ListListingRoleEffectiveSubjects

GET/api/v1/listings/{listing}/roles/{role}/effectivesubjects

Determine the access a user, group, or team has to a ListingRole.

Example request

US
Europe

curl \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  "https://us.oblique.security/api/v1/listings/{listing}/roles/{role}/effectivesubjects"

Set OBLIQUE_API_KEY to your API key.

curl \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  "https://eu.oblique.security/api/v1/listings/{listing}/roles/{role}/effectivesubjects"

Set OBLIQUE_API_KEY to your API key.

Path parameters

parentstringrequired
The parent of the effective subjects. Can also be listings/-/roles/- to list all effective subjects for all listing roles, or listings/{listing}/roles/- to list all effective subjects for all roles in a listing. If listings/{listing}/roles/- is used, all effective subjects for deleted roles are omitted, and a filter must be supplied.

Format: listings/{listing}/roles/{role}

Query parameters

pageSizeinteger (int32)
The maximum number of effective subjects to return. This service may return fewer than this value.
pageTokenstring
A page token, received from a previous ListListingRoleEffectiveSubjects call.
filterstring
Filter that can be used to search for effective subjects by values other than the parent. Currently supports filtering by subject.
- filter=subject="users/{user}" or filter=subject="users/me"
- filter=subject="teams/{team}"
- filter=subject="groups/{group}"
When providing a filter, parent must be the value listings/-/roles/- to indicate listing across listings and roles.
showDeletedboolean
If true, the response will include subjects in unspecified parent resources that have been deleted. It has no effect unless the parent is of the form listings/-/roles/- or listings/{listing}/roles/-.

Response

200ListListingRoleEffectiveSubjectsResponse

listingRoleEffectiveSubjectsListingRoleEffectiveSubject[]
- namestring
  Assigned by Oblique. Name of the effective subject of the format listings/{listing}/roles/{role}/effectivesubjects/{effective_subject}.
- createTimestring (date-time)read-only
  When the effective access was created.
- updateTimestring (date-time)read-only
  When the effective access was last updated.
- expireTimestring (date-time)read-only
  The computed expiry of this access. This is the minimum expiry of all of the via_resources for each resource that cause the subject to be part of the listing role.
- subjectstringread-only
  The user, team, or group that has effective access to the listing role.
- viaResourcesViaResource[]read-only
  - resourcestringread-only
    The resource that grants this access.
  - viaGroupsViaGroup[]read-only
    - groupstringread-only
    - createTimestring (date-time)read-only
      When the access via the group was granted.
    - expireTimestring (date-time)read-only
      When the access via this group expires.
    - entitlementstringread-only
      The entitlement that grants this access.
  - viaTeamsViaTeam[]read-only
    - teamstringread-only
    - createTimestring (date-time)read-only
      When the access via the team was granted.
    - expireTimestring (date-time)read-only
      When the access via the team expires.
    - entitlementstringread-only
      The entitlement that grants this access.
  - directDirectread-only
    - createTimestring (date-time)read-only
      When the direct access was granted.
    - expireTimestring (date-time)read-only
      When the direct access expires.
    - entitlementstringread-only
      The entitlement that grants this access.
  - pathsPath[]read-only
    Every path from the subject to this resource, each an ordered list of hops ending at the resource. A path can be any number of hops long when resources are nested inside each other, so this describes access that the via_groups, via_teams, and direct summaries above cannot represent, since those only name the hop closest to the subject.
    - partsPathPart[]read-only
      The hops from the subject to the resource, in order. The last is always the resource itself, so a path of one hop is access held directly.
      - resourcestringread-only
        The resource this hop reaches, or the group or team the access comes through.
      - createTimestring (date-time)read-only
        When the access over this hop was granted.
      - expireTimestring (date-time)read-only
        When the access over this hop expires. A path grants access only while every hop on it is live, so the path expires with its earliest hop.
      - entitlementstringread-only
        The entitlement that grants this hop. Revoking it breaks the whole path.
nextPageTokenstring
A token, which can be sent as page_token to retrieve the next page.

Errors

Status	Meaning
`400`	Malformed request
`401`	Missing or invalid API key
`403`	Not allowed for this API key
`404`	Not found
`429`	Too many requests
`500`	Internal server error