Tasks
Tasks
Tasks
Get
Create Grant Task
Create Offboarding Task
Create Revoke Task
List
App Entitlement Reference
This object references an app entitlement's ID and AppID.
ShowShow
The ID of the Entitlement.
The ID of the App this entitlement belongs to.
Approval
The Approval message.
This message contains a oneof named typ. Only a single field of the following list may be set at a time:
- users
- manager
- appOwners
- group
- self
- entitlementOwners
- expression
- webhook
- resourceOwners
- agent
ShowShow
The agent to assign the task to.
Hide ParametersShow Parameters
The mode of the agent, full control, change policy only, or comment only.
Hide ParametersShow Parameters
The agent user ID to assign the task to.
Instructions for the agent.
The allow list of policy IDs to re-route the task to.
List of users for whom this step can be reassigned.
Configuration to allow reassignment by reviewers during this step.
App owner approval provides the configuration for an approval step when the app owner is the target.
Hide ParametersShow Parameters
Configuration that allows a user to self approve if they are an app owner during this approval step.
A field indicating whether this step is assigned.
The entitlement owner approval allows configuration of the approval step when the target approvers are the entitlement owners.
Hide ParametersShow Parameters
Configuration to allow self approval if the target user is an entitlement owner during this step.
Configuration to allow a fallback if the entitlement owner cannot be identified.
Configuration to specific which users to fallback to if fallback is enabled and the entitlement owner cannot be identified.
The Escalation message.
This message contains a oneof named escalation_policy. Only a single field of the following list may be set at a time:
- replacePolicy
- reassignToApprovers
Hide ParametersShow Parameters
The escalationComment field.
The expiration field.
The ReassignToApprovers message.
Hide ParametersShow Parameters
The approverIds field.
The ReplacePolicy message.
Hide ParametersShow Parameters
The policyId field.
Whether escalation is enabled for this step.
The ExpressionApproval message.
Hide ParametersShow Parameters
Configuration to allow self approval of if the user is specified and also the target of the ticket.
The assignedUserIds field.
Array of dynamic expressions to determine the approvers. The first expression to return a non-empty list of users will be used.
Configuration to allow a fallback if the expression does not return a valid list of users.
Configuration to specific which users to fallback to if and the expression does not return a valid list of users.
The AppGroupApproval object provides the configuration for setting a group as the approvers of an approval policy step.
Hide ParametersShow Parameters
Configuration to allow self approval if the target user is a member of the group during this step.
The ID of the group specified for approval.
The ID of the app that contains the group specified for approval.
Configuration to allow a fallback if the group is empty.
Configuration to specific which users to fallback to if fallback is enabled and the group is empty.
The manager approval object provides configuration options for approval when the target of the approval is the manager of the user in the task.
Hide ParametersShow Parameters
Configuration to allow self approval if the target user is their own manager. This may occur if a service account has an identity user and manager specified as the same person.
The array of users determined to be the manager during processing time.
Configuration to allow a fallback if no manager is found.
Configuration to specific which users to fallback to if fallback is enabled and no manager is found.
Configuration to require a reason when approving this step.
Configuration to require a reason when denying this step.
Configuration to require a reason when reassigning this step.
The ID of a step-up authentication provider that will be required for approvals on this step. If set, approvers must complete the step-up authentication flow before they can approve.
The resource owner approval allows configuration of the approval step when the target approvers are the resource owners.
Hide ParametersShow Parameters
Configuration to allow self approval if the target user is an resource owner during this step.
Configuration to allow a fallback if the resource owner cannot be identified.
Configuration to specific which users to fallback to if fallback is enabled and the resource owner cannot be identified.
The self approval object describes the configuration of a policy step that needs to be approved by the target of the request.
Hide ParametersShow Parameters
The array of users determined to be themselves during approval. This should only ever be one person, but is saved because it may change if the owner of an app user changes while the ticket is open.
Configuration to allow a fallback if the identity user of the target app user cannot be determined.
Configuration to specific which users to fallback to if fallback is enabled and the identity user of the target app user cannot be determined.
The user approval object describes the approval configuration of a policy step that needs to be approved by a specific list of users.
Hide ParametersShow Parameters
Configuration to allow self approval of if the user is specified and also the target of the ticket.
Array of users configured for approval.
The WebhookApproval message.
Hide ParametersShow Parameters
The ID of the webhook to call for approval.
Approval Instance
The approval instance object describes the way a policy step should be approved as well as its outcomes and state.
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- approved
- denied
- reassigned
- restarted
- reassignedByError
- skipped
ShowShow
The Approval message.
This message contains a oneof named typ. Only a single field of the following list may be set at a time:
- users
- manager
- appOwners
- group
- self
- entitlementOwners
- expression
- webhook
- resourceOwners
- agent
The approved action indicates that the approvalinstance had an outcome of approved.
Hide ParametersShow Parameters
The entitlements that were approved. This will only ever be a list of one entitlement.
Hide ParametersShow Parameters
The ID of the Entitlement.
The ID of the App this entitlement belongs to.
The ID of the step-up transaction that was used for this approval, if step-up was required.
The UserID that approved this step.
The denied action indicates that the c1.api.policy.v1.ApprovalInstance had an outcome of denied.
Hide ParametersShow Parameters
The UserID that denied this step.
The EscalationInstance message.
This message contains a oneof named escalation_policy. Only a single field of the following list may be set at a time:
- replacePolicy
- reassignToApprovers
Hide ParametersShow Parameters
The alreadyEscalated field.
The escalationComment field.
The ReassignToApprovers message.
Hide ParametersShow Parameters
The approverIds field.
The ReplacePolicy message.
Hide ParametersShow Parameters
The policyId field.
The ReassignedAction object describes the outcome of a policy step that has been reassigned.
Hide ParametersShow Parameters
The ID of the policy step that was created as a result of this reassignment.
The UserID of the person who reassigned this step.
The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning.
The restart action describes the outcome of policy steps for when the task was restarted. This can be applied to multiple steps since restart skips all pending next steps.
Hide ParametersShow Parameters
The step ID that was restarted. Potentially multiple "history" steps will reference this ID to indicate by what step they were restarted.
The user that submitted the restart action.
The SkippedAction object describes the outcome of a policy step that has been skipped.
The state of the approval instance
Hide ParametersShow Parameters
Policy Step Instance
The policy step instance includes a reference to an instance of a policy step that tracks state and has a unique ID.
This message contains a oneof named instance. Only a single field of the following list may be set at a time:
- approval
- provision
- accept
- reject
- wait
ShowShow
The ID of the PolicyStepInstance. This is required by many action submission endpoints to indicate what step you're approving.
This policy step indicates that a ticket should have an approved outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy.
Hide ParametersShow Parameters
An optional message to include in the comments when a task is automatically accepted.
The approval instance object describes the way a policy step should be approved as well as its outcomes and state.
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- approved
- denied
- reassigned
- restarted
- reassignedByError
- skipped
The policy generation id refers to the version of the policy that this step was created from.
A provision instance describes the specific configuration of an executing provision policy step including actions taken and notification id.
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- completed
- cancelled
- errored
- reassignedByError
- skipped
Hide ParametersShow Parameters
The outcome of a provision instance that is cancelled.
Hide ParametersShow Parameters
The userID, usually the system, that cancells a provision instance.
The outcome of a provision instance that has been completed succesfully.
Hide ParametersShow Parameters
The list of entitlements that were provisioned. This is leftover from an older design, and is only ever going to be a single entitlement.
Hide ParametersShow Parameters
The ID of the Entitlement.
The ID of the App this entitlement belongs to.
The UserID of who completed provisioning. For connector provisioning this is the system user id, for manual provisioning this is who clicked "provision complete"
The outcome of a provision instance that has errored.
Hide ParametersShow Parameters
The description of a provision instance that has errored.
The error code of a provision instance that has errored. This is only PEC-1 for now, but more will be added in the future.
This indicates the external ticket id for this step.
This indicates the external ticket provisioner config id for this step.
This indicates the notification id for this step.
The provision step references a provision policy for this step.
The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning.
The SkippedAction object describes the outcome of a policy step that has been skipped.
This property indicates the current state of this step.
Hide ParametersShow Parameters
This indicates the webhook id for this step.
This indicates the webhook instance id for this step.
This policy step indicates that a ticket should have a denied outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy.
Hide ParametersShow Parameters
An optional message to include in the comments when a task is automatically rejected.
The state of the step, which is either active or done.
Hide ParametersShow Parameters
Used by the policy engine to describe an instantiated wait step.
This message contains a oneof named until. Only a single field of the following list may be set at a time:
- condition
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- succeeded
- timedOut
- skipped
Hide ParametersShow Parameters
The comment to post on first failed check.
The comment to post if we timeout.
Used by the policy engine to describe an instantiated condition to wait on.
Hide ParametersShow Parameters
The condition that has to be true for this wait condition instance to continue.
The name field.
The SkippedAction object describes the outcome of a policy step that has been skipped.
The state field.
Hide ParametersShow Parameters
The ConditionSucceeded message.
Hide ParametersShow Parameters
The ConditionTimedOut message.
Hide ParametersShow Parameters
Provision
The provision step references a provision policy for this step.
ShowShow
A field indicating whether this step is assigned.
ProvisionPolicy is a oneOf that indicates how a provision step should be processed.
This message contains a oneof named typ. Only a single field of the following list may be set at a time:
- connector
- manual
- delegated
- webhook
- multiStep
- externalTicket
- unconfigured
ProvisionTarget indicates the specific app, app entitlement, and if known, the app user and grant duration of this provision step
Hide ParametersShow Parameters
The app entitlement that should be provisioned.
The app in which the entitlement should be provisioned
The app user that should be provisioned. May be unset if the app user is unknown
Reassigned By Error Action
The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning.
ShowShow
The description of the error with more details on why this was reassigned.
Additional information about the error, like http status codes or error messages from SDKs.
The UserID of the user who reassigned this due to an error. This will exclusively be the System's UserID.
The ID of the policy step that was created by this reassignment.
Skipped Action
The SkippedAction object describes the outcome of a policy step that has been skipped.
ShowShow
The ID of the policy step that was created as a result of this skipping.
The UserID of the user who skipped this step.
Task Grant Source
The TaskGrantSource message tracks which external URL was the source of the specificed grant ticket.
ShowShow
The external url source of the grant ticket.
The integration id for the source of tickets.
the request id for the grant ticket if the source is external
Task View
Contains a task and JSONPATH expressions that describe where in the expanded array related objects are located. This view can be used to display a fully-detailed dashboard of task information.
ShowShow
JSONPATH expression indicating the location of the AccessReview object in the expanded array
JSONPATH expression indicating the location of the App object in the expanded array
JSONPATH expression indicating the location of the AppUser object in the expanded array
JSONPATH expression indicating the location of the object of the User that created the ticket in the expanded array
JSONPATH expression indicating the location of the Entitlements objects in the expanded array
JSONPATH expression indicating the location of the User object of the User that this task is targeting in the expanded array. This is the user that is the identity when the target of a task is an app user.
JSONPATH expression indicating the location of the Insights objects in the expanded array
JSONPATH expression indicating the location of the StepApproverUsers objects in the expanded array
A fully-fleged task object. Includes its policy, references to external apps, its type, its processing history, and more.
Hide ParametersShow Parameters
The ID of the task.
The actions that can be performed on the task by the current user.
Hide ParametersShow Parameters
The ID of the analysis object associated with this task created by an analysis workflow if the analysis feature is enabled for your tenant.
An array of google.protobuf.Any annotations with various base64-encoded data.
Hide ParametersShow Parameters
The type of the serialized message.
The count of comments.
The ID of the user that is the creator of this task. This may not always match the userId field.
The description of the task. This is also known as justification.
The display name of the task.
A field indicating whether this task was created using an emergency access flow, or escalated to emergency access. On task creation, it will also use the app entitlement's emergency policy when possible.
An array of external references to the task. Historically that has been items like Jira task IDs. This is currently unused, but may come back in the future for integrations.
Hide ParametersShow Parameters
The source of the external reference.
Hide ParametersShow Parameters
The name of the external reference.
The URL to the external reference.
The insightIds field.
A human-usable numeric ID of a task which can be included in place of the fully qualified task id in path parmeters (but not search queries).
The origin field.
Hide ParametersShow Parameters
A policy instance is an object that contains a reference to the policy it was created from, the currently executing step, the next steps, and the history of previously completed steps.
Hide ParametersShow Parameters
The policy step instance includes a reference to an instance of a policy step that tracks state and has a unique ID.
This message contains a oneof named instance. Only a single field of the following list may be set at a time:
- approval
- provision
- accept
- reject
- wait
An array of steps that were previously processed by the ticket with their outcomes set, in order.
Hide ParametersShow Parameters
The ID of the PolicyStepInstance. This is required by many action submission endpoints to indicate what step you're approving.
This policy step indicates that a ticket should have an approved outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy.
Hide ParametersShow Parameters
An optional message to include in the comments when a task is automatically accepted.
The approval instance object describes the way a policy step should be approved as well as its outcomes and state.
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- approved
- denied
- reassigned
- restarted
- reassignedByError
- skipped
The policy generation id refers to the version of the policy that this step was created from.
A provision instance describes the specific configuration of an executing provision policy step including actions taken and notification id.
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- completed
- cancelled
- errored
- reassignedByError
- skipped
Hide ParametersShow Parameters
The outcome of a provision instance that is cancelled.
Hide ParametersShow Parameters
The userID, usually the system, that cancells a provision instance.
The outcome of a provision instance that has been completed succesfully.
Hide ParametersShow Parameters
The list of entitlements that were provisioned. This is leftover from an older design, and is only ever going to be a single entitlement.
Hide ParametersShow Parameters
The ID of the Entitlement.
The ID of the App this entitlement belongs to.
The UserID of who completed provisioning. For connector provisioning this is the system user id, for manual provisioning this is who clicked "provision complete"
The outcome of a provision instance that has errored.
Hide ParametersShow Parameters
The description of a provision instance that has errored.
The error code of a provision instance that has errored. This is only PEC-1 for now, but more will be added in the future.
This indicates the external ticket id for this step.
This indicates the external ticket provisioner config id for this step.
This indicates the notification id for this step.
The provision step references a provision policy for this step.
The ReassignedByErrorAction object describes the outcome of a policy step that has been reassigned because it had an error provisioning.
The SkippedAction object describes the outcome of a policy step that has been skipped.
This property indicates the current state of this step.
Hide ParametersShow Parameters
This indicates the webhook id for this step.
This indicates the webhook instance id for this step.
This policy step indicates that a ticket should have a denied outcome. This is a terminal approval state and is used to explicitly define the end of approval steps. The instance is just a marker for it being copied into an active policy.
Hide ParametersShow Parameters
An optional message to include in the comments when a task is automatically rejected.
The state of the step, which is either active or done.
Hide ParametersShow Parameters
Used by the policy engine to describe an instantiated wait step.
This message contains a oneof named until. Only a single field of the following list may be set at a time:
- condition
This message contains a oneof named outcome. Only a single field of the following list may be set at a time:
- succeeded
- timedOut
- skipped
Hide ParametersShow Parameters
The comment to post on first failed check.
The comment to post if we timeout.
Used by the policy engine to describe an instantiated condition to wait on.
Hide ParametersShow Parameters
The condition that has to be true for this wait condition instance to continue.
The name field.
The SkippedAction object describes the outcome of a policy step that has been skipped.
The state field.
Hide ParametersShow Parameters
The ConditionSucceeded message.
Hide ParametersShow Parameters
The ConditionTimedOut message.
Hide ParametersShow Parameters
An array of steps that will be processed by the ticket, in order.
Hide ParametersShow Parameters
This policy step indicates that a ticket should have an approved outcome. This is a terminal approval state and is used to explicitly define the end of approval steps.
The Approval message.
This message contains a oneof named typ. Only a single field of the following list may be set at a time:
- users
- manager
- appOwners
- group
- self
- entitlementOwners
- expression
- webhook
- resourceOwners
- agent
The provision step references a provision policy for this step.
This policy step indicates that a ticket should have a denied outcome. This is a terminal approval state and is used to explicitly define the end of approval steps.
Define a Wait step for a policy to wait on a condition to be met.
This message contains a oneof named until. Only a single field of the following list may be set at a time:
- condition
A policy describes the behavior of the ConductorOne system when processing a task. You can describe the type, approvers, fallback behavior, and escalation processes.
The policy generation id refers to the current policy's generation ID. This is changed when the policy is changed on a task.
The processing state of a task as defined by the processing_enum
Hide ParametersShow Parameters
The recommendation field.
Hide ParametersShow Parameters
The current state of the task as defined by the state_enum
Hide ParametersShow Parameters
An array of IDs belonging to Identity Users that are allowed to review this step in a task.
Task Type provides configuration for the type of task: certify, grant, or revoke
This message contains a oneof named task_type. Only a single field of the following list may be set at a time:
- grant
- revoke
- certify
- offboarding
The ID of the user that is the target of this task. This may be empty if we're targeting a specific app user that has no known identity user.
JSONPATH expression indicating the location of the User object in the expanded array. This is the user that is a direct target of the ticket without a specific relationship to a potentially non-existent app user.
TasksAction
Approve
Approve With Step Up
Close
Comment
Deny
Escalate To Emergency Access
Hard Reset
Process Now
Reassign
Restart
Skip Step
Task Service Action Response
The TaskServiceActionResponse message.
ShowShow
Hide ParametersShow Parameters
The type of the serialized message.
Contains a task and JSONPATH expressions that describe where in the expanded array related objects are located. This view can be used to display a fully-detailed dashboard of task information.
The ticketActionId field.