CreateEntitlement

POST/api/v1/entitlements

Grant a subject access to a resource. Access granted this way is applied directly, without going through a request.

Example request

US
Europe

curl -X POST \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "resource": "string", "subject": "string" }' \
  "https://us.oblique.security/api/v1/entitlements"

Set OBLIQUE_API_KEY to your API key.

curl -X POST \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "resource": "string", "subject": "string" }' \
  "https://eu.oblique.security/api/v1/entitlements"

Set OBLIQUE_API_KEY to your API key.

Query parameters

entitlementIdstring
ID of the entitlement to create. This value should be 4-63 characters. Valid characters are /[a-z][0-9]-/.

Request body

namestring
Assigned by Oblique.
resourcestringrequired
Set once, when the resource is created. The resource that this entitlement grants access to.

Format: resources/{resource}
subjectstringrequired
Set once, when the resource is created. The subject that is granted access to the resource. This can be a user, team, group, an account in an integration, or another resource.

An account subject grants the access to that account rather than to the directory user behind it. The account must belong to the same integration as the resource.

A resource subject represents a nested membership in the system that owns both resources, such as a Google group that is a member of another Google group. Both resources must come from the same integration, and the system must support that pairing: a Google group nests in a Google group, an Okta group in an Okta app, and a GitHub team in a GitHub team. A resource can’t be a member of itself.

Format: users/{user}, teams/{team}, groups/{group}, integrations/{integration}/accounts/{account}, resources/{resource}
rolesRole[]
The roles the subject holds on the resource. A resource can grant a subject more than one role at once, such as a Cloudflare policy that carries several permission groups.

A subject holding the system’s default role has that role recorded explicitly, so an empty list means the roles are unknown rather than that the subject holds none.
- displayNamestringrequired
  The role’s name as the system that owns the resource names it. For example, a Google group membership is MEMBER, MANAGER, or OWNER, and a Cloudflare permission group has a name such as “OAuth App Registrations Read”.
  
  Every system names its roles differently, so values are recorded verbatim and are not validated.
- idstringrequired
  The identifier the system that owns the resource uses for this role. Opaque to Oblique, and the same as display_name for a system that names a role only one way.
One of
- expireTime
- ttl
- expireTimestring (date-time)
  If present, when this access expires. This field is always provided on output.
- ttlstring (duration)
  Input only. The TTL for this resource.
createTimestring (date-time)read-only
Create and update timestamps.
updateTimestring (date-time)read-only
justificationstring
Human readable justification for the entitlement to be granted. For example, this may contain a link to a ticket or other artifacts.
importedboolean
Set once, when the resource is created. When true, this boolean indicates this entitlement was “imported” from a syncing process, such as reading data from Okta or Google Groups. User created entitlements will always cause this field to be false or unset.
requeststringread-only
If present, the request that most recently created or updated this entitlement.

Format: requests/{request}

Response

200Entitlement

An entitlement represents a permission or access right that can be granted to users or teams.

namestring
Assigned by Oblique.
resourcestringrequired
Set once, when the resource is created. The resource that this entitlement grants access to.

Format: resources/{resource}
subjectstringrequired
Set once, when the resource is created. The subject that is granted access to the resource. This can be a user, team, group, an account in an integration, or another resource.

An account subject grants the access to that account rather than to the directory user behind it. The account must belong to the same integration as the resource.

A resource subject represents a nested membership in the system that owns both resources, such as a Google group that is a member of another Google group. Both resources must come from the same integration, and the system must support that pairing: a Google group nests in a Google group, an Okta group in an Okta app, and a GitHub team in a GitHub team. A resource can’t be a member of itself.

Format: users/{user}, teams/{team}, groups/{group}, integrations/{integration}/accounts/{account}, resources/{resource}
rolesRole[]
The roles the subject holds on the resource. A resource can grant a subject more than one role at once, such as a Cloudflare policy that carries several permission groups.

A subject holding the system’s default role has that role recorded explicitly, so an empty list means the roles are unknown rather than that the subject holds none.
- displayNamestringrequired
  The role’s name as the system that owns the resource names it. For example, a Google group membership is MEMBER, MANAGER, or OWNER, and a Cloudflare permission group has a name such as “OAuth App Registrations Read”.
  
  Every system names its roles differently, so values are recorded verbatim and are not validated.
- idstringrequired
  The identifier the system that owns the resource uses for this role. Opaque to Oblique, and the same as display_name for a system that names a role only one way.
One of
- expireTime
- ttl
- expireTimestring (date-time)
  If present, when this access expires. This field is always provided on output.
- ttlstring (duration)
  Input only. The TTL for this resource.
createTimestring (date-time)read-only
Create and update timestamps.
updateTimestring (date-time)read-only
justificationstring
Human readable justification for the entitlement to be granted. For example, this may contain a link to a ticket or other artifacts.
importedboolean
Set once, when the resource is created. When true, this boolean indicates this entitlement was “imported” from a syncing process, such as reading data from Okta or Google Groups. User created entitlements will always cause this field to be false or unset.
requeststringread-only
If present, the request that most recently created or updated this entitlement.

Format: requests/{request}

Errors

Status	Meaning
`400`	Malformed request
`401`	Missing or invalid API key
`403`	Not allowed for this API key
`404`	Not found
`429`	Too many requests
`500`	Internal server error