CreateIntegration

POST/api/v1/integrations

Connect an integration, which starts syncing the resources and accounts it can see.

Example request

US
Europe

curl -X POST \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "displayName": "string" }' \
  "https://us.oblique.security/api/v1/integrations"

Set OBLIQUE_API_KEY to your API key.

curl -X POST \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "displayName": "string" }' \
  "https://eu.oblique.security/api/v1/integrations"

Set OBLIQUE_API_KEY to your API key.

Query parameters

integrationIdstring
ID of the integration to create. This value should be 4-63 characters. Valid characters are /[a-z][0-9]-/.

Request body

namestring
Assigned by Oblique. Name of the integration of the format integrations/{integration}.
managementManagement
How this integration is managed. Set automatically by the server based on the calling client. Omitted from responses when the integration is manually managed (the default).
- managerstring
  Allowed values: TERRAFORM
  How the API object is managed. Set automatically by the server based on the caller: Terraform clients produce TERRAFORM; for all other clients the management field is left unset on the response.
- repoUristring
  URI of the VCS repository that holds the Terraform configuration for this API object. Populated by the Oblique Terraform provider.
- repoDirstring
  Optionally, the subdirectory within repo_uri that holds the Terraform configuration for this API object. Populated by the Oblique Terraform provider.
displayNamestring
A human readable name of the integration. For example “Okta Test”.
createTimestring (date-time)read-only
Create and update timestamps.
updateTimestring (date-time)read-only
deleteTimestring (date-time)read-only
The time when the integration was deleted.
One of
- oktaOkta
  apiTokenstring
  The API token to use when making calls to Okta. Either this or OAuth2 client credentials must be provided when the integration is created.
  clientIdstring
  The client ID issued when the Oblique app is installed from the Okta Integration Network catalog. Must be provided together with client_secret, and can’t be combined with api_token: an integration authenticates either with OAuth2 client credentials or with an API token.
  clientSecretstring
  The client secret issued alongside client_id when the Oblique app is installed. Must be provided together with client_id, and can’t be combined with api_token. Never returned by the API; provide it again to rotate.
  domainBaseUristringrequired
  Full base URL of the Okta domain, including the schema. For example: https://dev-45752433-admin.okta.com
  displayNamestring
  Will be removed in the future in favor of top level display_name.
  organizationIdstringread-only
  The tenant ID of the Okta organization. This is detected on first creation of the integration and is not editable.
  manageResourcesbooleanread-only
  Whether Oblique manages the org’s groups and applications, creating groups and changing membership and assignments, which a resource in push mode needs. False when the connection is read-only, either because read_only holds Oblique to reading or because the Oblique app in Okta wasn’t granted the scopes to manage them. Either way the connection imports users, groups, applications, and their memberships, and writes nothing back to Okta.
  readOnlyboolean
  Set once, when the resource is created. Whether Oblique asks Okta only for the access to read the org. The Oblique app is installed with the scopes to manage groups and applications, so this keeps a connection read-only without editing the app’s grants in Okta. Set when the integration is created and not editable afterwards: create the integration again to change it.
  
  Oblique won’t write to Okta while this is set, but it is Oblique’s own setting rather than a limit Okta enforces: the app keeps the scopes it was installed with. Revoke the management scopes from the Oblique app in Okta for a limit the org enforces, which Oblique reports the same way, by leaving manage_resources false.
  
  A connection that leaves this unset can still be read-only, when the Oblique app wasn’t granted those scopes. Either way, manage_resources reports whether the connection writes to Okta.
  ignoreUsersIgnoreUsers
  attributesUserAttribute[]required
  If provided, the integration will ignore users that have any of the given attributes set to this value. If multiple attributes are provided, the user will be ignored if any of their attributes match these rules. Custom attributes are supported.
  keystringrequired
  The key of the attribute. For example “department”.
  valuestringrequired
  The value of the attribute. For example “Engineering”.
- googleGoogle
  domainstringrequired
  The domain to query for groups and memberships.
  missingReportsScopesbooleanread-only
  Whether the connection is missing the Google OAuth scopes required to sync sign-in reports from the Google Workspace audit logs.
  connectedAccountEmailstringread-only
  The email of the Workspace administrator who authorized the connection.
  manageGroupsbooleanread-only
  Whether Oblique can manage the Workspace’s groups, creating them and changing their membership, which a resource in push mode needs. False when the administrator who authorized the connection approved reading the Workspace but not managing its groups.
- slackSlack
  teamIdstringrequired
  The team ID that has been configured for notifications.
  teamNamestringread-only
  The human readable name of the team that has been configured for notifications.
  channelIdsstring[]
  Channels to send notifications to.
  dmDisabledboolean
  Whether DM notifications are disabled. This is false by default.
  domainBaseUristringread-only
  The domain base URI of the Slack instance, including the schema. This is detected on creation and is not editable. For example: https://myworkspace.slack.com
  allowApprovalWorkflowboolean
  Whether reviewers can approve requests directly from the Slack notification. This is true by default.
- githubGitHub
  orgstringrequired
  The GitHub organization name to sync members and teams from. May be changed by the user on the GitHub side.
  orgIdstringread-only
  The immutable GitHub organization ID.
  installationIdstringread-only
  The GitHub App installation ID for this organization. Set by the installation callback.
  baseUristring
  Base URI of the GitHub instance, including the schema. Defaults to https://github.com. Set this to target GitHub Enterprise Cloud.
  displayNamestringread-only
  The human readable display name of the GitHub organization, synced from GitHub. Empty if the organization has not set one.
- cloudflareCloudflare
  accountIdstringread-only
  The ID of the Cloudflare account that members and policies are synced from. Determined by the account the admin grants access to when connecting, and not editable afterwards.
  accountNamestringread-only
  The human readable name of the Cloudflare account, read from Cloudflare when the integration is connected. Empty if Cloudflare reports the account without a name.
- notionNotion
  workspaceIdstringread-only
  The ID of the Notion workspace that members are synced from. Determined by the workspace the admin grants access to when connecting, and not editable afterwards.
  workspaceNamestringread-only
  The human readable name of the Notion workspace, read from Notion when the integration is connected. Empty if Notion reports the workspace without a name.
- linearLinear
  workspaceIdstringread-only
  The ID of the Linear workspace that members and teams are synced from. Determined by the workspace the admin grants access to when connecting, and not editable afterwards.
  workspaceNamestringread-only
  The human readable name of the Linear workspace, read from Linear when the integration is connected.
  uriKeystringread-only
  The URL key of the Linear workspace, used to build links into Linear. For example oblique for https://linear.app/oblique.
- anthropicAnthropic
  apiKeystringrequired
  The Admin API key used to read the organization’s members and workspaces. Required when the integration is created, and never returned by the API. Provide it again to rotate the key.
  organizationIdstringread-only
  The ID of the Anthropic organization that members and workspaces are synced from. Determined by the organization the API key belongs to, and not editable afterwards.
  organizationNamestringread-only
  The human readable name of the Anthropic organization, read from Anthropic when the integration is connected.
- posthogPostHog
  organizationIdstringread-only
  The ID of the PostHog organization that members and projects are synced from. Determined by the organization the admin grants access to when connecting, and not editable afterwards.
  organizationNamestringread-only
  The human readable name of the PostHog organization, read from PostHog when the integration is connected.
  baseUristringread-only
  The base URI of the PostHog region the organization lives in. Either https://us.posthog.com or https://eu.posthog.com.
- bamboohrBambooHR
  subdomainstringread-only
  The subdomain of the BambooHR account that employees are synced from: “acme” for an account reached at https://acme.bamboohr.com. BambooHR serves each account’s authorization endpoints from its own subdomain, so this is provided by the admin when connecting and is not editable afterwards.
userCountinteger (int32)read-only
The number of users that the system contains.
resourceCountinteger (int32)read-only
The number of resources that the system manages.
accountCountinteger (int32)read-only
The number of accounts the integration reports, deactivated accounts included. Matches what ListIntegrationAccounts returns for it.
attributeCountinteger (int32)read-only
The number of user attributes the integration syncs.
resourcePushCountinteger (int32)read-only
The number of resources that have been pushed to the integration.
resourcePullCountinteger (int32)read-only
The number of resources that have been pulled from the integration.
supportsPushbooleanread-only
Whether the integration can push to at least one of the objects it reports. Some of its write capabilities may still be unavailable. Determined by the access the integration was granted, and re-evaluated on every sync.
syncsUserAttributesbooleanread-only
Whether the integration is a source of directory users and the attributes held against them. Only such an integration may be named the source of a core attribute. Reported by the integration’s syncer, so it is unset until the integration has synced once.
needsReauthbooleanread-only
Whether the integration is missing access that Oblique asks for, which is granted by reconnecting it. Re-evaluated on every sync.

Response

200Integration

Integrations connect Oblique with external systems in your organization. Oblique can both pull information from and push access decisions back to integrations.

namestring
Assigned by Oblique. Name of the integration of the format integrations/{integration}.
managementManagement
How this integration is managed. Set automatically by the server based on the calling client. Omitted from responses when the integration is manually managed (the default).
- managerstring
  Allowed values: TERRAFORM
  How the API object is managed. Set automatically by the server based on the caller: Terraform clients produce TERRAFORM; for all other clients the management field is left unset on the response.
- repoUristring
  URI of the VCS repository that holds the Terraform configuration for this API object. Populated by the Oblique Terraform provider.
- repoDirstring
  Optionally, the subdirectory within repo_uri that holds the Terraform configuration for this API object. Populated by the Oblique Terraform provider.
displayNamestring
A human readable name of the integration. For example “Okta Test”.
createTimestring (date-time)read-only
Create and update timestamps.
updateTimestring (date-time)read-only
deleteTimestring (date-time)read-only
The time when the integration was deleted.
One of
- oktaOkta
  apiTokenstring
  The API token to use when making calls to Okta. Either this or OAuth2 client credentials must be provided when the integration is created.
  clientIdstring
  The client ID issued when the Oblique app is installed from the Okta Integration Network catalog. Must be provided together with client_secret, and can’t be combined with api_token: an integration authenticates either with OAuth2 client credentials or with an API token.
  clientSecretstring
  The client secret issued alongside client_id when the Oblique app is installed. Must be provided together with client_id, and can’t be combined with api_token. Never returned by the API; provide it again to rotate.
  domainBaseUristringrequired
  Full base URL of the Okta domain, including the schema. For example: https://dev-45752433-admin.okta.com
  displayNamestring
  Will be removed in the future in favor of top level display_name.
  organizationIdstringread-only
  The tenant ID of the Okta organization. This is detected on first creation of the integration and is not editable.
  manageResourcesbooleanread-only
  Whether Oblique manages the org’s groups and applications, creating groups and changing membership and assignments, which a resource in push mode needs. False when the connection is read-only, either because read_only holds Oblique to reading or because the Oblique app in Okta wasn’t granted the scopes to manage them. Either way the connection imports users, groups, applications, and their memberships, and writes nothing back to Okta.
  readOnlyboolean
  Set once, when the resource is created. Whether Oblique asks Okta only for the access to read the org. The Oblique app is installed with the scopes to manage groups and applications, so this keeps a connection read-only without editing the app’s grants in Okta. Set when the integration is created and not editable afterwards: create the integration again to change it.
  
  Oblique won’t write to Okta while this is set, but it is Oblique’s own setting rather than a limit Okta enforces: the app keeps the scopes it was installed with. Revoke the management scopes from the Oblique app in Okta for a limit the org enforces, which Oblique reports the same way, by leaving manage_resources false.
  
  A connection that leaves this unset can still be read-only, when the Oblique app wasn’t granted those scopes. Either way, manage_resources reports whether the connection writes to Okta.
  ignoreUsersIgnoreUsers
  attributesUserAttribute[]required
  If provided, the integration will ignore users that have any of the given attributes set to this value. If multiple attributes are provided, the user will be ignored if any of their attributes match these rules. Custom attributes are supported.
  keystringrequired
  The key of the attribute. For example “department”.
  valuestringrequired
  The value of the attribute. For example “Engineering”.
- googleGoogle
  domainstringrequired
  The domain to query for groups and memberships.
  missingReportsScopesbooleanread-only
  Whether the connection is missing the Google OAuth scopes required to sync sign-in reports from the Google Workspace audit logs.
  connectedAccountEmailstringread-only
  The email of the Workspace administrator who authorized the connection.
  manageGroupsbooleanread-only
  Whether Oblique can manage the Workspace’s groups, creating them and changing their membership, which a resource in push mode needs. False when the administrator who authorized the connection approved reading the Workspace but not managing its groups.
- slackSlack
  teamIdstringrequired
  The team ID that has been configured for notifications.
  teamNamestringread-only
  The human readable name of the team that has been configured for notifications.
  channelIdsstring[]
  Channels to send notifications to.
  dmDisabledboolean
  Whether DM notifications are disabled. This is false by default.
  domainBaseUristringread-only
  The domain base URI of the Slack instance, including the schema. This is detected on creation and is not editable. For example: https://myworkspace.slack.com
  allowApprovalWorkflowboolean
  Whether reviewers can approve requests directly from the Slack notification. This is true by default.
- githubGitHub
  orgstringrequired
  The GitHub organization name to sync members and teams from. May be changed by the user on the GitHub side.
  orgIdstringread-only
  The immutable GitHub organization ID.
  installationIdstringread-only
  The GitHub App installation ID for this organization. Set by the installation callback.
  baseUristring
  Base URI of the GitHub instance, including the schema. Defaults to https://github.com. Set this to target GitHub Enterprise Cloud.
  displayNamestringread-only
  The human readable display name of the GitHub organization, synced from GitHub. Empty if the organization has not set one.
- cloudflareCloudflare
  accountIdstringread-only
  The ID of the Cloudflare account that members and policies are synced from. Determined by the account the admin grants access to when connecting, and not editable afterwards.
  accountNamestringread-only
  The human readable name of the Cloudflare account, read from Cloudflare when the integration is connected. Empty if Cloudflare reports the account without a name.
- notionNotion
  workspaceIdstringread-only
  The ID of the Notion workspace that members are synced from. Determined by the workspace the admin grants access to when connecting, and not editable afterwards.
  workspaceNamestringread-only
  The human readable name of the Notion workspace, read from Notion when the integration is connected. Empty if Notion reports the workspace without a name.
- linearLinear
  workspaceIdstringread-only
  The ID of the Linear workspace that members and teams are synced from. Determined by the workspace the admin grants access to when connecting, and not editable afterwards.
  workspaceNamestringread-only
  The human readable name of the Linear workspace, read from Linear when the integration is connected.
  uriKeystringread-only
  The URL key of the Linear workspace, used to build links into Linear. For example oblique for https://linear.app/oblique.
- anthropicAnthropic
  apiKeystringrequired
  The Admin API key used to read the organization’s members and workspaces. Required when the integration is created, and never returned by the API. Provide it again to rotate the key.
  organizationIdstringread-only
  The ID of the Anthropic organization that members and workspaces are synced from. Determined by the organization the API key belongs to, and not editable afterwards.
  organizationNamestringread-only
  The human readable name of the Anthropic organization, read from Anthropic when the integration is connected.
- posthogPostHog
  organizationIdstringread-only
  The ID of the PostHog organization that members and projects are synced from. Determined by the organization the admin grants access to when connecting, and not editable afterwards.
  organizationNamestringread-only
  The human readable name of the PostHog organization, read from PostHog when the integration is connected.
  baseUristringread-only
  The base URI of the PostHog region the organization lives in. Either https://us.posthog.com or https://eu.posthog.com.
- bamboohrBambooHR
  subdomainstringread-only
  The subdomain of the BambooHR account that employees are synced from: “acme” for an account reached at https://acme.bamboohr.com. BambooHR serves each account’s authorization endpoints from its own subdomain, so this is provided by the admin when connecting and is not editable afterwards.
userCountinteger (int32)read-only
The number of users that the system contains.
resourceCountinteger (int32)read-only
The number of resources that the system manages.
accountCountinteger (int32)read-only
The number of accounts the integration reports, deactivated accounts included. Matches what ListIntegrationAccounts returns for it.
attributeCountinteger (int32)read-only
The number of user attributes the integration syncs.
resourcePushCountinteger (int32)read-only
The number of resources that have been pushed to the integration.
resourcePullCountinteger (int32)read-only
The number of resources that have been pulled from the integration.
supportsPushbooleanread-only
Whether the integration can push to at least one of the objects it reports. Some of its write capabilities may still be unavailable. Determined by the access the integration was granted, and re-evaluated on every sync.
syncsUserAttributesbooleanread-only
Whether the integration is a source of directory users and the attributes held against them. Only such an integration may be named the source of a core attribute. Reported by the integration’s syncer, so it is unset until the integration has synced once.
needsReauthbooleanread-only
Whether the integration is missing access that Oblique asks for, which is granted by reconnecting it. Re-evaluated on every sync.

Errors

Status	Meaning
`400`	Malformed request
`401`	Missing or invalid API key
`403`	Not allowed for this API key
`404`	Not found
`429`	Too many requests
`500`	Internal server error