UpdateRequest

PATCH/api/v1/requests/{request}

Update a change request: approve it, deny it, or change what it asks for.

Example request

US

curl -X PATCH \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "description": "string", "reviewers": [ "string" ], "applyBehavior": "AUTOMATIC", "recommendations": [ "string" ] }' \
  "https://us.oblique.security/api/v1/requests/{request}?updateMask=description,reviewers,applyBehavior,recommendations"

Set OBLIQUE_API_KEY to your API key.

Europe

curl -X PATCH \
  -H "Authorization: Bearer ${OBLIQUE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{ "description": "string", "reviewers": [ "string" ], "applyBehavior": "AUTOMATIC", "recommendations": [ "string" ] }' \
  "https://eu.oblique.security/api/v1/requests/{request}?updateMask=description,reviewers,applyBehavior,recommendations"

Set OBLIQUE_API_KEY to your API key.

Path parameters

• request.namestringrequired

  Assigned by Oblique. Name of the request of the format requests/{id}.

Query parameters

• updateMaskstring (field-mask)

  The list of fields to update.

Request body

• createTimestring (date-time)read-only

  Create and update timestamps.

• updateTimestring (date-time)read-only
• displayNamestringread-only

  Short title of the request to display in an inbox or at the top of a request page. Generated by the server from the request’s contents; any value supplied on input is ignored.

• descriptionstring

  Longer description.

• requesterstringread-only

  The original creator of the request. Inferred by the user’s authenticated state.

  Format: users/{user}

• reviewersstring[]

  List of users set to review the request.

  The reviewers field is set through this value on creation only. After, use the EditRequestReviewers method to update the reviewers.

  Use PreviewSuggestedReviewers to determine who to set as reviewers when creating a request.

  Format: users/{user} or users/me

• One of

  teamUpdate

  • teamUpdateRequestTeamUpdate
    • teamstringrequired

      The team to update.

      The owner of this team is required to approve the request.

      Format: teams/{team}

    • membersCreatestring[]

      Members to add to the team.

      Format: users/{user} or users/me

    • membersDeletestring[]

      Members to remove from the team.

      Format: users/{user} or users/me

  teamCreate

  • teamCreateRequestTeamCreate
    • displayNamestringrequired

      Display name for the new team.

    • usersstring[]

      Initial members to add to the team.

      Format: users/{user} or users/me

    • teamDescriptionstring

      Description for the new team.

    • ownersstring[]

      The owners of the team.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • teamstringread-only

      The team that was created.

  teamDelete

  • teamDeleteRequestTeamDelete
    • teamstringrequired

      The team to delete.

      The owner of this team is required to approve the request.

      Format: teams/{team}

  resourceUpdate

  • resourceUpdateRequestResourceUpdate
    • resourcestringrequired

      The resource whose access is being changed.

      Format: resources/{resource}

    • entitlementsCreateEntitlement[]

      A set of entitlements to create.

      • subjectstringrequired

        Set once, when the resource is created. The subject that will be granted access to the resource. An account subject holds the access itself, rather than the directory user behind it, and can only be referenced by an entitlement the integration reported.

        Format: users/{user}, users/me, teams/{team}, groups/{group}, or integrations/{integration}/accounts/{account}.

      • One of

        expireTime

        • expireTimestring (date-time)

          If present, when this access expires.

        ttl

        • ttlstring (duration)

          If present, the TTL for the entitlement.

      • rolesAddstring[]

        Roles to grant the subject on the resource, on top of those it already holds. Each role must belong to the same integration as the resource, and a role the subject already holds is a no-op rather than an error.

      • rolesRemovestring[]

        Roles to take away from the subject on the resource. Each role must belong to the same integration as the resource. Cannot overlap with role_add.

        A role the subject doesn’t hold is a no-op at request time, to accommdate bulk requests where some subjects may not hold the role in question. Any request that results in an invalid enforcement state will be rejected at apply time, so it’s up to the caller to ensure that e.g. requests on resources with EXACTLY_ONE role allowed removes and adds exactly one role in the same pass.

    • entitlementsUpdateEntitlement[]

      A set of entitlements to update.

      • subjectstringrequired

        Set once, when the resource is created. The subject that will be granted access to the resource. An account subject holds the access itself, rather than the directory user behind it, and can only be referenced by an entitlement the integration reported.

        Format: users/{user}, users/me, teams/{team}, groups/{group}, or integrations/{integration}/accounts/{account}.

      • One of

        expireTime

        • expireTimestring (date-time)

          If present, when this access expires.

        ttl

        • ttlstring (duration)

          If present, the TTL for the entitlement.

      • rolesAddstring[]

        Roles to grant the subject on the resource, on top of those it already holds. Each role must belong to the same integration as the resource, and a role the subject already holds is a no-op rather than an error.

      • rolesRemovestring[]

        Roles to take away from the subject on the resource. Each role must belong to the same integration as the resource. Cannot overlap with role_add.

        A role the subject doesn’t hold is a no-op at request time, to accommdate bulk requests where some subjects may not hold the role in question. Any request that results in an invalid enforcement state will be rejected at apply time, so it’s up to the caller to ensure that e.g. requests on resources with EXACTLY_ONE role allowed removes and adds exactly one role in the same pass.

    • entitlementsDeletestring[]

      Subjects to delete from the resource.

      Format: users/{user}, users/me, teams/{team}, groups/{group}, or integrations/{integration}/accounts/{account}.

  listingRoleUpdate

  • listingRoleUpdateRequestListingRoleUpdate
    • listingstringread-only

      The inferred listing to be updated based on the roles being granted.

    • rolesCreateRoleGrant[]

      Entitlements to grant.

      • listingRolestringrequired

        Format: listings/{listing}/roles/{role}

        If multiple roles are provided, they must be for the same listing.

      • subjectstringrequired

        A user, team, or group.

        Format: users/{user}, users/me, teams/{team}, or groups/{group}

      • One of

        expireTime

        • expireTimestring (date-time)

        ttl

        • ttlstring (duration)
    • rolesDeleteRoleGrant[]

      A list of subjects to remove from roles.

      • listingRolestringrequired

        Format: listings/{listing}/roles/{role}

        If multiple roles are provided, they must be for the same listing.

      • subjectstringrequired

        A user, team, or group.

        Format: users/{user}, users/me, teams/{team}, or groups/{group}

      • One of

        expireTime

        • expireTimestring (date-time)

        ttl

        • ttlstring (duration)
    • rolesUpdateRoleGrant[]

      Entitlements to update.

      • listingRolestringrequired

        Format: listings/{listing}/roles/{role}

        If multiple roles are provided, they must be for the same listing.

      • subjectstringrequired

        A user, team, or group.

        Format: users/{user}, users/me, teams/{team}, or groups/{group}

      • One of

        expireTime

        • expireTimestring (date-time)

        ttl

        • ttlstring (duration)

  teamOwnerUpdate

  • teamOwnerUpdateRequestTeamOwnerUpdate
    • teamstringrequired

      The team whose owners will be updated.

      Format: teams/{team}

    • ownersCreatestring[]

      Owners to add to the team.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • ownersDeletestring[]

      Owners to remove from the team.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

  groupOwnerUpdate

  • groupOwnerUpdateRequestGroupOwnerUpdate
    • groupstringrequired

      The group whose owners will be updated.

      Format: groups/{group}

    • ownersCreatestring[]

      Owners to add to the group.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • ownersDeletestring[]

      Owners to remove from the group.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

  listingOwnerUpdate

  • listingOwnerUpdateRequestListingOwnerUpdate
    • listingstringrequired

      The listing whose owners will be updated.

      Format: listings/{listing}

    • ownersCreatestring[]

      Owners to add to the listing.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • ownersDeletestring[]

      Owners to remove from the listing.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

  resourceOwnerUpdate

  • resourceOwnerUpdateRequestResourceOwnerUpdate
    • resourcestringrequired

      The resource whose owners will be updated.

      Format: resources/{resource}

    • ownersCreatestring[]

      Owners to add to the resource.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}.

    • ownersDeletestring[]

      Owners to remove from the resource.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}.

• applicableListingRolePoliciesstring[]read-only

  Listing role policies that led to this request being approved, if any.

• applyBehaviorstring
  Allowed values: AUTOMATIC

  Apply behavior can be used to control how this request is applied. The default requires the requester or an approver to merge manually after the request is approved.

• statestringread-only
  Allowed values: OPEN, APPROVED, APPLIED, CLOSED
• statusRequestStatusread-only

  Computed status of the request.

  • appliedTimestring (date-time)read-only

    The time the request was merged. Will be empty if the request is not merged.

  • closedTimestring (date-time)read-only

    The time the request was closed. Will be empty if the request is not closed.

  • approversApprover[]read-only

    List of users who have approved the request.

    • userstringread-only

      The user who approved the request.

      Format: users/{user}

    • approvedTimestring (date-time)read-only

      The time the user approved the request. Will be empty if the user has not approved the request.

• recommendationsstring[]

  Recommendations that this request was created to act on. May only be set when the request is created.

  When the request is applied, any of these recommendations that are still open will be marked as applied.

  Format: recommendations/{recommendation}

Response

200Request

A request represents a user’s proposal for a change to the system that requires approval from one or more reviewers.

• namestring

  Assigned by Oblique. Name of the request of the format requests/{id}.

• createTimestring (date-time)read-only

  Create and update timestamps.

• updateTimestring (date-time)read-only
• displayNamestringread-only

  Short title of the request to display in an inbox or at the top of a request page. Generated by the server from the request’s contents; any value supplied on input is ignored.

• descriptionstring

  Longer description.

• requesterstringread-only

  The original creator of the request. Inferred by the user’s authenticated state.

  Format: users/{user}

• reviewersstring[]

  List of users set to review the request.

  The reviewers field is set through this value on creation only. After, use the EditRequestReviewers method to update the reviewers.

  Use PreviewSuggestedReviewers to determine who to set as reviewers when creating a request.

  Format: users/{user} or users/me

• One of

  teamUpdate

  • teamUpdateRequestTeamUpdate
    • teamstringrequired

      The team to update.

      The owner of this team is required to approve the request.

      Format: teams/{team}

    • membersCreatestring[]

      Members to add to the team.

      Format: users/{user} or users/me

    • membersDeletestring[]

      Members to remove from the team.

      Format: users/{user} or users/me

  teamCreate

  • teamCreateRequestTeamCreate
    • displayNamestringrequired

      Display name for the new team.

    • usersstring[]

      Initial members to add to the team.

      Format: users/{user} or users/me

    • teamDescriptionstring

      Description for the new team.

    • ownersstring[]

      The owners of the team.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • teamstringread-only

      The team that was created.

  teamDelete

  • teamDeleteRequestTeamDelete
    • teamstringrequired

      The team to delete.

      The owner of this team is required to approve the request.

      Format: teams/{team}

  resourceUpdate

  • resourceUpdateRequestResourceUpdate
    • resourcestringrequired

      The resource whose access is being changed.

      Format: resources/{resource}

    • entitlementsCreateEntitlement[]

      A set of entitlements to create.

      • subjectstringrequired

        Set once, when the resource is created. The subject that will be granted access to the resource. An account subject holds the access itself, rather than the directory user behind it, and can only be referenced by an entitlement the integration reported.

        Format: users/{user}, users/me, teams/{team}, groups/{group}, or integrations/{integration}/accounts/{account}.

      • One of

        expireTime

        • expireTimestring (date-time)

          If present, when this access expires.

        ttl

        • ttlstring (duration)

          If present, the TTL for the entitlement.

      • rolesAddstring[]

        Roles to grant the subject on the resource, on top of those it already holds. Each role must belong to the same integration as the resource, and a role the subject already holds is a no-op rather than an error.

      • rolesRemovestring[]

        Roles to take away from the subject on the resource. Each role must belong to the same integration as the resource. Cannot overlap with role_add.

        A role the subject doesn’t hold is a no-op at request time, to accommdate bulk requests where some subjects may not hold the role in question. Any request that results in an invalid enforcement state will be rejected at apply time, so it’s up to the caller to ensure that e.g. requests on resources with EXACTLY_ONE role allowed removes and adds exactly one role in the same pass.

    • entitlementsUpdateEntitlement[]

      A set of entitlements to update.

      • subjectstringrequired

        Set once, when the resource is created. The subject that will be granted access to the resource. An account subject holds the access itself, rather than the directory user behind it, and can only be referenced by an entitlement the integration reported.

        Format: users/{user}, users/me, teams/{team}, groups/{group}, or integrations/{integration}/accounts/{account}.

      • One of

        expireTime

        • expireTimestring (date-time)

          If present, when this access expires.

        ttl

        • ttlstring (duration)

          If present, the TTL for the entitlement.

      • rolesAddstring[]

        Roles to grant the subject on the resource, on top of those it already holds. Each role must belong to the same integration as the resource, and a role the subject already holds is a no-op rather than an error.

      • rolesRemovestring[]

        Roles to take away from the subject on the resource. Each role must belong to the same integration as the resource. Cannot overlap with role_add.

        A role the subject doesn’t hold is a no-op at request time, to accommdate bulk requests where some subjects may not hold the role in question. Any request that results in an invalid enforcement state will be rejected at apply time, so it’s up to the caller to ensure that e.g. requests on resources with EXACTLY_ONE role allowed removes and adds exactly one role in the same pass.

    • entitlementsDeletestring[]

      Subjects to delete from the resource.

      Format: users/{user}, users/me, teams/{team}, groups/{group}, or integrations/{integration}/accounts/{account}.

  listingRoleUpdate

  • listingRoleUpdateRequestListingRoleUpdate
    • listingstringread-only

      The inferred listing to be updated based on the roles being granted.

    • rolesCreateRoleGrant[]

      Entitlements to grant.

      • listingRolestringrequired

        Format: listings/{listing}/roles/{role}

        If multiple roles are provided, they must be for the same listing.

      • subjectstringrequired

        A user, team, or group.

        Format: users/{user}, users/me, teams/{team}, or groups/{group}

      • One of

        expireTime

        • expireTimestring (date-time)

        ttl

        • ttlstring (duration)
    • rolesDeleteRoleGrant[]

      A list of subjects to remove from roles.

      • listingRolestringrequired

        Format: listings/{listing}/roles/{role}

        If multiple roles are provided, they must be for the same listing.

      • subjectstringrequired

        A user, team, or group.

        Format: users/{user}, users/me, teams/{team}, or groups/{group}

      • One of

        expireTime

        • expireTimestring (date-time)

        ttl

        • ttlstring (duration)
    • rolesUpdateRoleGrant[]

      Entitlements to update.

      • listingRolestringrequired

        Format: listings/{listing}/roles/{role}

        If multiple roles are provided, they must be for the same listing.

      • subjectstringrequired

        A user, team, or group.

        Format: users/{user}, users/me, teams/{team}, or groups/{group}

      • One of

        expireTime

        • expireTimestring (date-time)

        ttl

        • ttlstring (duration)

  teamOwnerUpdate

  • teamOwnerUpdateRequestTeamOwnerUpdate
    • teamstringrequired

      The team whose owners will be updated.

      Format: teams/{team}

    • ownersCreatestring[]

      Owners to add to the team.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • ownersDeletestring[]

      Owners to remove from the team.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

  groupOwnerUpdate

  • groupOwnerUpdateRequestGroupOwnerUpdate
    • groupstringrequired

      The group whose owners will be updated.

      Format: groups/{group}

    • ownersCreatestring[]

      Owners to add to the group.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • ownersDeletestring[]

      Owners to remove from the group.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

  listingOwnerUpdate

  • listingOwnerUpdateRequestListingOwnerUpdate
    • listingstringrequired

      The listing whose owners will be updated.

      Format: listings/{listing}

    • ownersCreatestring[]

      Owners to add to the listing.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

    • ownersDeletestring[]

      Owners to remove from the listing.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}

  resourceOwnerUpdate

  • resourceOwnerUpdateRequestResourceOwnerUpdate
    • resourcestringrequired

      The resource whose owners will be updated.

      Format: resources/{resource}

    • ownersCreatestring[]

      Owners to add to the resource.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}.

    • ownersDeletestring[]

      Owners to remove from the resource.

      Format: users/{user}, users/me, groups/{group}, or teams/{team}.

• applicableListingRolePoliciesstring[]read-only

  Listing role policies that led to this request being approved, if any.

• applyBehaviorstring
  Allowed values: AUTOMATIC

  Apply behavior can be used to control how this request is applied. The default requires the requester or an approver to merge manually after the request is approved.

• statestringread-only
  Allowed values: OPEN, APPROVED, APPLIED, CLOSED
• statusRequestStatusread-only

  Computed status of the request.

  • appliedTimestring (date-time)read-only

    The time the request was merged. Will be empty if the request is not merged.

  • closedTimestring (date-time)read-only

    The time the request was closed. Will be empty if the request is not closed.

  • approversApprover[]read-only

    List of users who have approved the request.

    • userstringread-only

      The user who approved the request.

      Format: users/{user}

    • approvedTimestring (date-time)read-only

      The time the user approved the request. Will be empty if the user has not approved the request.

• recommendationsstring[]

  Recommendations that this request was created to act on. May only be set when the request is created.

  When the request is applied, any of these recommendations that are still open will be marked as applied.

  Format: recommendations/{recommendation}

Errors

Status	Meaning
400	Malformed request
401	Missing or invalid API key
403	Not allowed for this API key
404	Not found
429	Too many requests
500	Internal server error