Skip to content
Docs

ListResources

GET/api/v1/resources

List resources. Resources are the objects in external systems that users can be granted access to, such as Okta groups, Okta apps, or Google groups.

Example request

Section titled “Example request”
curl \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  "https://us.oblique.security/api/v1/resources"

Set OBLIQUE_API_KEY to your API key.

Query parameters

Section titled “Query parameters”
  • pageSizeinteger (int32)

    The maximum number of resources to return. This service may return fewer than this value.

  • pageTokenstring

    A page token, received from a previous ListResources call.

  • showDeletedboolean

    If true, include deleted resources in the response.

  • filterstring

    Filter that can be used to search for resources. Supported filters are:

    • integration - Search by the integration that the resource is associated with.
    • owner="users/{id}", owner="users/me", owner="teams/{id}", owner="groups/{id}" - Search by the owner of the resource. For users this includes transitive ownerships via a team or group.

    Filters can’t be combined.

Response

Section titled “Response”
200ListResourcesResponse
  • resourcesResource[]
    • namestring

      Assigned by Oblique. Name of the resource of the format resources/{id}.

    • displayNamestringrequired

      Display name of the resource.

    • descriptionstring

      Description of the resource.

    • integrationstringrequired

      The integration that this resource is associated with.

    • resourceIdstringread-only

      The identifier the integration uses for this resource.

      IDs are optional and opaque to clients. They are guarenteed to be unique within the scope of a single integration, but may overlap between integrations.

    • kindstringread-only

      A string representing the value of the metadata oneof. For example, cloudflare_user_group or cloudflare_resource_group.

    • resourceUristringread-only

      A link to the resource in the system that reported it, for example the member list of a Cloudflare user group. Empty for a resource whose integration reports no link for it.

    • createTimestring (date-time)read-only

      Create and update timestamps.

    • updateTimestring (date-time)read-only
    • deleteTimestring (date-time)read-only

      Resources can only be soft-deleted to preserve logs and history. If this field is present, the resource has been deleted and won’t be returned in lists.

    • managedStartTimestring (date-time)read-only

      The time when the resource was first switched to PUSH mode indicating when Oblique started managing the resource as the source of truth. Empty otherwise.

    • userCountinteger (int32)read-only

      The number of users that have either direct or indirect access to this resource.

      Note that this will move to status.user_count in the future.

    • syncModestring
      Allowed values: PULL, PUSH, PAUSED
    • supportsPushbooleanread-only

      Whether the integration that reported this resource can push to the object backing it. Determined by the access the integration was granted, and re-evaluated on every sync.

    • capabilitiesCapabilitiesread-only

      The changes Oblique can push to this resource, determined by the integration that reported it and re-evaluated on every sync alongside supports_push. Requests for changes the resource doesn’t support are rejected. Unset for a resource whose integration can’t push to it, which places no constraint on requests.

      • entitlementUpdatebooleanread-only

        Whether Oblique can change the roles an existing entitlement carries.

      • entitlementAddbooleanread-only

        Whether Oblique can grant access to a subject that holds none.

      • entitlementRemovebooleanread-only

        Whether Oblique can take a subject’s access away, including when an entitlement expires.

    • visibilityVisibility

      Who can view this resource. An unset visibility is equivalent to PUBLIC.

      • modestringrequired
        Allowed values: RESTRICTED, PUBLIC
      • audienceAudience

        Who has visibility into an object in addition to owners/admins. Ignored when mode = PUBLIC. Retained during mode changes so that users can toggle visibility modes without rebuilding the list every time.

        • usersstring[]

          Users named directly in the audience.

          Format: users/{user}

        • groupsstring[]

          Groups whose effective members are in the audience.

          Format: groups/{group}

        • teamsstring[]

          Teams whose effective members are in the audience.

          Format: teams/{team}

    • memberRulesMemberRule[]read-only

      The rules for each kind of member the resource can hold, as reported by the integration that owns it. A resource with rules only holds members of the kinds they name, each at the roles its rule allows.

      A resource holds another resource only through a rule for that resource’s kind. A resource without rules holds accounts alone, at any roles.

      • memberKindstringread-only

        The kind of member the rule covers.

        “account” covers the accounts the integration reports, which users, teams and groups hold the resource through. Any other value is a kind of resource from the same integration, named as that resource’s kind names it: the name of the field in Resource that holds it, such as “github_team”.

      • roleGroupsRoleGroup[]read-only

        The roles such a member can hold, in groups that each say how many of their roles an entitlement names. An entitlement can only name roles in one of the groups, and its count in each group must fall between the group’s min and max. A rule without groups places no constraint on roles.

        For example, a team holds a GitHub repository at exactly one permission, but never triage plus: a group of triage plus with a max of zero, and a group covering every other permission with a min and max of one.

        • roleIdsstring[]read-only

          The roles in the group. Empty covers every role the integration reports for the resource’s kind that no other group in the rule names.

        • mininteger (int32)read-only

          The fewest roles of the group an entitlement names.

        • maxinteger (int32)read-only

          The most roles of the group an entitlement names. Unset places no limit, and zero forbids the group’s roles.

      • minRolesinteger (int32)read-only

        The fewest roles such an entitlement names across all the groups. Zero places no minimum.

        For example, a person in a GitHub organization is an owner or a member at most, and holds any of the organization’s own roles besides, but always holds at least one role.

      • maxHeldinteger (int32)read-only

        The most resources of this resource’s kind such a member can hold at once. Zero places no limit.

    • One of

      • oktaGroupOktaGroup

        For groups/teams that are sourced from an integration, this field holds information about that object.

        • idstring

          The ID of the Okta group. Required when creating or updating a resource.

        • domainBaseUristring

          Full base URL of the Okta domain, including the schema. For example: https://dev-45752433-admin.okta.com

        • groupCreateNamestring

          If provided, the name of a group to be created in Okta. Rejected by CreateResource and UpdateResource.

        • groupCreateDescriptionstring

          If provided, the description of the group to be created in Okta. Rejected by CreateResource and UpdateResource.

        • groupRulesOktaGroupRule[]

          The set of rules that are applied to the group.

          • idstring

            The ID of the rule.

          • namestring

            The name of the rule.

        • appIdstring

          When the group is an APP_GROUP, this field will be set to the ID of the Okta app that the group is associated with.

        • typestring
          Allowed values: APP_GROUP, BUILT_IN, OKTA_GROUP
    • syncTimestring (date-time)read-only

      The last time this resource was synchronized successfully with its downstream.

    • statestringread-only
      Allowed values: SYNCING, ACTIVE, SUSPENDED, CREATING, RECALCULATING
  • nextPageTokenstring

    A token, which can be sent as page_token to retrieve the next page.

Errors

Section titled “Errors”
StatusMeaning
400Malformed request
401Missing or invalid API key
403Not allowed for this API key
404Not found
429Too many requests
500Internal server error