Skip to content
Docs

GetResource

GET/api/v1/resources/{resource}

Fetch a resource by name.

Example request

Section titled “Example request”
curl \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  "https://us.oblique.security/api/v1/resources/{resource}"

Set OBLIQUE_API_KEY to your API key.

Path parameters

Section titled “Path parameters”
  • namestringrequired

    Name of the resource of the format resources/{id}.

Response

Section titled “Response”
200Resource

A resource represents a managed resource in the system.

  • namestring

    Assigned by Oblique. Name of the resource of the format resources/{id}.

  • displayNamestringrequired

    Display name of the resource.

  • descriptionstring

    Description of the resource.

  • integrationstringrequired

    The integration that this resource is associated with.

  • resourceIdstringread-only

    The identifier the integration uses for this resource.

    IDs are optional and opaque to clients. They are guarenteed to be unique within the scope of a single integration, but may overlap between integrations.

  • kindstringread-only

    A string representing the value of the metadata oneof. For example, cloudflare_user_group or cloudflare_resource_group.

  • resourceUristringread-only

    A link to the resource in the system that reported it, for example the member list of a Cloudflare user group. Empty for a resource whose integration reports no link for it.

  • createTimestring (date-time)read-only

    Create and update timestamps.

  • updateTimestring (date-time)read-only
  • deleteTimestring (date-time)read-only

    Resources can only be soft-deleted to preserve logs and history. If this field is present, the resource has been deleted and won’t be returned in lists.

  • managedStartTimestring (date-time)read-only

    The time when the resource was first switched to PUSH mode indicating when Oblique started managing the resource as the source of truth. Empty otherwise.

  • userCountinteger (int32)read-only

    The number of users that have either direct or indirect access to this resource.

    Note that this will move to status.user_count in the future.

  • syncModestring
    Allowed values: PULL, PUSH, PAUSED
  • supportsPushbooleanread-only

    Whether the integration that reported this resource can push to the object backing it. Determined by the access the integration was granted, and re-evaluated on every sync.

  • capabilitiesCapabilitiesread-only

    The changes Oblique can push to this resource, determined by the integration that reported it and re-evaluated on every sync alongside supports_push. Requests for changes the resource doesn’t support are rejected. Unset for a resource whose integration can’t push to it, which places no constraint on requests.

    • entitlementUpdatebooleanread-only

      Whether Oblique can change the roles an existing entitlement carries.

    • entitlementAddbooleanread-only

      Whether Oblique can grant access to a subject that holds none.

    • entitlementRemovebooleanread-only

      Whether Oblique can take a subject’s access away, including when an entitlement expires.

  • visibilityVisibility

    Who can view this resource. An unset visibility is equivalent to PUBLIC.

    • modestringrequired
      Allowed values: RESTRICTED, PUBLIC
    • audienceAudience

      Who has visibility into an object in addition to owners/admins. Ignored when mode = PUBLIC. Retained during mode changes so that users can toggle visibility modes without rebuilding the list every time.

      • usersstring[]

        Users named directly in the audience.

        Format: users/{user}

      • groupsstring[]

        Groups whose effective members are in the audience.

        Format: groups/{group}

      • teamsstring[]

        Teams whose effective members are in the audience.

        Format: teams/{team}

  • memberRulesMemberRule[]read-only

    The rules for each kind of member the resource can hold, as reported by the integration that owns it. A resource with rules only holds members of the kinds they name, each at the roles its rule allows.

    A resource holds another resource only through a rule for that resource’s kind. A resource without rules holds accounts alone, at any roles.

    • memberKindstringread-only

      The kind of member the rule covers.

      “account” covers the accounts the integration reports, which users, teams and groups hold the resource through. Any other value is a kind of resource from the same integration, named as that resource’s kind names it: the name of the field in Resource that holds it, such as “github_team”.

    • roleGroupsRoleGroup[]read-only

      The roles such a member can hold, in groups that each say how many of their roles an entitlement names. An entitlement can only name roles in one of the groups, and its count in each group must fall between the group’s min and max. A rule without groups places no constraint on roles.

      For example, a team holds a GitHub repository at exactly one permission, but never triage plus: a group of triage plus with a max of zero, and a group covering every other permission with a min and max of one.

      • roleIdsstring[]read-only

        The roles in the group. Empty covers every role the integration reports for the resource’s kind that no other group in the rule names.

      • mininteger (int32)read-only

        The fewest roles of the group an entitlement names.

      • maxinteger (int32)read-only

        The most roles of the group an entitlement names. Unset places no limit, and zero forbids the group’s roles.

    • minRolesinteger (int32)read-only

      The fewest roles such an entitlement names across all the groups. Zero places no minimum.

      For example, a person in a GitHub organization is an owner or a member at most, and holds any of the organization’s own roles besides, but always holds at least one role.

    • maxHeldinteger (int32)read-only

      The most resources of this resource’s kind such a member can hold at once. Zero places no limit.

  • One of

    • oktaGroupOktaGroup

      For groups/teams that are sourced from an integration, this field holds information about that object.

      • idstring

        The ID of the Okta group. Required when creating or updating a resource.

      • domainBaseUristring

        Full base URL of the Okta domain, including the schema. For example: https://dev-45752433-admin.okta.com

      • groupCreateNamestring

        If provided, the name of a group to be created in Okta. Rejected by CreateResource and UpdateResource.

      • groupCreateDescriptionstring

        If provided, the description of the group to be created in Okta. Rejected by CreateResource and UpdateResource.

      • groupRulesOktaGroupRule[]

        The set of rules that are applied to the group.

        • idstring

          The ID of the rule.

        • namestring

          The name of the rule.

      • appIdstring

        When the group is an APP_GROUP, this field will be set to the ID of the Okta app that the group is associated with.

      • typestring
        Allowed values: APP_GROUP, BUILT_IN, OKTA_GROUP
  • syncTimestring (date-time)read-only

    The last time this resource was synchronized successfully with its downstream.

  • statestringread-only
    Allowed values: SYNCING, ACTIVE, SUSPENDED, CREATING, RECALCULATING

Errors

Section titled “Errors”
StatusMeaning
400Malformed request
401Missing or invalid API key
403Not allowed for this API key
404Not found
429Too many requests
500Internal server error