168.190.144:7234
        cloud_provider:
          $ref: '#/components/schemas/CloudProviderType'
        default_address:
          description: The default IP address used to access the gateway. This is generally supplied by the network interface or cloud provider metadata.
          type: string
          example: 192.168.19.32
        description:
          description: The description of the gateway
          maxLength: 1024
          minLength: 1
          nullable: true
          type: string
        id:
          description: The ID of the gateway
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
          example: d4f40b71-9474-41c5-94ff-3196a4fc2d03
        labels:
          additionalProperties:
            type: string
          description: The labels associated with the gateway. Used by projects to select gateways.
          type: object
        last_seen:
          description: A timestamp indicating when the gateway last reported to the Okta Privileged Access platform
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T13:00:00.000000Z'
        name:
          description: The name for the gateway
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          type: string
          example: ProductionGateway
        refuse_connections:
          description: Whether the gateway should refuse connections. Defaults to `False`.
          readOnly: true
          type: boolean
          example: false
      required:
        - id
        - name
        - refuse_connections
        - labels
    GatewaySetupToken:
      type: object
      properties:
        created_at:
          description: A timestamp indicating when the gateway setup token was created
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
        description:
          description: The description for the gateway setup token
          maxLength: 1024
          minLength: 1
          nullable: true
          type: string
          example: Gateway Token 1
        details:
          description: An object that defines the labels applied to associated gateways
          discriminator:
            mapping:
              gateway-agent: '#/components/schemas/gateway-agent'
            propertyName: Type
          oneOf:
            - $ref: '#/components/schemas/gateway-agent'
          type: object
        id:
          description: The ID of the gateway setup token
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
          example: b09ba4db-d5b4-4ec5-90da-188e1d13d467
        name:
          description: The name for the gateway setup token
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          type: string
          example: ProductionGateway
        registration_type:
          allOf:
            - $ref: '#/components/schemas/GatewaySetupTokenRegistrationType'
          example: gateway-agent
        token:
          description: The token used to enroll the gateway
          readOnly: true
          type: string
          example: sft-gw.342c346c-256e-49d5-8db4-426426eqe26e4.eyJhdCI6ImZ5X2lZMnFmVk1TcHJQcDlUSEh0MS1SR240ae9OOXZsSXEwUWhoNlNnSnciLCJhcyI6Imh0dHBzO0123GFtLXByb2R1Y3QtdGMxLnBhbS50cmV4Y2xvdWQuY29tposeL2FzL2FnZW50IiwicnMiOiJodHRwczovL3BhbS1wcm9kdWN0LXRjMS5wYW0udHJleGNsb3VkLmNvabc2MSyq
      required:
        - id
        - registration_type
        - details
    GatewaySetupTokenRegistrationType:
      description: The type of registration policy
      type: string
      enum:
        - gateway-agent
    GatewayStatusReport:
      type: object
      properties:
        active_connections:
          description: The number of clients actively connected to the gateway
          maximum: 2147483647
          type: integer
          format: int32
        gateway_id:
          description: The ID of the gateway ID
          maxLength: 255
          minLength: 1
          nullable: true
          readOnly: true
          type: string
        status:
          description: The status of the gateway
          maxLength: 255
          nullable: true
          type: string
        total_storage_bytes:
          description: The total amount in bytes of storage space available for use by the gateway
          maximum: 9223372036854776000
          type: integer
          format: int64
        used_storage_bytes:
          description: The amount in bytes of storage space used by the gateway
          maximum: 9223372036854776000
          type: integer
          format: int64
      required:
        - total_storage_bytes
        - used_storage_bytes
        - active_connections
    Group:
      type: object
      properties:
        deleted_at:
          description: A timestamp indicating when the group was deleted
          format: date-time
          readOnly: true
          type: string
        id:
          description: The UUID of the group
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        name:
          description: The name of the group
          maxLength: 255
          minLength: 1
          type: string
        roles:
          description: The roles assigned to the group
          type: array
          items:
            $ref: '#/components/schemas/GroupRole'
      required:
        - id
        - name
        - roles
        - deleted_at
    GroupAttributeName:
      description: The type of attribute
      type: string
      enum:
        - unix_gid
        - unix_group_name
        - windows_group_name
    GroupCreate:
      type: object
      properties:
        deleted_at:
          description: A timestamp indicating when the group was deleted
          format: date-time
          readOnly: true
          type: string
        id:
          description: The UUID of the group
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        name:
          description: The name of the group
          maxLength: 255
          minLength: 1
          type: string
        roles:
          description: The roles assigned to the group
          type: array
          items:
            $ref: '#/components/schemas/GroupCreateRole'
      required:
        - id
        - name
        - roles
        - deleted_at
    GroupCreateRole:
      type: string
      enum:
        - pam_admin
        - resource_admin
        - security_admin
    GroupRole:
      type: string
      enum:
        - delegated_resource_admin
        - pam_admin
        - resource_admin
        - security_admin
    GroupUpdate:
      type: object
      properties:
        roles:
          description: The roles assigned to the group
          type: array
          items:
            $ref: '#/components/schemas/GroupUpdateRole'
      required:
        - roles
    GroupUpdateRole:
      type: string
      enum:
        - end_user
        - pam_admin
        - resource_admin
        - security_admin
    IssueServiceTokenRequestBody:
      type: object
      properties:
        key_id:
          description: The ID of the API key
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
        key_secret:
          description: The secret associated with the API key
          maxLength: 512
          minLength: 1
          type: string
      required:
        - key_id
        - key_secret
    ListActiveDirectoryAccountsResponse:
      description: Response schema for listing Active Directory accounts
      type: object
      properties:
        list:
          description: |-
            List of Active Directory accounts with user access methods.
            User access methods are returned when the `include_user_access_methods` query parameter is set to `true` in the request.
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectoryAccountWithUAMs'
          maxItems: 25
    ListResourceGroup:
      type: object
      properties:
        description:
          description: A description of the resource group
          type: string
        id:
          description: The UUID of the resource group
          type: string
          readOnly: true
        name:
          description: The name of the resource group
          type: string
        team_id:
          description: The UUID of the team associated with the resource group
          type: string
          readOnly: true
    ListUAMForActiveDirectoryAccountResponse:
      description: List of `User Access Methods` for an Active Directory account
      type: object
      properties:
        list:
          type: array
          items:
            $ref: '#/components/schemas/UserAccessMethod'
      required:
        - list
    ListUAMForServiceAccountResponse:
      description: List of user access methods for a service account
      type: object
      properties:
        list:
          type: array
          items:
            $ref: '#/components/schemas/UserAccessMethod'
      required:
        - list
    ManagedServerAccountPrivilegeContainer:
      description: Privileges granted to a user for a managed server account
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        privilege_type:
          $ref: '#/components/schemas/SecurityPolicyRulePrivilegeTypeForManagedServerAccounts'
        privilege_value:
          type: object
          description: The value of the privilege
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyPasswordCheckoutSSHPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyPasswordCheckoutRDPPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
          discriminator:
            propertyName: _type
            mapping:
              reveal_password: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
    NameResolutionResult:
      type: object
      properties:
        name:
          description: Name of the resource
          type: string
        servers:
          description: A list of servers and bastions used to reach the target resource
          items:
            $ref: '#/components/schemas/Server'
          type: array
        user_access_methods:
          description: A list of user access methods used to access the resource
          items:
            $ref: '#/components/schemas/UserAccessMethod'
          type: array
      required:
        - name
    NamedObject:
      title: NamedObject
      description: A reference to an object that has its ID, name and type
      type: object
      properties:
        id:
          type: string
          description: The UUID of the object
        missing:
          type: boolean
          description: A boolean value that indicates if the named object with the given ID is valid
        name:
          type: string
          description: The name of the object
          readOnly: true
        type:
          $ref: '#/components/schemas/NamedObjectType'
      required:
        - id
    NamedObjectType:
      description: The type of the named object
      type: string
      enum:
        - active_directory_connection
        - active_directory_shared_account
        - managed_saas_app_account
        - okta_account
        - project
        - resource_group
        - saas_app_instance
        - secret
        - secret_folder
        - server
        - sudo_command_bundle
        - unmanaged_saas_app_account
        - user
        - user_group
        - workload_connection
        - workload_role
      readOnly: true
    NotFoundResponse:
      description: JSON response for accessing an invalid endpoint
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 404
        message:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
          example: Not Found
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - not_found
    OktaUniversalDirectoryAccount:
      type: object
      properties:
        created_at:
          description: A timestamp that indicates when the Okta Privileged Access-managed Universal Directory account was created
          type: string
          format: date-time
          readOnly: true
        description:
          description: A brief description of the Universal Directory account
          type: string
          example: Shared admin account for managing Active Directory integrations
        id:
          description: The UUID of the Universal Directory account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
          example: d1b65a78-21ed-429b-8ea3-eec96f2748d6
        lcm_sync_possible:
          description: Whether the password for the Universal Directory account can be rotated using Okta Lifecycle Management
          type: boolean
        name:
          description: A human-readable name for the Universal Directory account
          type: string
          example: Active Directory Integrations Admin
        okta_user_id:
          description: The Okta user ID for the Universal Directory account
          type: string
          example: 00u11s48P9zGW8yqm0g5
        sync_status:
          $ref: '#/components/schemas/ServiceAccountSyncStatus'
        updated_at:
          description: A timestamp that indicates when the Okta Privileged Access-managed Universal Directory account was updated
          type: string
          format: date-time
          readOnly: true
        username:
          description: The username used to log into Okta
          type: string
          example: shr-ad-admin-01@example.okta.com
    OktaUniversalDirectoryAccountCheckedOutResourceDetails:
      type: object
      properties:
        account_name:
          description: The name of the Universal Directory account associated with the resource
          type: string
          readOnly: true
        app_name:
          description: The name of the Okta Application associated with the resource
          default: Okta
          type: string
          readOnly: true
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this Resource object
    OktaUniversalDirectoryAccountDetails:
      allOf:
        - $ref: '#/components/schemas/AccountPasswordChangeDetails'
      type: object
      properties:
        account_name:
          description: A human-readable name for the Universal Directory account
          type: string
          example: AWS Prod-5 account
        checkout_enabled:
          description: Indicates whether this Universal Directory account is included in the checkout settings
          type: boolean
        checkout_expiry_at:
          description: The period after checkout when a user's access to the Universal Directory account will expire
          type: string
          format: date-time
        checkout_status:
          allOf:
            - $ref: '#/components/schemas/ResourceAvailabilityStatus'
          description: The Universal Directory account's checkout status
        created_at:
          description: A timestamp that indicates when the Universal Directory account was created
          type: string
          format: date-time
          readOnly: true
        id:
          description: The UUID of the SaaS Application Account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
          example: d1b65a78-21ed-429b-8ea3-eec96f2748d6
        last_checkout_user:
          description: The username of the user who last accessed the Universal Directory accounts via checkout
          type: string
        next_scheduled_password_rotation_reason:
          description: The reason for scheduling the next password rotation for the Universal Directory account
          type: string
        next_scheduled_password_rotation_timestamp:
          description: The timestamp indicating when the Universal Directory account password is scheduled to be rotated next
          type: string
          format: date-time
        project_id:
          description: The UUID of the Project associated with this Universal Directory account
          type: string
        team_id:
          description: The UUID of the Team associated with this Universal Directory account
          type: string
        username:
          description: The username used to log into the Universal Directory account
          type: string
          example: OpsCaliforniaShared
      readOnly: true
    OktaUniversalDirectoryAccountWithSettings:
      allOf:
        - $ref: '#/components/schemas/OktaUniversalDirectoryAccount'
      type: object
      properties:
        account_settings_enabled:
          description: The project level account settings that are enabled for this account
          type: array
          items:
            $ref: '#/components/schemas/AccountSetting'
        last_password_change_system_timestamp:
          description: A timestamp indicating when Okta Privileged Access last reported a change to the Universal Directory account password
          type: string
          format: date-time
          readOnly: true
    PasswordPolicy:
      type: object
      properties:
        character_options:
          description: The specific characters rules required by the password policy
          type: object
          properties:
            upper_case:
              type: boolean
              description: If `true`, passwords can include one or more uppercase characters
            lower_case:
              type: boolean
              description: If `true`, passwords can include one or more lowercase characters
            digits:
              type: boolean
              description: If `true`, passwords can include one or more numbers
            punctuation:
              type: boolean
              description: If `true`, passwords can include one or more symbols
            exclude_certain_symbols:
              description: Symbols to exclude from generated passwords. Each item must be a single punctuation character. This property applies only when `punctuation` is `true`.
              type: array
              items:
                type: string
        enable_periodic_rotation:
          description: If `true`, rotates account passwords after a period of time has passed. You must also set the `periodic_rotation_duration_in_seconds` parameter.
          type: boolean
        managed_privileged_accounts_config:
          description: An array of managed accounts for password rotation
          type: array
          items:
            type: string
        max_length_in_bytes:
          description: The maximum length allowed for the password
          type: integer
        min_length_in_bytes:
          description: The minimum length allowed for the password
          type: integer
        modified_at:
          description: A timestamp indicating when the password policy was last modified
          type: string
          format: date-time
          readOnly: true
        periodic_rotation_duration_in_seconds:
          description: If `enable_periodic_rotation` is enabled, specifies how often the Okta Privileged Access platform rotates account passwords.
          type: integer
      required:
        - enable_periodic_rotation
        - min_length_in_bytes
        - max_length_in_bytes
        - character_options
    PasswordPolicyWithExclude:
      type: object
      properties:
        character_options:
          description: The specific characters rules required by the password policy
          type: object
          properties:
            upper_case:
              type: boolean
              description: If `true`, passwords can include one or more uppercase characters
            lower_case:
              type: boolean
              description: If `true`, passwords can include one or more lowercase characters
            digits:
              type: boolean
              description: If `true`, passwords can include one or more numbers
            punctuation:
              type: boolean
              description: If `true`, passwords can include one or more symbols
            exclude_certain_symbols:
              description: Symbols to exclude from generated passwords. Each item must be a single punctuation character. This property applies only when `punctuation` is `true`.
              type: array
              items:
                type: string
        enable_periodic_rotation:
          description: If `true`, rotates account passwords after a period of time has passed. You must also set the `periodic_rotation_duration_in_seconds` and `periodic_rotation_account_selector_mode` params.
          type: boolean
        max_length_in_bytes:
          description: The maximum length allowed for the password
          type: integer
        min_length_in_bytes:
          description: The minimum length allowed for the password
          type: integer
        modified_at:
          description: A timestamp indicating when the password policy was last modified
          type: string
          format: date-time
          readOnly: true
        periodic_rotation_account_exclude_list:
          description: If `periodic_rotation_account_selector_mode` is set to `EXCLUDE`, all of the actively managed accounts in the project, except those listed, will have their password periodically rotated
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccountSettingNameObject'
        periodic_rotation_account_include_list:
          description: If `periodic_rotation_account_selector_mode` is set to `INCLUDE`, only the actively managed accounts listed will have their password periodically rotated
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccountSettingNameObject'
        periodic_rotation_account_selector_mode:
          $ref: '#/components/schemas/AccountSelectorMode'
        periodic_rotation_duration_in_seconds:
          description: Specifies how often the Okta Privileged Access platform rotates account passwords
          type: integer
      required:
        - enable_periodic_rotation
        - min_length_in_bytes
        - max_length_in_bytes
        - character_options
    PreconditionFailedResponse:
      description: JSON response for a precondition failure
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 412
        message:
          type: string
          description: A short description of what caused the error. A dynamic description is sometimes generated for the specific error.
          example: Precondition Failed
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - precondition_failed
    PreconditionRequiredResponse:
      description: JSON response for a precondition required error
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 428
        message:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
          example: Precondition Required
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - precondition_required
    Project:
      type: object
      properties:
        active_resource_count:
          type: integer
          format: int32
          description: The number of active resources within this project
          example: 50
        create_server_users:
          description: Whether to create server users for users in this project. Defaults to `false`. If `false`, you must ensure that accounts exist on the server for each user.
          nullable: true
          type: boolean
        deleted_at:
          description: A timestamp indicating when the project was deleted
          format: date-time
          nullable: true
          readOnly: true
          type: string
        force_shared_ssh_users:
          description: Whether to force the project to use a shared SSH account
          type: boolean
        gateway_selector:
          description: 'A comma separated list of labels used to match to enrolled gateways. Labels should use the following format: `key=value`'
          type: string
          example: REGION=WEST-EU,TEAM=MARKETING
        id:
          description: The UUID of the project
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        name:
          description: The name of the project
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          type: string
        next_unix_gid:
          description: The GID used when creating a server user
          maximum: 65535
          minimum: 100
          nullable: true
          type: integer
          format: int32
        next_unix_uid:
          description: The UID used when creating a server user
          maximum: 65535
          minimum: 100
          nullable: true
          type: integer
          format: int32
        persistent_server_user_accounts:
          description: If `true`, creates persistent user accounts and home folders on servers in this project for every user on your team. By default, on-demand accounts are only created when a user accesses a server.
          nullable: true
          default: null
          type: boolean
        require_preauth_for_creds:
          description: If `true`, the project requires preauthorization before a user can access a server. Default is `false`.
          nullable: true
          type: boolean
        resource_group_id:
          type: string
          description: The UUID of the resource group where the project is located
          example: 5f3159e9-e7ab-428e-8a87-c2ebffe407f6
        server_account_management:
          description: Whether to manage existing local accounts on the server
          type: boolean
        shared_admin_user_name:
          description: The shared username to use for root accounts
          type: string
          example: Server.Admin
        shared_standard_user_name:
          description: The shared username to use for non-root accounts
          type: string
          example: Server.User
        ssh_certificate_type:
          $ref: '#/components/schemas/SSHCertificateType'
        stale_resource_count:
          type: integer
          format: int32
          description: The number of stale resources within this project
          example: 0
        team:
          description: The team associated with the project
          example: Your_OPA_Team
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          readOnly: true
          type: string
        user_on_demand_period:
          readOnly: true
          description: The time period in seconds before an on-demand user account expires and is removed from a server. `0` if disabled. This is the default,
          maximum: 4294967295
          nullable: true
          type: integer
          format: int64
      required:
        - name
        - id
        - team
    RandomPasswordCharacterOptions:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        digits:
          type: boolean
          description: If `true`, passwords include one or more numbers
        lower_case:
          type: boolean
          description: If `true`, passwords include one or more lowercase letters
        special_characters:
          type: boolean
          description: If `true`, passwords include one or more symbols
        upper_case:
          type: boolean
          description: If `true`, passwords include one or more uppercase letters
    RandomPasswordCreateRequest:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        character_options:
          $ref: '#/components/schemas/RandomPasswordCharacterOptions'
        num_chars:
          description: The desired length for the password
          type: integer
        public_key:
          $ref: '#/components/schemas/RawJSONWebKey'
      required:
        - public_key
        - character_options
        - num_chars
    RandomPasswordCreateResponse:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        password_jwe:
          description: The encrypted password as a fully serialized JWE
          type: string
      required:
        - password_jwe
    RawJSONWebKey:
      description: A JSON Web Key formatted in accordance with [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517).
      type: object
      properties:
        alg:
          $ref: '#/components/schemas/alg'
        crv:
          $ref: '#/components/schemas/curve'
        d:
          description: The exponent of the private key
          type: string
          format: byte
        dp:
          description: The first factor CRT exponent of the private key
          type: string
          format: byte
        dq:
          description: The second factor CRT exponent of the private key
          type: string
          format: byte
        e:
          description: The exponent of the public key
          type: string
          format: byte
        k:
          description: The key
          type: string
          format: byte
        kid:
          description: The key ID
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
        kty:
          $ref: '#/components/schemas/kty'
        'n':
          description: The modulus of the public key
          type: string
          format: byte
        p:
          description: The first prime factor of the private key
          type: string
          format: byte
        q:
          description: The second prime factor of the private key
          type: string
          format: byte
        qi:
          description: The first CRT coefficient of the private key
          type: string
          format: byte
        use:
          description: The intended use of the key
          type: string
        x:
          description: The x coordinate of the key
          type: string
          format: byte
        x5c:
          description: A list of X.509 certificates
          items:
            type: string
          type: array
        x5t:
          description: The SHA-1 thumbprint of the X.509 certificate
          type: string
        x5t#S256:
          description: The SHA-256 thumbprint of the X.509 certificate
          type: string
        x5u:
          description: The URL of the X.509 certificates
          type: string
        'y':
          description: The y coordinate of the key
          type: string
          format: byte
    ReorderActiveDirectoryAccountRuleRequest:
      type: object
      properties:
        priority:
          type: integer
          minimum: 1
          maximum: 100
          description: Specify the new priority of the Active Directory account rule. Lower numbers have higher priority.
        rule_id:
          description: The UUID of the Active Directory account rule
          type: string
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          example: a747a818-a4c4-4446-8a87-704216495a08
    ResolveResourceNamesRequest:
      type: object
      properties:
        client_features:
          description: A list of features supported by the current sft client
          type: array
          items:
            type: string
        include_privileged_user_access_methods:
          description: If `true`, includes additional user access methods for managed server accounts with allowed privilege list. Requires `include_user_access_methods` to be `true`.
          type: boolean
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
        include_user_access_methods:
          description: If `true`, the response includes the user access methods for the resource
          type: boolean
        names:
          description: A list of resource names to resolve
          items:
            maxLength: 255
            minLength: 1
            type: string
          type: array
        user_access_method_filters:
          description: |
            Optional map of filters to apply per name. Keys must exactly match one of the names provided in the `names` array.
            If a key is provided, the corresponding filters are used to restrict user access methods for that name. For
            names without a corresponding key, no filters are applied and all user access methods are returned.
          additionalProperties:
            $ref: '#/components/schemas/UserAccessMethodFilters'
      required:
        - names
    ResolveResourceNamesResponse:
      type: object
      properties:
        results:
          description: A list of resolved resources
          items:
            $ref: '#/components/schemas/NameResolutionResult'
          type: array
    ResolveSecretOrFolderRequest:
      type: object
      properties:
        id:
          description: The ID of the secret or secret folder. Don't use this parameter if the request also includes a `parent_folder_path`, `secret_folder_name`, and `secret_name`. If the ID isn't provided, you must include both `resource_group` and `project`.
          type: string
          nullable: true
        parent_folder_path:
          description: The path to the parent directory. Don't use this parameter if the request also includes an `id`.
          type: string
          nullable: true
        project:
          $ref: '#/components/schemas/SecretResolveParent'
        resource_group:
          $ref: '#/components/schemas/SecretResolveParent'
        secret_folder_name:
          description: The name of the secret folder. Don't use this parameter if the request also includes an `id` or `secret_name`.
          type: string
        secret_name:
          description: The name of the secret. Don't use this parameter if the request also includes an `id` or `secret_folder_name`.
          type: string
      required:
        - resource_group
        - project
    ResolveSecretOrFolderResponse:
      type: object
      properties:
        description:
          description: A description of the secret or secret folder
          type: string
          readOnly: true
          nullable: true
        id:
          description: The UUID of the secret or secret folder
          type: string
          readOnly: true
        name:
          description: The name of the secret or secret folder
          type: string
          readOnly: true
        path:
          type: array
          items:
            $ref: '#/components/schemas/SecretPath'
        project:
          $ref: '#/components/schemas/NamedObject'
        resource_group:
          $ref: '#/components/schemas/NamedObject'
        template:
          $ref: '#/components/schemas/SecretTemplateResponse'
        type:
          $ref: '#/components/schemas/SecretType'
      required:
        - id
        - name
        - resource_group
        - project
    ResourceAvailabilityStatus:
      description: The availability status of the resource
      type: string
      enum:
        - available
        - checked_out
        - checked_out_by_other_user
        - unavailable
    ResourceCheckoutDetails:
      description: Resource checkout details for end-user
      type: object
      properties:
        checkout_required:
          type: boolean
          description: If `true`, account will be checked out and no other users will be able to reveal/update credentials until it's checked in back
        current_user_checkout_expires_at:
          type: string
          format: date-time
          description: A timestamp when the checkout expires for the current user (in UTC)
      required:
        - checkout_required
    ResourceCheckoutSettings:
      type: object
      properties:
        checkout_duration_in_seconds:
          description: The duration in seconds for the checkout. If the checkout is enabled, the duration is the maximum time a user can access the resource before the checkout expires.
          type: integer
          maximum: 604800
          minimum: 900
          format: int32
        checkout_required:
          description: Indicates whether a checkout is mandatory for accessing resources within the project. If `true`, checkout is enforced by default for all applicable resources. If `false`, checkout is not required, and resources are accessible without it.
          type: boolean
        exclude_list:
          description: If provided, only the account identifiers listed are excluded from the checkout requirement. This list is only considered if `checkout_required` is set to `true`. Only one of `include_list` and `exclude_list` can be specified in a request since they are mutually exclusive.
          type: array
          items:
            type: string
        include_list:
          description: If provided, only the account identifiers listed are required to perform a checkout to access the resource. This list is only considered if `checkout_required` is set to `true`. Only one of `include_list` and `exclude_list` can be specified in a request since they are mutually exclusive.
          type: array
          items:
            type: string
      required:
        - checkout_required
    ResourceGroup:
      type: object
      properties:
        delegated_resource_admin_groups:
          description: An array of Okta Privileged Access groups that own this resource group. This parameter is only available to users with the `resource_admin` role.
          type: array
          items:
            $ref: '#/components/schemas/NamedObject'
        description:
          description: A description of the resource group
          type: string
        id:
          description: The UUID of the resource group
          type: string
          readOnly: true
        name:
          description: The name of the resource group
          type: string
        team_id:
          description: The UUID of the team associated with the resource group
          type: string
          readOnly: true
    RevealResponse:
      description: A response containing an encrypted secret
      type: object
      properties:
        id:
          type: string
          description: ID of the item being revealed
        secret_jwe:
          description: The encrypted Secret as a fully serialized JWE
          type: string
      required:
        - secret_jwe
    RoleName:
      description: The name of the available roles
      type: string
      enum:
        - delegated_resource_admin
        - devops_admin
        - end_user
        - pam_admin
        - resource_admin
        - security_admin
    Roles:
      properties:
        name:
          $ref: '#/components/schemas/RoleName'
    RotateResourceRequest:
      type: object
      properties:
        resource_id:
          description: The UUID or ORN of the resource
          type: string
        resource_type:
          $ref: '#/components/schemas/CheckoutResourceType'
      required:
        - resource_id
        - resource_type
    SSHCertificateType:
      description: (Optional) The type of signature algorithm used for authentication keys. Default is `CERT_TYPE_ED25519_01`.
      nullable: true
      type: string
      enum:
        - CERT_TYPE_ECDSA_256_01
        - CERT_TYPE_ECDSA_384_01
        - CERT_TYPE_ECDSA_521_01
        - CERT_TYPE_ED25519_01
        - CERT_TYPE_RSA_01
        - CERT_TYPE_RSA_SHA2_256_01
        - CERT_TYPE_RSA_SHA2_512_01
    SaasAppAccount:
      type: object
      properties:
        application_instance_id:
          description: The Okta app instance ID of the SaaS app
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          type: string
          example: aln1aqcs055ZRoizW0g8
        application_instance_name:
          description: The name of the SaaS app instance
          type: string
          example: AWS Engineering
        created_at:
          description: A timestamp that indicates when the Okta Privileged Access managed SaaS app account was created
          type: string
          format: date-time
          readOnly: true
        description:
          description: A brief description of the SaaS app account
          type: string
          example: This is for accessing AWS Prod-5
        id:
          description: The UUID of the SaaS app account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
          example: d1b65a78-21ed-429b-8ea3-eec96f2748d6
        lcm_sync_possible:
          description: Indicates whether the password for the SaaS app account can be rotated using Okta Lifecycle Management
          type: boolean
        login_url:
          description: A URL pointing to the login page of the SaaS app
          type: string
          example: https://example.com/login
        logo_url:
          description: A URL pointing to the logo of the SaaS app
          type: string
          example: https://ok3static.oktacdn.com/fs/bco/4/fs01i34nm7lS8dyXf1d8
        name:
          description: A human-readable name for the SaaS app account
          type: string
          example: AWS Prod-5 account
        privileged_resource_id:
          description: The ID of the privileged resource associated with this SaaS app account
          type: string
          readOnly: true
          example: prs1b2c3d4e5F6g7H8i9
        sync_status:
          $ref: '#/components/schemas/ServiceAccountSyncStatus'
        updated_at:
          description: A timestamp that indicates when the Okta Privileged Access managed SaaS app account was updated
          type: string
          format: date-time
          readOnly: true
        username:
          description: The username used to log into the SaaS Application
          type: string
          example: OpsCaliforniaShared
    SaasAppAccountCheckedOutResourceDetails:
      type: object
      properties:
        account_name:
          description: The name of the SaaS app account associated with the resource
          type: string
          readOnly: true
        app_name:
          description: The name of the SaaS Application associated with the resource
          type: string
          readOnly: true
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this Resource object
    SaasAppAccountDetails:
      allOf:
        - $ref: '#/components/schemas/AccountPasswordChangeDetails'
      type: object
      properties:
        account_name:
          description: A human-readable name for the SaaS app account
          type: string
          example: AWS Prod-5 account
        checkout_enabled:
          description: Indicates whether this SaaS app account is included in the checkout settings
          type: boolean
        checkout_expiry_at:
          description: The period after checkout when a user's access to the SaaS app account will expire
          type: string
          format: date-time
        checkout_status:
          allOf:
            - $ref: '#/components/schemas/ResourceAvailabilityStatus'
          description: The SaaS app account's checkout status
        created_at:
          description: A timestamp that indicates when the SaaS app account was created
          type: string
          format: date-time
          readOnly: true
        id:
          description: The UUID of the SaaS app account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
          example: d1b65a78-21ed-429b-8ea3-eec96f2748d6
        last_checkout_user:
          description: The username of the user who last accessed the SaaS app account through checkout
          type: string
        next_scheduled_password_rotation_reason:
          description: The reason for scheduling the next password rotation for the SaaS app account
          type: string
        next_scheduled_password_rotation_timestamp:
          description: The timestamp indicating when the SaaS app account password is scheduled to be rotated next
          type: string
          format: date-time
        project_id:
          description: The UUID of the project associated with this SaaS app account
          type: string
        team_id:
          description: The UUID of the team associated with this SaaS app account
          type: string
        username:
          description: The username used to log into the SaaS app account
          type: string
          example: OpsCaliforniaShared
      readOnly: true
    SaasAppAccountWithSettings:
      allOf:
        - $ref: '#/components/schemas/SaasAppAccount'
      type: object
      properties:
        account_settings_enabled:
          description: The project level account settings that are enabled for this account
          type: array
          items:
            $ref: '#/components/schemas/AccountSetting'
        last_password_change_system_timestamp:
          description: A timestamp indicating when Okta Privileged Access last reported a change to the SaaS app account password
          type: string
          format: date-time
          readOnly: true
    SaasApplicationInstance:
      description: An Okta app instance connected to Okta Privileged Access
      type: object
      properties:
        app_instance_id:
          type: string
          description: The unique identifier of the app instance
          readOnly: true
        app_instance_name:
          type: string
          description: The name of the app instance
          readOnly: true
        app_instance_orn:
          type: string
          description: The Okta resource name (ORN) for the app instance
          readOnly: true
        app_login_url:
          type: string
          description: The URL pointing to the login page of the app instance
          readOnly: true
        app_logo_url:
          type: string
          description: The URL of the logo for the global app that the instance belongs to. This URL is obtained from the app definition in the [OIN catalog](https://www.okta.com/integrations/).
          readOnly: true
        created_at:
          type: string
          format: date-time
          description: A timestamp indicating when the app instance was created
          readOnly: true
        global_app_name:
          type: string
          description: Name of the global app that the instance belongs to. This name is obtained from the app definition in the [OIN catalog](https://www.okta.com/integrations/).
          readOnly: true
        password_rotation_strategy:
          $ref: '#/components/schemas/AppPasswordRotationStrategy'
        team_id:
          type: string
          description: The UUID of the team associated with the app instance
          readOnly: true
        updated_at:
          type: string
          format: date-time
          description: A timestamp indicating when the app instance was last updated
          readOnly: true
      required:
        - app_instance_id
        - app_instance_name
        - global_app_name
        - app_instance_orn
        - password_rotation_strategy
        - team_id
        - created_at
        - updated_at
    SearchSecretBy:
      type: string
      enum:
        - description
        - name
    Secret:
      type: object
      properties:
        created_at:
          description: Timestamp of when the secret was created
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
        created_by:
          description: The username of the user who created the secret
          type: string
          readOnly: true
        description:
          description: The description of the secret
          type: string
          nullable: true
        id:
          description: The UUID of the secret
          type: string
          readOnly: true
        name:
          description: The name of the secret
          type: string
          readOnly: true
        path:
          type: array
          items:
            $ref: '#/components/schemas/SecretPath'
        template:
          description: The template used to create the secret
          type: object
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
          additionalProperties: true
        updated_at:
          description: A timestamp indicating when the secret was last updated
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
        updated_by:
          description: The username of the user who last updated the secret
          type: string
          readOnly: true
      required:
        - id
        - name
    SecretCreateOrUpdateRequest:
      type: object
      properties:
        description:
          description: The description of the secret
          type: string
          nullable: true
        name:
          description: The name of the secret
          type: string
        parent_folder_id:
          description: The UUID of the secret's parent folder
          type: string
        secret_jwe:
          description: The encrypted secret is a fully serialized JWE. The secret is encrypted using a public key provided by the [Retrieve the vault JWKS](https://developer.okta.com/docs/api/openapi/opa/opa/tag/teams/#tag/teams/operation/GetVaultJWKS) resource on the client side. Typically, the secret encryption is performed by the Okta Privileged Access (OPA) client or the Terraform provider.
          type: string
        template_id:
          description: The ID of the template
          type: string
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
        template_version:
          description: The version of the template
          type: integer
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
      required:
        - name
        - secret_jwe
        - parent_folder_id
    SecretFolderCreateRequest:
      type: object
      properties:
        description:
          type: string
          description: A description of the secret folder
          nullable: true
        name:
          type: string
          description: The name of the secret folder
        parent_folder_id:
          type: string
          description: The UUID of the secret folder's parent folder. When omitted, a top-level folder is created, which requires the `resource_admin` or `delegated_resource_admin` role.
      required:
        - name
    SecretFolderResponse:
      type: object
      properties:
        created_at:
          description: A timestamp indicating when the secret folder was created
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
        created_by:
          description: The username of the user who created the secret folder
          type: string
          readOnly: true
        description:
          type: string
          description: A description of the secret folder
          readOnly: true
          nullable: true
        id:
          type: string
          description: The UUID of the secret folder
          readOnly: true
        name:
          type: string
          description: The name of the secret folder
          readOnly: true
        path:
          type: array
          items:
            $ref: '#/components/schemas/SecretPath'
        updated_at:
          description: A timestamp indicating when the secret folder was last updated
          type: string
          format: date-time
          readOnly: true
          example: '2023-08-25T12:00:00.000000Z'
        updated_by:
          description: The username of the user who last updated the secret folder
          type: string
          readOnly: true
      required:
        - id
        - name
    SecretFolderUpdateRequest:
      type: object
      properties:
        description:
          type: string
          description: A description of the secret folder
          nullable: true
        name:
          type: string
          description: The name of the secret folder
      required:
        - name
    SecretOrFolderListResponse:
      type: object
      properties:
        description:
          type: string
          description: A description of the secret folder
          readOnly: true
          nullable: true
        id:
          type: string
          description: The UUID of the secret folder
          readOnly: true
        name:
          type: string
          description: The name of the secret folder
          readOnly: true
        path:
          type: array
          description: The names and IDs of the parent folders for this secret or folder. The first entry is the root folder.
          items:
            $ref: '#/components/schemas/SecretPath'
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
        project:
          $ref: '#/components/schemas/NamedObject'
        resource_group:
          $ref: '#/components/schemas/NamedObject'
        type:
          $ref: '#/components/schemas/SecretType'
      required:
        - id
        - name
        - type
        - resource_group
        - project
    SecretPath:
      type: object
      properties:
        id:
          description: The UUID of the secret
          type: string
          readOnly: true
        name:
          description: The name of the secret
          type: string
          readOnly: true
      required:
        - id
        - name
    SecretResolveParent:
      nullable: true
      type: object
      properties:
        id:
          description: The UUID of the parent
          type: string
        name:
          description: The name of the parent
          type: string
        type:
          $ref: '#/components/schemas/NamedObjectType'
    SecretRevealRequest:
      type: object
      properties:
        public_key:
          $ref: '#/components/schemas/RawJSONWebKey'
      required:
        - public_key
    SecretRevealResponse:
      allOf:
        - $ref: '#/components/schemas/Secret'
        - $ref: '#/components/schemas/RevealResponse'
    SecretTemplateField:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        key_name:
          type: string
          description: Key name of the field
        required:
          type: boolean
          description: Indicates if the key is required
        type:
          type: string
          description: Type of key
    SecretTemplateResponse:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        description:
          type: string
          description: Description of the template
        id:
          type: string
          description: ID of the template
        is_global:
          type: boolean
          description: Indicates if this is a global template
        name:
          type: string
          description: Name of the template
        template_fields:
          type: array
          description: Template fields
          items:
            $ref: '#/components/schemas/SecretTemplateField'
          additionalProperties: true
        version:
          type: integer
          description: Template version
    SecretType:
      type: string
      enum:
        - folder
        - key_value_secret
    SecurityPolicy:
      title: Security Policy
      type: object
      properties:
        active:
          description: If `true`, indicates that the security policy is active
          type: boolean
        description:
          description: The description of the security policy
          type: string
        id:
          description: The UUID of the security policy
          type: string
          readOnly: true
        name:
          description: The name of the security policy
          type: string
          example: Prod Servers - EU West
        principals:
          description: The user groups and workload roles associated with the security policy. The combined total of user groups and workload roles can't exceed 40 items.
          type: object
          properties:
            user_groups:
              type: array
              maxItems: 40
              description: The user groups associated with the security policy. Each user group is defined in a separate object.
              items:
                $ref: '#/components/schemas/NamedObject'
              example:
                - id: 6c88b11b-b4ad-436b-a69a-c11dy08q7155
                  name: OPAUserGroup
                  type: user_group
            workload_roles:
              type: array
              maxItems: 40
              description: The workload roles associated with the security policy. Each workload role is defined in a separate object.
              items:
                $ref: '#/components/schemas/NamedObject'
              example:
                - id: 5f6a4b8f-344f-472e-aeca-9035a81ae61c
                  name: deployment_workload
                  type: workload_role
        resource_group:
          allOf:
            - $ref: '#/components/schemas/NamedObject'
          description: The resource group that this security policy applies to. This property is required when the user who creates the security policy is a delegated security admin.
        rules:
          description: The rules associated with the security policy. A security policy can set multiple rules that define privileges available for matching resources.
          type: array
          maxItems: 30
          items:
            $ref: '#/components/schemas/SecurityPolicyRule'
        type:
          $ref: '#/components/schemas/SecurityPolicyType'
      required:
        - name
        - active
        - principals
        - rules
    SecurityPolicyNoneAccountSelector:
      description: Selector to include all accounts with no filtering applied. Set `_type` to `none`.
      type: object
      properties:
        _type:
          type: string
          readOnly: true
          enum:
            - none
    SecurityPolicyPasswordCheckoutRDPPrivilege:
      description: |-
        `SecurityPolicyPasswordCheckoutRDPPrivilege` indicates that the principal will be allowed to check out passwords
        for RDPing to servers for accounts specified through `ServerBasedResourceSelector`
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            admin_level_permissions:
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: false
                SKUs: []
              type: boolean
              description: |
                If enabled, AD accounts are added to the local administrators group when you connect using RDP to the target server
            password_checkout_rdp:
              type: boolean
            remote_access_permissions:
              x-okta-lifecycle:
                lifecycle: GA
                isGenerallyAvailable: false
                SKUs: []
              type: boolean
              description: |
                If enabled, AD accounts are added to the remote desktop group when you connect using RDP to the target server
          required:
            - password_checkout_rdp
    SecurityPolicyPasswordCheckoutSSHPrivilege:
      description: |
        `SecurityPolicyPasswordCheckoutSSHPrivilege` indicates that the principal has the ability to check out vaulted passwords to sign in with SSH to servers for accounts specified through `ServerBasedResourceSelector`
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            password_checkout_ssh:
              type: boolean
          required:
            - password_checkout_ssh
    SecurityPolicyPrincipalAccountRDPPrivilege:
      description: |
        `SecurityPolicyPrincipalAccountRDPPrivilege` indicates that the principal has the ability to RDP as the principal user on the specified targets. The principal account is the account that is created and managed by the server agent.
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            admin_level_permissions:
              description: |
                If enabled, the user can run any command as root using Sudo
              type: boolean
            principal_account_rdp:
              x-go-name: PrivilegePrincipalAccountRDP
              type: boolean
          required:
            - principal_account_rdp
    SecurityPolicyPrincipalAccountSSHPrivilege:
      description: |
        `SecurityPolicyPrincipalAccountSSHPrivilege` indicates that the principal has the ability to SSH as the principal user on the specified targets. The principal account is the account that is created and managed by the server agent.
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            admin_level_permissions:
              type: boolean
            principal_account_ssh:
              x-go-name: PrivilegePrincipalAccountSSH
              type: boolean
            sudo_command_bundles:
              items:
                $ref: '#/components/schemas/NamedObject'
              type: array
              minItems: 0
              maxItems: 10
            sudo_display_name:
              type: string
              minLength: 1
              maxLength: 64
              pattern: ^[a-zA-Z0-9-_. ]+$
          required:
            - principal_account_ssh
    SecurityPolicyPrivilege:
      type: object
      properties:
        _type:
          type: string
      required:
        - _type
      discriminator:
        propertyName: _type
    SecurityPolicyRevealPasswordPrivilege:
      description: Privilege to grant access to reveal password for an account
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            reveal_password:
              type: boolean
          required:
            - reveal_password
    SecurityPolicyRotatePasswordPrivilege:
      description: Privilege to grant access to rotate the password of an account
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            rotate_password:
              type: boolean
              description: If enabled, grants access to rotate the password
          required:
            - rotate_password
    SecurityPolicyRule:
      type: object
      properties:
        conditions:
          type: array
          description: The conditions required before a privilege is made available to the Principals. All conditions must be met.
          items:
            $ref: '#/components/schemas/SecurityPolicyRuleConditionContainer'
        name:
          type: string
          description: The name of the Security Policy rule
        override_checkout_duration_in_seconds:
          type: integer
          format: int64
          description: Overrides checkout duration provided in the resource settings
          nullable: true
          minimum: 900
          maximum: 604800
        privileges:
          type: array
          description: The specific privileges granted to Principals on matching resources.
          items:
            $ref: '#/components/schemas/SecurityPolicyRulePrivilegeContainer'
        resource_selector:
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyRuleServerBasedResourceSelector'
            - $ref: '#/components/schemas/SecurityPolicyRuleManagedSaaSAppBasedResourceSelector'
            - $ref: '#/components/schemas/SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelector'
            - $ref: '#/components/schemas/SecurityPolicyRuleOktaAppBasedResourceSelector'
            - $ref: '#/components/schemas/SecurityPolicySecretBasedResourceSelector'
            - $ref: '#/components/schemas/SecurityPolicyRuleActiveDirectoryBasedResourceSelector'
          discriminator:
            propertyName: _type
            mapping:
              server_based_resource: '#/components/schemas/SecurityPolicyRuleServerBasedResourceSelector'
              managed_saas_app_based_resource: '#/components/schemas/SecurityPolicyRuleManagedSaaSAppBasedResourceSelector'
              unmanaged_saas_app_based_resource: '#/components/schemas/SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelector'
              okta_app_based_resource: '#/components/schemas/SecurityPolicyRuleOktaAppBasedResourceSelector'
              secret_based_resource: '#/components/schemas/SecurityPolicySecretBasedResourceSelector'
              active_directory_based_resource: '#/components/schemas/SecurityPolicyRuleActiveDirectoryBasedResourceSelector'
        resource_type:
          $ref: '#/components/schemas/SecurityPolicyRuleResourceType'
        security_policy_id:
          type: string
          description: The UUID of the associated Security Policy
          nullable: true
          readOnly: true
      required:
        - name
        - resource_type
        - resource_selector
        - privileges
    SecurityPolicyRuleActiveDirectoryBasedResourceSelector:
      title: SecurityPolicyRuleActiveDirectoryBasedResourceSelector
      description: The selector that defines resources targeted by this Security policy for Active Directory based resources
      type: object
      properties:
        selectors:
          type: array
          maxItems: 1
        _type:
          type: string
          readOnly: true
          enum:
            - active_directory_based_resource_selector
      required:
        - _type
        - selectors
    SecurityPolicyRuleConditionContainer:
      title: Conditions
      type: object
      properties:
        condition_type:
          $ref: '#/components/schemas/SecurityPolicyRuleConditionType'
        condition_value:
          type: object
          description: The parameters for the condition. The structure of this object depends on the `condition_type`.
          oneOf:
            - $ref: '#/components/schemas/ConditionsAccessRequests'
            - $ref: '#/components/schemas/ConditionsGateway'
            - $ref: '#/components/schemas/ConditionsMFA'
          discriminator:
            mapping:
              access_request: '#/components/schemas/ConditionsAccessRequests'
              gateway: '#/components/schemas/ConditionsGateway'
              mfa: '#/components/schemas/ConditionsMFA'
            propertyName: _type
    SecurityPolicyRuleConditionType:
      description: The type of condition
      type: string
      enum:
        - access_request
        - gateway
        - mfa
    SecurityPolicyRuleManagedSaaSAppBasedResourceSelector:
      title: SecurityPolicyRuleManagedSaaSAppBasedResourceSelector
      description: The selector that defines resources targeted by this Security Policy for managed SaaS app based resources
      type: object
      properties:
        selectors:
          type: array
          items:
            $ref: '#/components/schemas/SecurityPolicyRuleManagedSaaSAppBasedResourceSelectorContainer'
        _type:
          type: string
          readOnly: true
          enum:
            - managed_saas_app_based_resource
      required:
        - _type
        - selectors
    SecurityPolicyRuleManagedSaaSAppBasedResourceSelectorContainer:
      title: SecurityPolicyRuleManagedSaaSAppBasedResourceSelectorContainer
      maxItems: 20
      type: object
      properties:
        selector:
          title: SecurityPolicyRuleManagedSaaSAppBasedResourceSubSelector
          type: object
          description: The specific parameters used to target resources. The organization of this object depends on the `selector_type`.
          oneOf:
            - $ref: '#/components/schemas/SelectorIndividualSaaSAppAccount'
          discriminator:
            mapping:
              individual_managed_saas_app_account: '#/components/schemas/SelectorIndividualSaaSAppAccount'
            propertyName: _type
        selector_type:
          $ref: '#/components/schemas/SecurityPolicyRuleManagedSaaSAppBasedResourceSubSelectorType'
      required:
        - selector_type
        - selector
    SecurityPolicyRuleManagedSaaSAppBasedResourceSubSelectorType:
      title: SecurityPolicyRuleManagedSaaSSAppBasedResourceSubSelectorType
      description: The type of selector used to target managed SaaS app based resources
      type: string
      enum:
        - individual_managed_saas_app_account
    SecurityPolicyRuleOktaAppBasedResourceSelector:
      title: SecurityPolicyRuleOktaAppBasedResourceSelector
      description: The selector that defines resources targeted by this Security policy for Universal Directory based resources
      type: object
      properties:
        selectors:
          type: array
          items:
            $ref: '#/components/schemas/SecurityPolicyRuleOktaAppBasedResourceSelectorContainer'
        _type:
          type: string
          readOnly: true
          enum:
            - okta_app_based_resource
      required:
        - _type
        - selectors
    SecurityPolicyRuleOktaAppBasedResourceSelectorContainer:
      title: SecurityPolicyRuleOktaAppBasedResourceSelectorContainer
      maxItems: 20
      type: object
      properties:
        selector:
          title: SecurityPolicyRuleOktaAppBasedResourceSubSelector
          type: object
          description: The specific parameters used to target resources. The organization of this object depends on the `selector_type`.
          oneOf:
            - $ref: '#/components/schemas/SelectorIndividualOktaServiceAccount'
          discriminator:
            mapping:
              individual_okta_account: '#/components/schemas/SelectorIndividualOktaServiceAccount'
            propertyName: _type
        selector_type:
          $ref: '#/components/schemas/SecurityPolicyRuleOktaAppBasedResourceSubSelectorType'
      required:
        - selector_type
        - selector
    SecurityPolicyRuleOktaAppBasedResourceSubSelectorType:
      title: SecurityPolicyRuleOktaAppBasedResourceSubSelectorType
      description: The type of selector used to target Okta app based resources
      type: string
      enum:
        - individual_okta_account
    SecurityPolicyRulePrivilegeContainer:
      title: Privileges
      type: object
      properties:
        privilege_type:
          $ref: '#/components/schemas/SecurityPolicyRulePrivilegeType'
        privilege_value:
          type: object
          description: An object that indicates whether the privilege type is allowed. The key must match the specified privilege type and the value must be set to `true`.
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyPrincipalAccountSSHPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyPrincipalAccountRDPPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyPasswordCheckoutSSHPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyPasswordCheckoutRDPPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyUpdatePasswordPrivilege'
            - $ref: '#/components/schemas/SecurityPolicySecretPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyRotatePasswordPrivilege'
          discriminator:
            propertyName: _type
            mapping:
              principal_account_ssh: '#/components/schemas/SecurityPolicyPrincipalAccountSSHPrivilege'
              principal_account_rdp: '#/components/schemas/SecurityPolicyPrincipalAccountRDPPrivilege'
              password_checkout_ssh: '#/components/schemas/SecurityPolicyPasswordCheckoutSSHPrivilege'
              password_checkout_rdp: '#/components/schemas/SecurityPolicyPasswordCheckoutRDPPrivilege'
              reveal_password: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
              update_password: '#/components/schemas/SecurityPolicyUpdatePasswordPrivilege'
              secret: '#/components/schemas/SecurityPolicySecretPrivilege'
              rotate_password: '#/components/schemas/SecurityPolicyRotatePasswordPrivilege'
    SecurityPolicyRulePrivilegeType:
      description: The type of privilege granted to a Principal. You can't specify both SSH and RDP options within the same rule.
      type: string
      enum:
        - password_checkout_rdp
        - password_checkout_ssh
        - principal_account_rdp
        - principal_account_ssh
        - reveal_password
        - rotate_password
        - secret
        - update_password
    SecurityPolicyRulePrivilegeTypeForActiveDirectoryAccounts:
      description: The type of privilege granted to a user for an Active Directory account
      type: string
      enum:
        - password_checkout_rdp
        - password_checkout_ssh
        - reveal_password
        - rotate_password
    SecurityPolicyRulePrivilegeTypeForManagedServerAccounts:
      description: The type of privilege granted to a user for a managed server account
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: string
      enum:
        - password_checkout_rdp
        - password_checkout_ssh
        - reveal_password
    SecurityPolicyRulePrivilegeTypeForServiceAccounts:
      description: The type of privilege granted to a user for a service account.
      type: string
      enum:
        - reveal_password
        - update_password
    SecurityPolicyRuleResourceType:
      description: The type of resource that Principals are granted privileges to access.
      type: string
      enum:
        - active_directory_based_resource
        - managed_saas_app_based_resource
        - okta_app_based_resource
        - secret_based_resource
        - server_based_resource
        - unmanaged_saas_app_based_resource
    SecurityPolicyRuleSecretBasedResourceSecretFolderSelector:
      title: SecurityPolicyRuleSecretBasedResourceSecretFolderSelector
      type: object
      properties:
        secret_folder:
          $ref: '#/components/schemas/NamedObject'
        _type:
          type: string
          readOnly: true
          enum:
            - secret_folder
      required:
        - _type
        - secret_folder
    SecurityPolicyRuleSecretBasedResourceSecretSelector:
      title: SecurityPolicyRuleSecretBasedResourceSecretSelector
      type: object
      properties:
        secret:
          $ref: '#/components/schemas/NamedObject'
        _type:
          type: string
          readOnly: true
          enum:
            - secret
      required:
        - _type
        - secret
    SecurityPolicyRuleServerBasedResourceSelector:
      title: SecurityPolicyRuleServerBasedResourceSelector
      description: The selector that defines resources targeted by this Security Policy for server based resources
      type: object
      properties:
        selectors:
          type: array
          items:
            $ref: '#/components/schemas/SecurityPolicyRuleServerBasedResourceSelectorContainer'
        _type:
          type: string
          readOnly: true
          enum:
            - server_based_resource_selector
      required:
        - _type
        - selectors
    SecurityPolicyRuleServerBasedResourceSelectorContainer:
      title: SecurityPolicyRuleServerBasedResourceSelectorContainer
      type: object
      properties:
        selector:
          title: SecurityPolicyRuleResourceServerBasedResourceSubSelector
          type: object
          description: The specific parameters used to target resources. The organization of this object depends on the `selector_type`.
          oneOf:
            - $ref: '#/components/schemas/SelectorIndividualServer'
            - $ref: '#/components/schemas/SelectorIndividualServerAccount'
            - $ref: '#/components/schemas/SelectorServerLabel'
          discriminator:
            propertyName: _type
            mapping:
              individual_server: '#/components/schemas/SelectorIndividualServer'
              individual_server_account: '#/components/schemas/SelectorIndividualServerAccount'
              server_label: '#/components/schemas/SelectorServerLabel'
        selector_type:
          $ref: '#/components/schemas/SecurityPolicyRuleServerBasedResourceSubSelectorType'
      required:
        - selector_type
        - selector
    SecurityPolicyRuleServerBasedResourceSubSelectorType:
      description: The type of selector used to target server based resources
      type: string
      enum:
        - individual_server
        - individual_server_account
        - server_label
    SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelector:
      title: SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelector
      description: The selector that defines resources targeted by this Security policy for unmanaged SaaS app based resources
      type: object
      properties:
        selectors:
          type: array
          items:
            $ref: '#/components/schemas/SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelectorContainer'
        _type:
          type: string
          readOnly: true
          enum:
            - unmanaged_saas_app_based_resource
      required:
        - _type
        - selectors
    SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelectorContainer:
      title: SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSelectorContainer
      maxItems: 20
      type: object
      properties:
        selector:
          title: SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSubSelector
          type: object
          description: The specific parameters used to target resources. The organization of this object depends on the `selector_type`.
          oneOf:
            - $ref: '#/components/schemas/SelectorIndividualSaaSAppAccount'
          discriminator:
            mapping:
              individual_unmanaged_saas_app_account: '#/components/schemas/SelectorIndividualSaaSAppAccount'
            propertyName: _type
        selector_type:
          $ref: '#/components/schemas/SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSubSelectorType'
      required:
        - selector_type
        - selector
    SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSubSelectorType:
      title: SecurityPolicyRuleUnmanagedSaaSAppBasedResourceSubSelectorType
      description: The type of selector used to target unmanaged SaaS app based resources
      type: string
      enum:
        - individual_unmanaged_saas_app_account
    SecurityPolicySecretBasedResourceSelector:
      title: SecurityPolicySecretBasedResourceSelector
      description: The selector that defines resources targeted by this Security policy for secret based resources
      type: object
      properties:
        selectors:
          type: array
          items:
            $ref: '#/components/schemas/SecurityPolicySecretBasedResourceSelectorContainer'
        _type:
          type: string
          readOnly: true
          enum:
            - secret_based_resource
      required:
        - _type
        - selectors
    SecurityPolicySecretBasedResourceSelectorContainer:
      title: SecurityPolicySecretBasedResourceSelectorContainer
      type: object
      properties:
        selector:
          type: object
          description: The specific parameters used to target resources. The organization of this object depends on the `selector_type`.
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyRuleSecretBasedResourceSecretFolderSelector'
            - $ref: '#/components/schemas/SecurityPolicyRuleSecretBasedResourceSecretSelector'
          discriminator:
            propertyName: _type
            mapping:
              secret_folder: '#/components/schemas/SecurityPolicyRuleSecretBasedResourceSecretFolderSelector'
              secret: '#/components/schemas/SecurityPolicyRuleSecretBasedResourceSecretSelector'
        selector_type:
          type: string
          description: The type of selector used to target secret based resources
          enum:
            - secret_folder
            - secret
          example: secret
      required:
        - selector_type
        - selector
    SecurityPolicySecretPrivilege:
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            folder_create:
              description: If `true`, the user has the privilege to create a folder
              type: boolean
            folder_delete:
              description: If `true`, the user has the privilege to delete a folder
              type: boolean
            folder_update:
              description: If `true`, the user has the privilege to update a folder
              type: boolean
            list:
              description: If `true`, the user has the privilege to list the contents of the folder
              type: boolean
            secret_create:
              description: If `true`, the user has the privilege to create a secret
              type: boolean
            secret_delete:
              description: If `true`, the user has the privilege to delete a secret
              type: boolean
            secret_reveal:
              description: If `true`, the user has the privilege to reveal a secret
              type: boolean
            secret_update:
              description: If `true`, the user has the privilege to update a secret
              type: boolean
          required:
            - list
            - folder_create
            - folder_update
            - folder_delete
            - secret_create
            - secret_update
            - secret_reveal
            - secret_delete
    SecurityPolicyType:
      description: |-
        The type of the policy. Determines which resource types are allowed in security policy rules.
        - 'default': Any valid resource type is allowed except 'okta_app_based_resource'.
        - 'okta_service_account': Only 'okta_app_based_resource' resource type is allowed. Only users with the Okta super admin role can create policies of this type.
      type: string
      enum:
        - default
        - okta_service_account
    SecurityPolicyUpdatePasswordPrivilege:
      description: Privilege to grant access to update password for an account
      allOf:
        - $ref: '#/components/schemas/SecurityPolicyPrivilege'
        - type: object
          properties:
            update_password:
              type: boolean
          required:
            - update_password
    SecurityPolicyUsernameAccountSelector:
      description: Defines existing Server accounts available for use by the Principals
      type: object
      properties:
        usernames:
          type: array
          items:
            type: string
          description: A list of Server accounts
          example:
            - ServerAccount1
            - ServerAccount2
        _type:
          type: string
          readOnly: true
          enum:
            - username
    SelectorIndividualOktaServiceAccount:
      title: SelectorIndividualOktaServiceAccount
      description: This resource selector identifies a Service Account that exists on a Okta Universal Directory
      type: object
      properties:
        service_account:
          allOf:
            - $ref: '#/components/schemas/NamedObject'
          description: A named object representing the Okta Service Account
        _type:
          type: string
          readOnly: true
          enum:
            - individual_okta_account
      required:
        - _type
        - service_account
    SelectorIndividualSaaSAppAccount:
      title: SelectorIndividualSaaSAppAccount
      description: This resource selector identifies a Service Account that exists on a specific SaaS Application
      type: object
      properties:
        saas_app_instance:
          allOf:
            - $ref: '#/components/schemas/NamedObject'
          readOnly: true
          description: A named object representing the SaaS Application
        service_account:
          allOf:
            - $ref: '#/components/schemas/NamedObject'
          description: A named object representing the Service Account
        _type:
          type: string
          readOnly: true
          enum:
            - individual_managed_saas_app_account
      required:
        - _type
        - service_account
    SelectorIndividualServer:
      title: individual_server
      description: This resource selector identifies a specific enrolled server
      type: object
      properties:
        server:
          allOf:
            - $ref: '#/components/schemas/NamedObject'
          example:
            id: xzy-654-123
            name: EnrolledServer
            type: server
        _type:
          type: string
          readOnly: true
          enum:
            - individual_server
      required:
        - _type
        - server
    SelectorIndividualServerAccount:
      title: individual_server_account
      description: This resource selector identifies a specific user account that exists on a specific enrolled server
      type: object
      properties:
        server:
          allOf:
            - $ref: '#/components/schemas/NamedObject'
          example:
            id: xzy-654-123
            name: EnrolledServer
            type: server
        username:
          type: string
          description: A server account that exists on the Server
        _type:
          type: string
          readOnly: true
          enum:
            - individual_server_account
      required:
        - _type
        - server
    SelectorServerLabel:
      title: server_label
      description: This resource selector identifies every enrolled sever that includes a matching label
      type: object
      properties:
        account_selector:
          type: object
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyUsernameAccountSelector'
            - $ref: '#/components/schemas/SecurityPolicyNoneAccountSelector'
          discriminator:
            propertyName: _type
            mapping:
              none: '#/components/schemas/SecurityPolicyNoneAccountSelector'
              username: '#/components/schemas/SecurityPolicyUsernameAccountSelector'
        account_selector_type:
          $ref: '#/components/schemas/SelectorServerLabelAccountSelectorType'
        server_selector:
          type: object
          description: Contains an object called `labels`. Currently, only a single Server Selector object is allowed per rule.
          properties:
            labels:
              type: object
              description: Contains key/value pairs used to match labels applied to one or more enrolled servers.
              example:
                os: Linux
                usage: prod
        _type:
          type: string
          readOnly: true
          enum:
            - server_label
      required:
        - _type
        - server_selector
        - account_selector
        - account_selector_type
    SelectorServerLabelAccountSelectorType:
      description: Defines the type of account. Currently only accepts `username`.
      type: string
      enum:
        - none
        - username
    Server:
      type: object
      properties:
        access_address:
          description: The access address of the server
          readOnly: true
          type: string
        alt_names:
          description: (Optional) Alternative names for the server
          items:
            maxLength: 255
            minLength: 1
            type: string
          readOnly: true
          type: array
        bastion:
          description: The bastion host that clients automatically use when connecting to this host
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        broker_host_certs:
          description: The broker host certificates list
          items:
            maxLength: 2048
            minLength: 1
            type: string
          readOnly: true
          type: array
        canonical_name:
          description: The name that clients should use when connecting to this server. Overrides the name found with hostname.
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        cloud_provider:
          $ref: '#/components/schemas/CloudProviderType'
        deleted_at:
          description: A timestamp indicating when the server was deleted from the project
          format: date-time
          readOnly: true
          type: string
        hostname:
          description: The hostname of the server
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        id:
          description: The UUID of the server
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        instance_details:
          oneOf:
            - $ref: '#/components/schemas/aws'
            - $ref: '#/components/schemas/gce'
          discriminator:
            propertyName: _type
            mapping:
              aws: '#/components/schemas/aws'
              gce: '#/components/schemas/gce'
        instance_id:
          description: The UUID of the instance
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        labels:
          additionalProperties:
            type: string
          description: 'The labels for this server. Used by the PolicySync feature, see [PolicySync: Attribute-Based Access Control](https://help.okta.com/okta_help.htm?type=asa&id=ext-asa-policysync).'
          type: object
        last_seen:
          description: A timestamp indicating when the server was last seen
          format: date-time
          readOnly: true
          type: string
        managed:
          description: If `true`, the server is managed by the OPA server agent (`sftd`)
          readOnly: true
          type: boolean
        os:
          description: The OS version of the server, such as CentOS 6 or Debian 9.13
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        os_type:
          description: 'The OS family of the server. Possible values: `linux` or `windows`.'
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        project_id:
          description: The UUID of the project where the server is enrolled
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        project_name:
          description: The name of the project where the server is enrolled
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        registered_at:
          description: The timestamp when the server was enrolled in the project
          format: date-time
          readOnly: true
          type: string
        services:
          description: 'The service that clients use to connect to the server. Possible values: `ssh` or `rdp`.'
          items:
            maxLength: 64
            minLength: 1
            type: string
          readOnly: true
          type: array
        sftd_version:
          description: The OPA server agent (`sftd`) version on the server
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        ssh_host_keys:
          description: The host keys used to authenticate the server
          items:
            maxLength: 2147483647
            minLength: 1
            type: string
          readOnly: true
          type: array
        state:
          description: 'The state of the server. Possible values: `ACTIVE` or `INACTIVE`.'
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        team_name:
          description: The name of the associated team
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          readOnly: true
          type: string
      required:
        - team_name
        - id
        - project_name
        - hostname
        - alt_names
        - bastion
        - canonical_name
        - access_address
        - os
        - os_type
        - services
        - registered_at
        - last_seen
        - sftd_version
        - ssh_host_keys
        - state
        - managed
        - deleted_at
        - labels
    ServerAccountCheckedOutResourceDetails:
      type: object
      properties:
        hostname:
          description: The hostname of the server associated with the Resource
          type: string
          readOnly: true
        server_id:
          description: The UUID of the server associated with the Resource
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this Resource object
      required:
        - hostname
        - server_id
    ServerAccounts:
      type: object
      properties:
        created_at:
          description: A timestamp indicating when the server account was created
          type: string
          format: date-time
        deleted_at:
          description: A timestamp indicating when the server account was deleted
          type: string
          format: date-time
        hostname:
          description: The host name of the server
          type: string
        id:
          description: The UUID of the server account
          type: string
        last_password_change_error_metadata:
          description: The error message metadata reported during the most recent failure to change the server account password
          type: string
        last_password_change_error_report_timestamp:
          description: A timestamp indicating when the server last reported a failure to change to the server account password
          type: string
          format: date-time
        last_password_change_error_system_timestamp:
          description: A timestamp reported from the server system clock indicating when the server last failed to change the server account password
          type: string
          format: date-time
        last_password_change_error_type:
          description: The type of error message reported during the most recent failure to change the server account password
          type: string
        last_password_change_success_report_timestamp:
          description: A timestamp indicating when the server last reported a change to the server account password
          type: string
          format: date-time
        last_password_change_system_timestamp:
          description: A timestamp reported from the server system clock indicating when the server last changed the server account password
          type: string
          format: date-time
        login:
          description: The user account name on the server
          type: string
        managed:
          description: If `true`, indicates that the server account password is managed by Okta Privileged Access. If `false`, this account was discovered on the server, but the password is not managed by Okta Privileged Access.
          type: boolean
        project_id:
          description: The UUID of the project associated with this server account
          type: string
        server_id:
          description: The UUID of the server associated with this server account
          type: string
        team_id:
          description: The UUID of the team associated with this server account
          type: string
    ServerAccountsRevealCredentialsRequest:
      type: object
      properties:
        public_key:
          $ref: '#/components/schemas/RawJSONWebKey'
        user_access_method:
          $ref: '#/components/schemas/UserAccessMethod'
      required:
        - public_key
        - user_access_method
    ServerEnrollmentToken:
      type: object
      properties:
        created_by_user:
          description: The user that created this server enrollment token
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        description:
          description: A human-readable description of the purpose of this server enrollment token
          maxLength: 512
          minLength: 1
          type: string
        id:
          description: The UUID of a server enrollment token
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        issued_at:
          description: A timestamp indicating when the server enrollment token was created
          format: date-time
          readOnly: true
          type: string
        token:
          additionalProperties:
            type: string
          description: A token used to enroll a server
          readOnly: true
          type: object
      required:
        - id
        - token
        - created_by_user
        - issued_at
        - description
    ServiceAccountCheckoutDetails:
      description: Service account info with account checkout details for end-user. Service account can either be a SaaS app account or a Universal Directory account
      allOf:
        - $ref: '#/components/schemas/ResourceCheckoutDetails'
      type: object
    ServiceAccountEndUser:
      description: Service account info with account checkout details for end-user. Service account can either be a SaaS app account or Universal Directory account.
      type: object
      properties:
        account:
          type: object
          description: Service account details
          properties:
            id:
              type: string
              description: The UUID of the service account
              format: regex
              pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
              readOnly: true
              example: a747a818-a4c4-4446-8a87-704216495a08
            name:
              type: string
              description: The human-readable name for the service account
              format: regex
              maxLength: 50
              minLength: 1
              pattern: ^[\w\-_. ]+$
              example: AWS Prod-5 account
            username:
              type: string
              description: The username associated with the service account
              minLength: 1
              maxLength: 100
              example: testuser@example.com
            lcm_sync_possible:
              type: boolean
              description: Whether the password for the service account can be rotated using Okta Lifecycle Management
            availability_status:
              $ref: '#/components/schemas/ResourceAvailabilityStatus'
        checkout_details:
          $ref: '#/components/schemas/ServiceAccountCheckoutDetails'
      required:
        - account
    ServiceAccountPrivilegeContainer:
      description: Privileges granted to a user for a service account
      type: object
      properties:
        privilege_type:
          $ref: '#/components/schemas/SecurityPolicyRulePrivilegeTypeForServiceAccounts'
        privilege_value:
          type: object
          description: The value of the privilege
          oneOf:
            - $ref: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
            - $ref: '#/components/schemas/SecurityPolicyUpdatePasswordPrivilege'
          discriminator:
            propertyName: _type
            mapping:
              reveal_password: '#/components/schemas/SecurityPolicyRevealPasswordPrivilege'
              update_password: '#/components/schemas/SecurityPolicyUpdatePasswordPrivilege'
    ServiceAccountSettingNameObject:
      type: object
      properties:
        id:
          description: The unique identifier of the service account setting
          type: string
          minLength: 1
          maxLength: 255
        missing:
          description: Indicates if the selected service account could not be found
          type: boolean
          readOnly: true
        saas_app_instance_name:
          description: The name of the SaaS application instance
          type: string
          readOnly: true
        service_account_user_name:
          description: The username of the service account
          type: string
          readOnly: true
      required:
        - id
    ServiceAccountSyncStatus:
      description: Describes the current sync status for actively managed accounts
      type: string
      enum:
        - NOT_SYNCED
        - SYNCED
        - SYNCING
        - SYNC_FAILED
      x-enumDescriptions:
        NOT_SYNCED: Credentials are not yet synced
        SYNCING: Credentials are currently being synced
        SYNCED: Credentials are successfully synced
        SYNC_FAILED: Credentials sync failed
    ServiceAccountsRevealCredentialsRequest:
      type: object
      properties:
        public_key:
          $ref: '#/components/schemas/RawJSONWebKey'
        user_access_method:
          $ref: '#/components/schemas/UserAccessMethodWithRuleIds'
      required:
        - public_key
        - user_access_method
    ServiceAccountsRevealCredentialsResponse:
      type: object
      properties:
        password_jwe:
          type: string
      required:
        - password_jwe
    ServiceAccountsRotateCredentialsRequest:
      type: object
      properties:
        password_jwe:
          type: string
          description: The new JWE-encrypted password for the service account
        user_access_method:
          $ref: '#/components/schemas/UserAccessMethodWithRuleIds'
          description: The user access method configuration for credential rotation
      required:
        - password_jwe
        - user_access_method
    ServiceAccountsUpdateCredentialsRequest:
      type: object
      properties:
        password_jwe:
          type: string
        user_access_method:
          $ref: '#/components/schemas/UserAccessMethodWithRuleIds'
      required:
        - password_jwe
        - user_access_method
    ServiceUserKey:
      type: object
      properties:
        expires_at:
          description: A timestamp for when the API key expires
          format: date-time
          readOnly: true
          type: string
        id:
          description: The UUID of the API key
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        issued_at:
          description: A timestamp for when the API key was issued
          format: date-time
          readOnly: true
          type: string
        last_used:
          description: A timestamp for when the API key was last used
          format: date-time
          readOnly: true
          type: string
      required:
        - id
        - issued_at
        - expires_at
        - last_used
    ServiceUserKeyWithSecret:
      type: object
      properties:
        expires_at:
          description: A timestamp for when the API key expires
          format: date-time
          readOnly: true
          type: string
        id:
          description: The UUID of the API key
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        issued_at:
          description: A timestamp for when the API key was issued
          format: date-time
          readOnly: true
          type: string
        last_used:
          description: A timestamp for when the API key was last used
          format: date-time
          readOnly: true
          type: string
        secret:
          description: The secret associated with the API key and used to authenticate the service user. Don't share.
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
      required:
        - id
        - issued_at
        - expires_at
        - last_used
        - secret
    StagedServiceAccount:
      type: object
      properties:
        application_instance_name:
          description: The name of the app associated with the service account
          type: string
          example: AWS Engineering
        description:
          description: A brief description of the service account
          type: string
          example: This is for accessing AWS Prod-5
        id:
          description: The UUID of the service account
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          type: string
          readOnly: true
          example: d1b65a78-21ed-429b-8ea3-eec96f2748d6
        lcm_sync_possible:
          description: Whether the password for the service account can be rotated using Okta Lifecycle Management
          type: boolean
        logo_url:
          description: A URL pointing to the logo of the app associated with the service account
          type: string
          example: https://ok3static.oktacdn.com/fs/bco/4/fs01i34nm7lS8dyXf1d8
        name:
          description: A human-readable name for the service account
          type: string
          example: AWS Prod-5 account
        username:
          description: The username of the service account
          type: string
          example: awsuser
    SudoCommandBundle:
      type: object
      properties:
        add_env:
          description: A list of environment variables to include when running sudo commands. See the [sudo documentation](https://www.sudo.ws/man/1.8.13/sudoers.man.html#Command_environment).
          items:
            format: regex
            maxLength: 128
            minLength: 1
            pattern: ^[\w]+$
            type: string
          nullable: true
          type: array
          maxItems: 32
        created_at:
          description: A timestamp indicating when the sudo command bundle was created
          type: string
          format: date-time
          readOnly: true
          example: '2022-08-25T00:00:00Z'
        created_by:
          description: The username of the user who created the sudo command bundle
          type: string
          readOnly: true
        description:
          description: A description of the sudo command bundle
          maxLength: 255
          minLength: 1
          type: string
        id:
          description: The UUID of the sudo command bundle
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        name:
          description: The name of the sudo command bundle. This controls the ordering of all bundles within your team. See [Sudo Command Bundle](https://help.okta.com/oie/en-us/okta_help.htm#cshid=csh-pam-sudo-commands).
          format: regex
          maxLength: 255
          minLength: 1
          pattern: ^[\w\-_.]+$
          type: string
        no_exec:
          description: Whether to allow commands to execute child processes
          nullable: true
          type: boolean
        no_passwd:
          description: Whether to require a password when sudo is run. This should generally not be used as users don't require a password.
          nullable: true
          type: boolean
          default: true
        run_as:
          description: A non-root user account used to run the command
          format: regex
          maxLength: 64
          minLength: 1
          nullable: true
          pattern: ^([%]{0,1})((([#])(\d+))|([\w\-_.]+)|((?i)[A-Z0-9._%+-^]+@[A-Z0-9.-]+\.[A-Z]{2,}))$
          type: string
        set_env:
          description: Whether to allow overriding environment variables to commands
          nullable: true
          type: boolean
        structured_commands:
          description: A list of commands to allow
          minItems: 0
          maxItems: 64
          items:
            type: object
            properties:
              args:
                type: string
                description: The args are only allowed for 'executable' command type
              args_type:
                $ref: '#/components/schemas/args_type'
              command_type:
                $ref: '#/components/schemas/command_type'
              command:
                type: string
              rendered_command:
                maxLength: 1024
                readOnly: true
                type: string
            required:
              - command
              - command_type
          nullable: true
          type: array
        sub_env:
          description: A list of environment variables to ignore when running the commands. See the [sudo documentation](https://www.sudo.ws/man/1.8.13/sudoers.man.html#Command_environment).
          items:
            format: regex
            maxLength: 128
            minLength: 1
            pattern: ^[\w]+$
            type: string
          maxItems: 32
          nullable: true
          type: array
        updated_at:
          description: A timestamp indicating when the sudo command bundle was last updated
          type: string
          format: date-time
          readOnly: true
          example: '2022-08-25T00:00:00Z'
        updated_by:
          description: The username of the user who last updated the sudo command bundle
          type: string
          readOnly: true
      required:
        - name
    SudoCommandBundleForConnectionInfo:
      type: object
      properties:
        ent_type:
          description: Entitlement type
          type: string
        sudo_add_env:
          description: Additional environmental variables
          type: array
          items:
            type: string
        sudo_commands:
          description: List of sudo commands
          type: array
          items:
            type: string
        sudo_group_name:
          description: Sudo group name
          type: string
        sudo_id:
          description: Sudo ID
          type: string
        sudo_login_username:
          description: Sudo login username
          type: string
        sudo_name:
          description: Sudo name
          type: string
        sudo_noexec:
          description: If sudo has `noexec` configuration set
          type: boolean
        sudo_nopasswd:
          description: If sudo can be used without password
          type: boolean
        sudo_runas:
          description: Sudo run as
          type: string
        sudo_setenv:
          description: If `setenv` is allowed
          type: boolean
        sudo_sub_env:
          description: A list of environment variables to be used to substitute your current environment
          type: array
          items:
            type: string
      required:
        - sudo_id
        - ent_type
        - sudo_login_username
        - sudo_group_name
        - sudo_name
        - sudo_runas
        - sudo_nopasswd
        - sudo_noexec
        - sudo_setenv
    TeamGroupAttribute:
      type: object
      properties:
        attribute_name:
          $ref: '#/components/schemas/GroupAttributeName'
        attribute_value:
          oneOf:
            - $ref: '#/components/schemas/unix_gid'
            - $ref: '#/components/schemas/unix_group_name'
            - $ref: '#/components/schemas/windows_group_name'
        id:
          description: The unique identifier for the attribute
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
          example: d4f40b71-9474-41c5-94ff-3196a4fc2d03
        managed:
          description: Indicates if the attribute is managed through SCIM or SAML
          readOnly: true
          type: boolean
      required:
        - id
        - attribute_name
        - attribute_value
        - managed
    TeamSettings:
      type: object
      properties:
        approve_device_without_interaction:
          description: If `true`, devices are automatically approved for authenticated users
          nullable: true
          type: boolean
        client_session_duration:
          description: The maximum time before a client session expires. The duration can be from 3600 – 90000 seconds.
          maximum: 90000
          minimum: 3600
          nullable: true
          type: integer
          format: int32
        post_device_enrollment_url:
          description: If specified, redirects a user to the URL after they enroll a device
          maxLength: 8096
          nullable: true
          type: string
        post_login_url:
          description: If specified, redirects a user to the URL after they authenticate through the IdP
          maxLength: 8096
          nullable: true
          type: string
        post_logout_url:
          description: If specified, redirects a user to the URL after they sign out
          maxLength: 8096
          nullable: true
          type: string
        reactivate_users_via_idp:
          description: If `true`, previously deleted or disabled users are re-enabled if they authenticate through the IdP
          nullable: true
          type: boolean
        team:
          description: The name of the team
          example: Your_OPA_Team
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
        user_provisioning_exact_username:
          description: DEPRECATED.  This setting has no effect.
          nullable: true
          type: boolean
          deprecated: true
        web_session_duration:
          description: The maximum time before a web session expires. The duration can be from 1800 – 90000 seconds.
          maximum: 90000
          minimum: 1800
          nullable: true
          type: integer
          format: int32
      required:
        - team
    TeamStats:
      type: object
      properties:
        num_clients:
          description: The number of clients in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
        num_gateways:
          description: The number of gateways in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
        num_groups:
          description: The number of groups in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
        num_human_users:
          description: The number of users in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
        num_projects:
          description: The number of projects in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
        num_servers:
          description: The number of servers in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
        num_service_users:
          description: The number of service users in a team
          maximum: 60000
          readOnly: true
          type: integer
          format: int32
      required:
        - num_human_users
        - num_service_users
        - num_groups
        - num_projects
        - num_servers
        - num_gateways
        - num_clients
    TeamUserAttribute:
      type: object
      properties:
        attribute_name:
          $ref: '#/components/schemas/TeamUserAttributeName'
        attribute_value:
          type: object
          oneOf:
            - $ref: '#/components/schemas/active_directory_identity'
            - $ref: '#/components/schemas/active_directory_passwordless_identity'
            - $ref: '#/components/schemas/gecos_field'
            - $ref: '#/components/schemas/user_home_dir'
            - $ref: '#/components/schemas/unix_gid'
            - $ref: '#/components/schemas/unix_uid'
            - $ref: '#/components/schemas/unix_user_name'
            - $ref: '#/components/schemas/user_shell'
            - $ref: '#/components/schemas/windows_user_name'
        id:
          description: The unique identifier for the attribute
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        managed:
          description: Indicates if the attribute is managed through SCIM or SAML
          readOnly: true
          type: boolean
      required:
        - id
        - attribute_name
        - attribute_value
        - managed
    TeamUserAttributeConflict:
      type: object
      properties:
        attribute_name:
          $ref: '#/components/schemas/TeamUserAttributeName'
        attribute_value:
          type: object
          oneOf:
            - $ref: '#/components/schemas/active_directory_identity'
            - $ref: '#/components/schemas/active_directory_passwordless_identity'
            - $ref: '#/components/schemas/gecos_field'
            - $ref: '#/components/schemas/user_home_dir'
            - $ref: '#/components/schemas/unix_gid'
            - $ref: '#/components/schemas/unix_uid'
            - $ref: '#/components/schemas/unix_user_name'
            - $ref: '#/components/schemas/user_shell'
            - $ref: '#/components/schemas/windows_user_name'
        id:
          description: The unique identifier for the attribute
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        is_service_user:
          description: Indicates if the attribute is related to a service user
          readOnly: true
          type: boolean
        user_name:
          description: Indicates the Okta Privileged Access username related to the conflict
          readOnly: true
          type: string
      required:
        - id
        - attribute_name
        - attribute_value
    TeamUserAttributeName:
      description: The type of attribute
      type: string
      enum:
        - active_directory_identity
        - active_directory_passwordless_identity
        - gecos_field
        - unix_gid
        - unix_uid
        - unix_user_name
        - user_shell
        - windows_user_name
    UUID:
      format: regex
      example: a747a818-a4c4-4446-8a87-704216495a08
      type: string
      pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
      readOnly: true
    UnauthorizedAccessResponse:
      description: JSON response for accessing an endpoint without an appropriate role
      type: object
      properties:
        code:
          type: integer
          description: An error code for this type of error
          enum:
            - 401
        message:
          type: string
          description: A short description of what caused this error. Sometimes this contains dynamically-generated information about your specific error.
          example: 'Missing capability: role'
        nottype:
          type: string
          description: The type of error that occurred
          enum:
            - authorization_error
    UpdateAttribute:
      type: object
      properties:
        attribute_name:
          $ref: '#/components/schemas/TeamUserAttributeName'
        attribute_value:
          oneOf:
            - $ref: '#/components/schemas/active_directory_identity'
            - $ref: '#/components/schemas/active_directory_passwordless_identity'
            - $ref: '#/components/schemas/gecos_field'
            - $ref: '#/components/schemas/user_home_dir'
            - $ref: '#/components/schemas/unix_gid'
            - $ref: '#/components/schemas/unix_uid'
            - $ref: '#/components/schemas/unix_user_name'
            - $ref: '#/components/schemas/user_shell'
            - $ref: '#/components/schemas/windows_user_name'
          type: object
      required:
        - attribute_name
        - attribute_value
    UpdateGroupAttribute:
      type: object
      properties:
        attribute_name:
          $ref: '#/components/schemas/GroupAttributeName'
        attribute_value:
          oneOf:
            - $ref: '#/components/schemas/unix_gid'
            - $ref: '#/components/schemas/unix_group_name'
            - $ref: '#/components/schemas/windows_group_name'
      required:
        - attribute_name
        - attribute_value
    UpdateServiceUserBody:
      type: object
      properties:
        name:
          description: The name of the service user
          maxLength: 255
          minLength: 1
          type: string
        status:
          description: 'The status of the user: `ACTIVE`, `DISABLED`, or `DELETED`. Users can''t disable or delete their own account.'
          type: string
      required:
        - name
        - status
    UpdateWorkloadConnectionStatusRequest:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        status:
          allOf:
            - $ref: '#/components/schemas/WorkloadConnectionStatus'
      required:
        - status
    UpdateableADConnectionStatus:
      description: Statuses that can be updated via the API
      type: string
      enum:
        - connected
        - disconnected
      x-enumDescriptions:
        connected: Indicates that the connection is in use and can be used to define account assignment rules
        disconnected: Indicates that the connection is not in use and cannot be used to define account assignment rules
    User:
      type: object
      properties:
        deleted_at:
          description: A timestamp indicating when the user was deleted
          format: date-time
          readOnly: true
          nullable: true
          type: string
        details:
          description: The details of the user synced from Okta
          nullable: true
          properties:
            email:
              format: regex
              description: The email associated with the user
              maxLength: 255
              minLength: 1
              nullable: true
              pattern: ^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$
              type: string
            first_name:
              maxLength: 255
              minLength: 1
              nullable: true
              description: The first name of the user
              type: string
            last_name:
              maxLength: 255
              minLength: 1
              nullable: true
              description: The last name of the user
              type: string
            full_name:
              maxLength: 512
              minLength: 1
              nullable: true
              description: The full name of the user
              type: string
          type: object
        id:
          description: The UUID of the user
          format: regex
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
          readOnly: true
          type: string
        name:
          description: The username for the user
          maxLength: 255
          minLength: 1
          type: string
        oauth_client_application_id:
          description: If defined, indicates the OAuth client application ID tied to a service user. Only available when the user was created as part of an OAuth approval flow.
          maxLength: 255
          minLength: 1
          nullable: true
          readOnly: true
          type: string
        role_grants:
          description: The permission roles available to the user
          items:
            maxLength: 64
            minLength: 1
            type: string
          readOnly: true
          type: array
        status:
          description: 'The status of the user: `ACTIVE`, `DISABLED`, or `DELETED`. Users can''t disable or delete their own account.'
          type: string
        team_name:
          description: The name of the team
          type: string
          readOnly: true
        user_type:
          description: 'The type of user. Possible values: `service` or `human`.'
          maxLength: 255
          minLength: 1
          readOnly: true
          type: string
      required:
        - team_name
        - id
        - name
        - details
        - status
        - user_type
        - deleted_at
    UserAccessConditional:
      type: object
      properties:
        access_request_type_id:
          description: Used by `access_request` conditionals to define the ID of a specific request type
          type: string
        access_request_type_name:
          description: Used by `access_request` conditionals to define the name of a specific request type
          type: string
        acr_values:
          $ref: '#/components/schemas/ConditionsMFAACRValues'
        condition_is_met:
          description: If `true`, the condition is currently met
          type: boolean
        description:
          description: A description of the condition
          type: string
        expires_after_seconds:
          description: Used by `access_request` conditionals to define the number of seconds the approval remains valid
          type: integer
          format: int64
        type:
          $ref: '#/components/schemas/UserAccessConditionalType'
    UserAccessConditionalType:
      description: The type of condition
      type: string
      enum:
        - access_request
        - gateway
        - gateway_with_session_recording
        - mfa
    UserAccessMethod:
      type: object
      properties:
        access_credential:
          description: The user credential that's used to access the resource
          type: string
          enum:
            - managed
            - password
            - ssh-certificate
            - ssh-certificate-admin
            - ssh-certificate-sudo
            - rdp-broker-certificate
            - rdp-broker-certificate-admin
            - encrypted-ssh-password
            - encrypted-rdp-password
            - encrypted-ad-rdp-password
            - encrypted-ad-rdp-password-with-remote-access
            - encrypted-ad-rdp-password-with-admin
            - encrypted-ad-ssh-password
        availability_details_text:
          description: This text displays in the user interface (CLI) to show resource availability status with checkout requirements and checkout expiry time. The availability status displays only for the CLI user who previously checked out the resource.
          type: string
        brokered:
          description: If `true`, the connection is brokered by the server agent
          type: boolean
        checkout_requirements:
          $ref: '#/components/schemas/CheckoutRequirements'
        conditionals:
          description: A list of required conditions to use the user access method
          items:
            $ref: '#/components/schemas/UserAccessConditional'
          type: array
        current_user_checkout_expires_at:
          description: The checkout expiry time for the current user
          type: string
          format: date-time
        details:
          description: User access method details
          type: object
          oneOf:
            - $ref: '#/components/schemas/UserAccessMethodSecretDetails'
            - $ref: '#/components/schemas/UserAccessMethodServerDetails'
            - $ref: '#/components/schemas/UserAccessMethodServiceAccountDetails'
            - $ref: '#/components/schemas/UserAccessMethodActiveDirectoryAccountDetails'
          discriminator:
            propertyName: _type
            mapping:
              secret: '#/components/schemas/UserAccessMethodSecretDetails'
              unknown: '#/components/schemas/UserAccessMethodServerDetails'
              brokered_rdp: '#/components/schemas/UserAccessMethodServerDetails'
              ad_passwordless: '#/components/schemas/UserAccessMethodServerDetails'
              ad_password: '#/components/schemas/UserAccessMethodServerDetails'
              unmanaged_rdp: '#/components/schemas/UserAccessMethodServerDetails'
              principal_account_ssh: '#/components/schemas/UserAccessMethodServerDetails'
              principal_account_ssh_with_admin: '#/components/schemas/UserAccessMethodServerDetails'
              principal_account_ssh_with_sudo: '#/components/schemas/UserAccessMethodServerDetails'
              principal_account_rdp: '#/components/schemas/UserAccessMethodServerDetails'
              principal_account_rdp_with_admin: '#/components/schemas/UserAccessMethodServerDetails'
              encrypted_ssh_password: '#/components/schemas/UserAccessMethodServerDetails'
              encrypted_rdp_password: '#/components/schemas/UserAccessMethodServerDetails'
              service_account: '#/components/schemas/UserAccessMethodServiceAccountDetails'
              active_directory_account: '#/components/schemas/UserAccessMethodActiveDirectoryAccountDetails'
              encrypted_ad_rdp_password: '#/components/schemas/UserAccessMethodServerDetails'
              encrypted_ad_rdp_password_with_remote_access: '#/components/schemas/UserAccessMethodServerDetails'
              encrypted_ad_rdp_password_with_admin: '#/components/schemas/UserAccessMethodServerDetails'
              encrypted_ad_ssh_password: '#/components/schemas/UserAccessMethodServerDetails'
        identity:
          description: The user account that's used to access the resource
          type: string
        resource_status:
          description: Resource availability status that's displayed to end users
          type: string
          enum:
            - available
            - checked_out
            - checked_out_by_other_user
            - unavailable
        rule_ids:
          description: The IDs of the security policy rules that generated this user access method
          items:
            type: string
          type: array
        rule_resource_type:
          x-okta-lifecycle:
            lifecycle: EA
            isGenerallyAvailable: false
            SKUs: []
          allOf:
            - $ref: '#/components/schemas/SecurityPolicyRuleResourceType'
              description: The type of resource targeted by the security policy rules that generated this user access method
          readOnly: true
        server_host_name:
          description: Server host name
          type: string
        server_id:
          description: The ID of the resource
          type: string
        short_text:
          description: A short description that's used to identify the access method to the user interface
          type: string
          readOnly: true
        sudo_command_bundles:
          type: array
          items:
            $ref: '#/components/schemas/SudoCommandBundleForConnectionInfo'
          description: Collection of all the sudo-related commands a user can access in a single string format
        sudo_display_name:
          description: This is a nickname set on the policy rule that contains one or more sudo command bundles. This helps users choose the appropriate user access method based on the sudo permissions it grants.
          type: string
          readOnly: true
        user_access_type:
          description: The type of access method
          type: string
      required:
        - identity
        - access_credential
        - brokered
        - user_access_type
        - resource_status
        - server_host_name
        - sudo_display_name
    UserAccessMethodActiveDirectoryAccountDetails:
      type: object
      properties:
        account_id:
          description: The ID of the Active Directory account
          type: string
        privileges:
          description: A list of privileges granted to a user based on security policies
          type: array
          items:
            $ref: '#/components/schemas/ActiveDirectoryAccountPrivilegeContainer'
          minItems: 1
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this resource object
      required:
        - account_id
        - privileges
    UserAccessMethodAssignmentType:
      x-okta-lifecycle:
        lifecycle: EA
        isGenerallyAvailable: false
        SKUs: []
      description: <x-lifecycle-container><x-lifecycle class="ea"></x-lifecycle></x-lifecycle-container>The type of identity assignment that grants the user access to the resource
      type: string
      enum:
        - INDIVIDUAL
        - SHARED
      readOnly: true
    UserAccessMethodFilters:
      type: object
      properties:
        identity:
          description: |
            If provided, only return user access methods that use this account to access the server
          type: string
        sudo_display_name:
          description: |
            If provided, only return user access methods associated with this sudo command bundle.
            The command bundle is a grouping of sudo command sets defined in policies, identified by its display name.
          type: string
    UserAccessMethodSecretDetails:
      type: object
      properties:
        path:
          description: List of secrets
          type: array
          items:
            $ref: '#/components/schemas/SecretPath'
        privileges:
          description: A list of privileges granted to the user
          allOf:
            - $ref: '#/components/schemas/SecurityPolicySecretPrivilege'
        secret_id:
          description: The ID of the secret used to access the resource
          type: string
        secret_name:
          description: The name of the secret used to access the resource
          type: string
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this resource object
    UserAccessMethodServerDetails:
      type: object
      properties:
        access_credential:
          $ref: '#/components/schemas/AccessCredentialType'
        brokered:
          description: If `true`, the connection is brokered by the server agent
          type: boolean
        identity:
          description: The username that will be used to access the server resource
          type: string
        identity_assignment_type:
          $ref: '#/components/schemas/UserAccessMethodAssignmentType'
        identity_id:
          description: The ID of the identity used to access the server resource
          type: string
        privileges:
          description: |
            A list of privileges granted to a user based on security policies.
            This field is only present when:
            - The `include_privileged_user_access_methods` parameter is set to `true` in the `/v1/resolve` API request
            - The account is a managed server account (access_credential is `encrypted-ssh-password` or `encrypted-rdp-password`)
          type: array
          items:
            $ref: '#/components/schemas/ManagedServerAccountPrivilegeContainer'
          x-okta-lifecycle:
            lifecycle: GA
            isGenerallyAvailable: false
            SKUs: []
        server_host_name:
          description: The host name of the server resource
          type: string
        server_id:
          description: The ID of the server resource
          type: string
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this resource object
    UserAccessMethodServiceAccountDetails:
      type: object
      properties:
        account_id:
          description: The ID of the service account
          type: string
        privileges:
          description: A list of privileges granted to a user based on security policies
          type: array
          items:
            $ref: '#/components/schemas/ServiceAccountPrivilegeContainer'
          minItems: 1
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this resource object
      required:
        - account_id
        - privileges
    UserAccessMethodWithRuleIds:
      description: |
        User access method with required rule IDs.
        Used for non-server resource credential operations such as reveal, rotate, and update.
      allOf:
        - $ref: '#/components/schemas/UserAccessMethod'
        - type: object
          properties:
            rule_ids:
              description: The IDs of the security policy rules that generated this user access method
              items:
                type: string
              type: array
          required:
            - rule_ids
    WorkloadAttributeMatcher:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      description: The condition used to match the source attribute
      type: string
      enum:
        - EQUALS
        - EXISTS
        - STARTS_WITH
      x-enumDescriptions:
        EQUALS: Indicates that the source attribute must match the desired value exactly
        EXISTS: Indicates that the source attribute must exist
        STARTS_WITH: Indicates that the source attribute must start with the desired value
    WorkloadCondition:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        matcher:
          $ref: '#/components/schemas/WorkloadAttributeMatcher'
        name:
          type: string
          description: The name of the attribute from the source identity document
          x-faker: lorem.word
        value:
          type: string
          description: The desired value for the attribute. This parameter is omitted if `matcher` is `EXISTS`.
      required:
        - name
        - matcher
    WorkloadConnection:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        conditions:
          description: Defines the identity attribute requirements that a workload must satisfy to authenticate through this connection and to obtain an OPA access token
          type: array
          minItems: 1
          maxItems: 20
          items:
            $ref: '#/components/schemas/WorkloadCondition'
        created_at:
          description: Timestamp that indicates when the workload connection was created
          type: string
          format: date-time
          readOnly: true
          x-faker: date.past
        created_by:
          $ref: '#/components/schemas/NamedObject'
        description:
          description: A brief description of the workload connection
          type: string
          x-faker: lorem.sentence
        id:
          description: The UUID of the workload connection
          $ref: '#/components/schemas/schemas-UUID'
          readOnly: true
        jwt_config:
          $ref: '#/components/schemas/WorkloadConnectionJWTConfig'
        last_activated_at:
          description: Timestamp that indicates when the workload connection was last activated
          type: string
          format: date-time
          readOnly: true
          x-faker: date.past
        last_activated_by:
          $ref: '#/components/schemas/NamedObject'
        name:
          description: The name of the workload connection
          type: string
          x-faker: internet.domainWord
        status:
          description: The status of the workload connection
          readOnly: true
          allOf:
            - $ref: '#/components/schemas/WorkloadConnectionStatus'
        token_ttl_in_seconds:
          description: |-
            The time-to-live (TTL) in seconds.
            Determines how long issued OPA access tokens remain valid.
          type: integer
          format: int64
          minimum: 1
          maximum: 86400
          example: 900
          x-faker:
            datatype.number:
              - max: 3600
              - min: 30
        type:
          $ref: '#/components/schemas/WorkloadConnectionType'
        updated_at:
          description: Timestamp that indicates when the workload connection was last updated
          type: string
          format: date-time
          readOnly: true
          x-faker: date.past
        updated_by:
          $ref: '#/components/schemas/NamedObject'
        workload_identity_claim:
          type: string
          description: The claim in the incoming identity document that represents the workload identity. For example, `sub` or `email`.
          readOnly: true
      required:
        - name
        - description
        - token_ttl_in_seconds
        - conditions
    WorkloadConnectionJWTConfig:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      description: Configuration for JWT type workload connections
      type: object
      properties:
        jwks_url:
          type: string
          description: The URL to verify the JSON Web Key Set (JWKS) for the workload connection
          x-faker: internet.url
      required:
        - jwks_url
    WorkloadConnectionStatus:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      description: The workload connection status
      type: string
      enum:
        - ACTIVE
        - DRAFT
        - INACTIVE
      x-enumDescriptions:
        DRAFT: Indicates that the workload connection is in draft status
        ACTIVE: Indicates that the workload connection is active
        INACTIVE: Indicates that the workload connection is inactive
    WorkloadConnectionType:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      description: The workload connection type. Only JWT is supported.
      type: string
      enum:
        - JWT
    WorkloadRole:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      type: object
      properties:
        created_at:
          description: Timestamp that indicates when the workload role was created
          type: string
          format: date-time
          readOnly: true
          x-faker: date.past
        created_by:
          $ref: '#/components/schemas/NamedObject'
        description:
          description: A brief description of the workload role
          type: string
          x-faker: lorem.sentence
        id:
          description: The ID of the workload role
          $ref: '#/components/schemas/schemas-UUID'
          readOnly: true
        name:
          description: The name of the workload role
          type: string
          x-faker: internet.domainWord
        requirements:
          type: array
          description: Defines the identity attribute requirements that a workload must satisfy to be authorized for this role
          minItems: 1
          maxItems: 20
          items:
            $ref: '#/components/schemas/WorkloadRoleRequirement'
        updated_at:
          description: Timestamp that indicates when the workload role was last updated
          type: string
          format: date-time
          readOnly: true
          x-faker: date.past
        updated_by:
          $ref: '#/components/schemas/NamedObject'
      required:
        - name
        - description
        - requirements
    WorkloadRoleRequirement:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      description: Specifies the identity attribute requirements a workload must satisfy to use this role
      type: object
      properties:
        conditions:
          type: array
          description: The additional identity attribute conditions a workload using the specified connection must satisfy to access this role
          maxItems: 20
          items:
            $ref: '#/components/schemas/WorkloadCondition'
        workload_connection:
          $ref: '#/components/schemas/NamedObject'
      required:
        - workload_connection
    WorkloadRoleWithServerUsername:
      x-okta-lifecycle:
        lifecycle: GA
        isGenerallyAvailable: false
        SKUs: []
      allOf:
        - $ref: '#/components/schemas/WorkloadRole'
        - type: object
          properties:
            linux_server_username:
              description: The username for the Linux server
              type: string
              x-faker: internet.userName
          required:
            - linux_server_username
    active_directory_identity:
      description: The Active Directory usernames accessible by the user. Users must manually enter their password.
      maxLength: 256
      type: string
    active_directory_passwordless_identity:
      description: The Active Directory usernames accessible by the user. Users don't need to enter a password.
      maxLength: 256
      type: string
    alg:
      description: The algorithm of the key
      type: string
      enum:
        - EdDSA
        - RSA-OAEP-256
    args_type:
      description: The `args_type` is only allowed for the 'executable' command type
      type: string
      enum:
        - any
        - custom
        - none
    aws:
      type: object
      properties:
        account_id:
          maxLength: 32
          minLength: 1
          type: string
        availability_zone:
          maxLength: 32
          minLength: 1
          type: string
        instance_id:
          maxLength: 32
          minLength: 1
          type: string
        instance_type:
          maxLength: 256
          minLength: 1
          type: string
        networks:
          items:
            properties:
              addresses:
                items:
                  maxLength: 32
                  minLength: 1
                  type: string
                type: array
              mac:
                maxLength: 32
                minLength: 1
                type: string
              vpc_id:
                maxLength: 32
                minLength: 1
                type: string
            required:
              - mac
            type: object
          type: array
        public_ip_v4:
          description: IP Address
          type: string
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this Resource object
      required:
        - instance_id
        - account_id
        - availability_zone
    command_type:
      type: string
      enum:
        - directory
        - executable
        - raw
    curve:
      description: The curve used by the key
      type: string
      enum:
        - Ed25519
        - P-256
        - P-384
        - P-521
    gateway-agent:
      type: object
      properties:
        labels:
          description: Key-value pairs for gateway proxy routing
          additionalProperties:
            type: string
          nullable: true
          type: object
    gce:
      type: object
      properties:
        external_ip:
          description: IP Address
          type: string
        instance_id:
          maxLength: 32
          minLength: 1
          type: string
        internal_ip:
          description: IP Address
          type: string
        network:
          maxLength: 1024
          minLength: 1
          type: string
        project_id:
          maxLength: 255
          minLength: 1
          type: string
        zone_id:
          maxLength: 32
          minLength: 1
          type: string
        _type:
          maxLength: 255
          minLength: 1
          type: string
          readOnly: true
          description: Type of this Resource object
      required:
        - instance_id
        - project_id
        - zone_id
    gecos_field:
      description: Any information associated with the user
      maxLength: 256
      type: string
    kty:
      description: The key type
      type: string
      enum:
        - EC
        - OKP
        - RSA
        - oct
    schemas-UUID:
      description: A Universally Unique Identifier (UUID)
      format: regex
      example: a747a818-a4c4-4446-8a87-704216495a08
      x-faker: datatype.uuid
      type: string
      pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$
      readOnly: true
    unix_gid:
      description: The associated Unix group ID
      maximum: 2147483647
      minimum: 100
      format: int32
      type: integer
    unix_group_name:
      description: The associated Unix group name
      maxLength: 255
      type: string
    unix_uid:
      description: The associated Unix user ID
      maximum: 2147483647
      minimum: 100
      format: int32
      type: integer
    unix_user_name:
      description: The associated Unix user name
      maxLength: 255
      type: string
    user_home_dir:
      description: The path to the home directory for the user
      maxLength: 256
      type: string
    user_shell:
      description: The associated Unix shell
      maxLength: 256
      type: string
    windows_group_name:
      description: The associated Windows group name
      maxLength: 255
      type: string
    windows_user_name:
      description: The associated Windows user name
      maxLength: 255
      type: string
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http
security:
  - bearerAuth: []