Atomicwork Access Management API

openapi: 3.2.0
info:
  title: Atomicwork Public Access Management API
  version: 1.0.0
servers:
- url: https://{tenant}.atomicwork.com
  description: Your Atomicwork tenant
tags:
- name: Access Management
paths:
  /api/v1/iga/grants:
    post:
      operationId: postapi-v-1-iga-grants
      summary: Create a grant for a user
      description: 'Create an identity grant directly without going through the IGA approval workflow. This is the primary endpoint for programmatic access provisioning — use it when an external system (HRMS, onboarding tool, compliance platform) needs to grant access to a user.


        **Required fields:** `user_id` and `entitlement_id`. Call `GET /iga/apps` then `GET /iga/entitlements?app_id={id}` to discover valid entitlement IDs.


        **Optional fields:**

        - `policy_id` or `policy_key` — link the grant to a specific access policy

        - `granted_by` — record which user or system initiated the grant

        - `granted_at` — backdate the grant timestamp (ISO 8601); defaults to now


        The grant method (how provisioning happens) is automatically derived from the entitlement''s provisioning configuration — Okta, Azure AD, JumpCloud, Google Workspace, or manual service request.


        Returns the created grant with its `id`, resolved `status`, `entitlement`, `app`, and provisioning details.'
      tags:
      - Access Management
      parameters:
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_postapi_v1_iga_grants_Response_200'
      requestBody:
        description: Request body for creating a grant via the public API
        content:
          application/json:
            schema:
              type: object
              properties:
                user_id:
                  type: integer
                  format: int64
                  description: The ID of the user who will receive the grant
                entitlement_id:
                  type: integer
                  format: int64
                  description: The ID of the entitlement to grant
                policy_id:
                  type: integer
                  format: int64
                  description: Optional policy ID to associate with the grant
                policy_key:
                  type: string
                  description: Optional policy key (alternative to policy_id)
                granted_by:
                  type: integer
                  format: int64
                  description: Optional user ID of who authorized this grant. Defaults to the API key owner.
                granted_at:
                  type: string
                  format: date-time
                  description: Optional timestamp of when the grant was authorized. Defaults to current time.
              required:
              - user_id
              - entitlement_id
  /api/v1/iga/grants/list:
    post:
      operationId: postapi-v-1-iga-grants-list
      summary: List grants with filters
      description: Search and list identity grants with advanced filtering.
      tags:
      - Access Management
      parameters:
      - name: search_key
        in: query
        description: Free-text search across grant, entitlement, and user fields.
        required: false
        schema:
          type: string
      - name: sort_order
        in: query
        description: 'Sort order for results. Common values: GRANTED_AT_DESC (newest first), GRANTED_AT_ASC (oldest first), EXPIRES_AT_ASC (expiring soonest first).'
        required: false
        schema:
          $ref: '#/components/schemas/ApiV1IgaGrantsListPostParametersSortOrder'
      - name: policy_id
        in: query
        description: Filter grants linked to a specific access policy by its UUID key.
        required: false
        schema:
          type: string
      - name: app_id
        in: query
        description: Filter grants to entitlements under a specific app (from GET /iga/apps).
        required: false
        schema:
          type: integer
          format: int64
      - name: page
        in: query
        description: Page number (1-indexed). Default 1.
        required: false
        schema:
          type: integer
          default: 1
      - name: per_page
        in: query
        description: Results per page (default 25, max 100).
        required: false
        schema:
          type: integer
          default: 25
      - name: next_page_token
        in: query
        description: Token from previous response to fetch the next page. When provided, takes priority over page and per_page parameters.
        required: false
        schema:
          type: string
      - name: ids
        in: query
        description: Comma-separated list of grant IDs to filter by. When provided, returns only grants matching these IDs.
        required: false
        schema:
          type: string
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_postapi_v1_iga_grants_list_Response_200'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItems'
  /api/v1/iga/grants/{grant_id}:
    put:
      operationId: putapi-v-1-iga-grants-grant-id
      summary: Update a grant
      description: 'Update an identity grant''s metadata. Use this to change the associated policy, update the grantor, or adjust grant timestamps.


        **Updatable fields:**

        - `status` — transition the grant to a new status

        - `policy_id` or `policy_key` — reassign the grant to a different access policy

        - `granted_by` — update the grantor identifier

        - `granted_at` — correct the grant timestamp


        To revoke a grant, use the dedicated `POST /iga/grants/{grant_id}/revoke` endpoint instead — it handles deprovisioning workflows.'
      tags:
      - Access Management
      parameters:
      - name: grant_id
        in: path
        description: ''
        required: true
        schema:
          type: string
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_putapi_v1_iga_grants__grant_id_Response_200'
      requestBody:
        description: Request body for updating a grant via the public API
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  $ref: '#/components/schemas/ApiV1IgaGrantsGrantIdPutRequestBodyContentApplicationJsonSchemaStatus'
                policy_id:
                  type: integer
                  format: int64
                  description: Change the policy associated with the grant
                policy_key:
                  type: string
                  description: Change the policy by key (alternative to policy_id)
                granted_by:
                  type: integer
                  format: int64
                  description: User ID who authorized this grant
                granted_at:
                  type: string
                  format: date-time
                  description: When the grant was authorized
  /api/v1/iga/grants/{grant_id}/revoke:
    post:
      operationId: postapi-v-1-iga-grants-grant-id-revoke
      summary: Revoke a grant
      description: 'Revoke an identity grant. Supports two modes depending on whether you want the identity provider to be notified:


        **Immediate revocation (default):** With `skip_deprovisioning=true` (the default), the grant is marked as `REVOKED` immediately in Atomicwork. No action is taken in the identity provider — use this when you''ve already removed access externally or when the grant is informational only.


        **Full deprovisioning:** With `skip_deprovisioning=false`, Atomicwork triggers the full deprovisioning workflow. Depending on the entitlement''s provisioning config, this may:

        - Remove the user from an Azure AD or Okta group

        - Remove a JumpCloud or Google Workspace assignment

        - Create a manual service request for IT to action


        The response includes a `revocation_status` object with `status` (IN_PROGRESS, COMPLETED, or FAILED) and a `schedule_id` you can use to track the deprovisioning execution.


        **Optional fields:**

        - `reason` — free-text reason for the revocation (recorded in grant history)'
      tags:
      - Access Management
      parameters:
      - name: grant_id
        in: path
        description: The grant ID to revoke
        required: true
        schema:
          type: integer
          format: int64
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_postapi_v1_iga_grants__grant_id__revoke_Response_200'
      requestBody:
        description: Request body for revoking a grant via the public API
        content:
          application/json:
            schema:
              type: object
              properties:
                reason:
                  type: string
                  description: Optional reason for revoking the grant
                skip_deprovisioning:
                  type: boolean
                  default: true
                  description: 'When true (default), marks the grant as REVOKED immediately without triggering IDP deprovisioning. When false, triggers the full deprovisioning workflow (Azure AD/Okta group removal or service request creation).

                    '
  /api/v1/iga/grants/{grant_id}/history:
    get:
      operationId: getapi-v-1-iga-grants-grant-id-history
      summary: Get grant history
      description: 'Retrieve the complete audit trail for a specific grant. Returns a paginated timeline of all lifecycle events — creation, extensions, revocations, and expirations — with timestamps and actors.


        Each history entry includes:

        - `event_type` — one of `GRANTED`, `EXTENDED`, `REVOKED`, or `EXPIRED`

        - `event_at` — when the event occurred (ISO 8601)

        - `event_by` — who or what triggered the event


        **Pagination:** Supports `page`, `per_page`, and `sort_order` (CREATED_AT_ASC or CREATED_AT_DESC). Default sort is newest first.'
      tags:
      - Access Management
      parameters:
      - name: grant_id
        in: path
        description: The unique identifier of the grant
        required: true
        schema:
          type: integer
          format: int64
      - name: page
        in: query
        description: ''
        required: false
        schema:
          type: integer
          default: 1
      - name: per_page
        in: query
        description: ''
        required: false
        schema:
          type: integer
          default: 25
      - name: sort_order
        in: query
        description: Sort order for grant history results
        required: false
        schema:
          $ref: '#/components/schemas/ApiV1IgaGrantsGrantIdHistoryGetParametersSortOrder'
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_getapi_v1_iga_grants__grant_id__history_Response_200'
  /api/v1/iga/apps:
    get:
      operationId: getapi-v-1-iga-apps
      summary: List available apps
      description: 'List the identity resource apps connected to your workspace. This is the starting point for grant discovery — each app represents a connected identity provider (Okta, Azure AD, JumpCloud, Google Workspace, etc.) and contains entitlements that can be granted to users.


        **Typical flow:** Call this endpoint first to get `app_id` values, then call `GET /iga/entitlements?app_id={id}` to browse the entitlements (groups, roles, licenses) available in each app.


        **Pagination:** Supports `page` and `per_page` (default 25). Use `search_key` to filter apps by name.'
      tags:
      - Access Management
      parameters:
      - name: search_key
        in: query
        description: Filter apps by name (partial match).
        required: false
        schema:
          type: string
      - name: page
        in: query
        description: Page number (1-indexed). Default 1.
        required: false
        schema:
          type: integer
          default: 1
      - name: per_page
        in: query
        description: Results per page (default 25).
        required: false
        schema:
          type: integer
          default: 25
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_getapi_v1_iga_apps_Response_200'
  /api/v1/iga/entitlements:
    get:
      operationId: getapi-v-1-iga-entitlements
      summary: List available entitlements
      description: 'List the entitlements (groups, roles, licenses, repos) available for granting. Each entitlement belongs to an app and represents a specific access right that can be assigned to a user.


        **Filter by app:** Pass `app_id` (from `GET /iga/apps`) to list only entitlements under a specific identity provider app.


        **Filter by type:** Use the `type` parameter to narrow by entitlement category:

        - `GROUP` — identity provider group membership (e.g. Azure AD security group, Okta group)

        - `ROLE` — application role assignment


        **Filter by status:** Use `status` to filter by publication state:

        - `PUBLISHED` — available for granting

        - `DRAFT` — not yet available


        **Pagination:** Supports `page`, `per_page` (default 25), and `search_key` for name search.'
      tags:
      - Access Management
      parameters:
      - name: search_key
        in: query
        description: Filter entitlements by name (partial match).
        required: false
        schema:
          type: string
      - name: app_id
        in: query
        description: Filter entitlements under a specific app (from GET /iga/apps).
        required: false
        schema:
          type: integer
          format: int64
      - name: type
        in: query
        description: 'Filter by entitlement category: GROUP (IDP group membership), ROLE (application role).'
        required: false
        schema:
          $ref: '#/components/schemas/ApiV1IgaEntitlementsGetParametersType'
      - name: status
        in: query
        description: 'Filter by publication state: PUBLISHED (available for granting), DRAFT (not yet available).'
        required: false
        schema:
          $ref: '#/components/schemas/ApiV1IgaEntitlementsGetParametersStatus'
      - name: page
        in: query
        description: Page number (1-indexed). Default 1.
        required: false
        schema:
          type: integer
          default: 1
      - name: per_page
        in: query
        description: Results per page (default 25).
        required: false
        schema:
          type: integer
          default: 25
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_getapi_v1_iga_entitlements_Response_200'
    post:
      operationId: postapi-v-1-iga-entitlements
      summary: Create an entitlement
      description: 'Create a new identity entitlement. Requires app_id and type.

        The entitlement can then be associated with policies and granted to users.'
      tags:
      - Access Management
      parameters:
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_postapi_v1_iga_entitlements_Response_200'
      requestBody:
        description: Request body for creating an entitlement via the public API
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Name of the entitlement
                description:
                  type: string
                  description: Description of the entitlement
                app_id:
                  type: integer
                  format: int64
                  description: ID of the identity resource app this entitlement belongs to
                status:
                  $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaStatus'
                  description: Status of the entitlement. Defaults to PUBLISHED if not specified.
                provisioning_config:
                  $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfig'
                deprovisioning_config:
                  $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig'
              required:
              - name
              - app_id
  /api/v1/iga/policies:
    post:
      operationId: postapi-v-1-iga-policies
      summary: Create a policy
      description: 'Create a new identity policy. Requires name, type, and status.

        Policies define access rules and can be associated with entitlements.'
      tags:
      - Access Management
      parameters:
      - name: X-Api-Key
        in: header
        required: true
        schema:
          type: string
      - name: X-Workspace-Id
        in: header
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Access_Management_postapi_v1_iga_policies_Response_200'
      requestBody:
        description: Request body for creating an identity policy via the public API
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Name of the policy
                description:
                  type: string
                  description: Description of the policy
                type:
                  $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaType'
                condition:
                  $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition'
                approvals:
                  $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals'
                lifecycle:
                  $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycle'
                status:
                  $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaStatus'
                is_active:
                  type: boolean
                  description: Whether the policy is active
                entitlements:
                  type: array
                  items:
                    type: integer
                    format: int64
                  description: List of entitlement IDs to associate with this policy
                app_id:
                  type: integer
                  format: int64
                  description: ID of the identity resource app this policy belongs to
                is_business_justification_required:
                  type: boolean
                  description: Whether business justification is required for requests under this policy
              required:
              - name
              - type
              - status
              - app_id
components:
  schemas:
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettings:
      type: object
      properties:
        enable_expiry_notifications:
          type: boolean
          default: false
          description: Whether expiry notifications are enabled
        notification_timings:
          type: array
          items:
            $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettingsNotificationTimingsItems'
          default: []
          description: List of notification timings specifying when to send notifications before expiry
      description: Notification settings for time-based access policies. Can be used globally or per-duration.
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettings
    ApiV1IgaEntitlementsGetParametersStatus:
      type: string
      enum:
      - DRAFT
      - PUBLISHED
      title: ApiV1IgaEntitlementsGetParametersStatus
    ? ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettingsNotificationTimingsItems
    : type: object
      properties:
        id:
          type: string
          description: 'Unique identifier in format: {value}_{unit}'
        value:
          type: integer
          description: The numeric value of the duration
        unit:
          description: Any type
      required:
      - value
      - unit
      description: Represents a duration with a value and time unit. Includes ID field for AI-agent friendly selection.
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1AllowedAccessDurationsItemsNotificationSettingsNotificationTimingsItems
    ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigProvider:
      type: string
      enum:
      - OKTA
      - AZURE_AD
      - MS_INTUNE
      - JUMPCLOUD
      - GOOGLE_WORKSPACE
      - TUEBORA
      - MANUAL
      description: Provisioning provider
      title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigProvider
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition0:
      type: object
      properties:
        type:
          type: string
        values:
          type: array
          items:
            type: integer
            format: int64
      required:
      - type
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition0
    ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigProvider:
      type: string
      enum:
      - OKTA
      - AZURE_AD
      - MS_INTUNE
      - JUMPCLOUD
      - GOOGLE_WORKSPACE
      - TUEBORA
      - MANUAL
      description: Deprovisioning provider
      title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigProvider
    Access_Management_putapi_v1_iga_grants__grant_id_Response_200:
      type: object
      properties: {}
      description: Empty response body
      title: Access Management_putapi_v1_iga_grants__grant_id_Response_200
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0Criteria:
      type: string
      enum:
      - FIRST_DECISION
      - EVERYONE
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0Criteria
    ApiV1IgaEntitlementsGetParametersType:
      type: string
      enum:
      - GROUP
      - ROLE
      title: ApiV1IgaEntitlementsGetParametersType
    ApiV1IgaGrantsGrantIdPutRequestBodyContentApplicationJsonSchemaStatus:
      type: string
      enum:
      - GRANTED
      - EXPIRED
      - EXTENDED
      - REVOKED
      title: ApiV1IgaGrantsGrantIdPutRequestBodyContentApplicationJsonSchemaStatus
    ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValueIcon:
      type: object
      properties:
        name:
          type: string
          description: Icon name
        type:
          type: string
          description: Icon type
        url:
          type:
          - string
          - 'null'
          description: Icon URL (for OKTA/AZURE)
      title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValueIcon
    ? ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItemsUnit
    : type: string
      enum:
      - HOURS
      - DAYS
      - WEEKS
      - MONTHS
      description: Time unit for duration specifications
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItemsUnit
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems1:
      type: object
      properties:
        type:
          type: string
        policy_id:
          type: integer
          format: int64
      required:
      - type
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems1
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItemsCardinality:
      type: string
      enum:
      - SINGLE
      - MULTI
      description: "Indicates whether the approver row resolves to a single user (SINGLE) or multiple\nusers (MULTI). Populated server-side on approval-policy GET responses; null on writes.\n\nRules:\n- EXPRESSION: SINGLE/MULTI per the placeholder template (ApprovalPlaceholder catalog).\n  Null on unknown templates.\n- AGENT_GROUP: always MULTI — the resolver fans the group out to every member at\n  evaluation time, so the FE picker should render the multi-user badge and auto-toggle\n  the criteria selector.\n- Other types (EXACT, STANDARD_BASED, OPTION_BASED): null.\n"
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItemsOneOf0ApproversDataItemsCardinality
    ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigType:
      type: string
      enum:
      - OKTA_GROUP_PROVISIONING
      - AZURE_GROUP_PROVISIONING
      - INTUNE_GROUP_PROVISIONING
      - JUMPCLOUD_GROUP_PROVISIONING
      - GOOGLE_WORKSPACE_GROUP_PROVISIONING
      - MANUAL_PROVISIONING
      description: Type of provisioning configuration
      title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaProvisioningConfigType
    ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator:
      type: string
      enum:
      - EQUALS
      - NOT_EQUALS
      - CONTAINS
      - NOT_CONTAINS
      - IN
      - NOT_IN
      - GREATER_THAN
      - LESS_THAN
      - GREATER_THAN_EQUALS
      - LESS_THAN_EQUALS
      - IS_BETWEEN
      - IS_NULL
      - IS_NOT_NULL
      - STARTS_WITH
      - ENDS_WITH
      - TEXT_CONTAINS
      - TEXT_DOES_NOT_CONTAINS
      - IS_ANY_OF
      - IS_NOT_ANY_OF
      - IS_EXACTLY
      - IS_ON_OR_BEFORE
      - IS_ON_OR_AFTER
      - IS_WITHIN
      title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsOperator
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition:
      oneOf:
      - $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition0'
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaCondition
    Access_Management_getapi_v1_iga_grants__grant_id__history_Response_200:
      type: object
      properties: {}
      description: Empty response body
      title: Access Management_getapi_v1_iga_grants__grant_id__history_Response_200
    ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals1:
      type: object
      properties:
        type:
          type: string
        steps:
          type: array
          items:
            $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovalsOneOf1StepsItems'
      required:
      - type
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaApprovals1
    ? ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItems
    : type: object
      properties:
        id:
          type: string
          description: 'Unique identifier in format: {value}_{unit}'
        value:
          type: integer
          description: The numeric value of the duration
        unit:
          $ref: '#/components/schemas/ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItemsUnit'
          description: Time unit for duration specifications
      required:
      - value
      - unit
      description: Represents a duration with a value and time unit. Includes ID field for AI-agent friendly selection.
      title: ApiV1IgaPoliciesPostRequestBodyContentApplicationJsonSchemaLifecycleOneOf1GlobalNotificationSettingsNotificationTimingsItems
    ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems:
      type: object
      properties:
        value:
          $ref: '#/components/schemas/ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItemsValue'
        nested_filter:
          description: Any type
      title: ApiV1IgaGrantsListPostRequestBodyContentApplicationJsonSchemaItemsValuesItems
    ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig:
      type: object
      properties:
        provider:
          $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigProvider'
          description: Deprovisioning provider
        type:
          $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigType'
          description: Type of deprovisioning configuration
        value:
          $ref: '#/components/schemas/ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfigValue'
      required:
      - provider
      - type
      - value
      title: ApiV1IgaEntitlementsPostRequestBodyContentApplicationJsonSchemaDeprovisioningConfig
    ApiV1IgaGrantsListPostParametersSortOrder:
      type: string
      enum:
      - CREATED_AT_ASC
      - CREATED_AT_DESC
      - UPDATED_AT_ASC
      - 

# --- truncated at 32 KB (46 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/atomicwork/refs/heads/main/openapi/atomicwork-access-management-api-openapi.yml