JumpCloud Roles API

openapi: 3.2.0
info:
  contact:
    name: JumpCloud Support
    url: https://jumpcloud.com/support/contact-jumpcloud-support
  description: '# Overview


    JumpCloud''s V2 API. This set of endpoints allows JumpCloud customers to manage objects, groupings and mappings and interact with the JumpCloud Graph. > **Note:** See JumpCloud Data Centers: Login URLs and Service Endpoints to learn more. ## API Best Practices


    Read the linked Help Article below for guidance on retrying failed requests to JumpCloud''s REST API, as well as best practices for structuring subsequent retry requests. Customizing retry mechanisms based on these recommendations will increase the reliability and dependability of your API calls. Covered topics include:

    1. Important Considerations

    2. Supported HTTP Request Methods

    3. Response codes

    4. API Key rotation

    5. Paginating

    6. Error handling

    7. Retry rates


    JumpCloud Help Center - API Best Practices


    # Directory Objects


    This API offers the ability to interact with some of our core features; otherwise known as Directory Objects. The Directory Objects are:


    * Commands

    * Policies

    * Policy Groups

    * Applications

    * Systems

    * Users

    * User Groups

    * System Groups

    * Radius Servers

    * Directories: Office 365, LDAP,G-Suite, Active Directory

    * Duo accounts and applications. The Directory Object is an important concept to understand in order to successfully use JumpCloud API. ## JumpCloud Graph


    We''ve also introduced the concept of the JumpCloud Graph along with Directory Objects. The Graph is a powerful aspect of our platform which will enable you to associate objects with each other, or establish membership for certain objects to become members of other objects. Specific `GET` endpoints will allow you to traverse the JumpCloud Graph to return all indirect and directly bound objects in your organization. | !alt text |

    |:--:|

    | **This diagram highlights our association and membership model as it relates to Directory Objects.** |


    # API Key


    ## Access Your API Key


    To locate your API Key:


    1. Log into the JumpCloud Admin Console. 2. Go to the username drop down located in the top-right of the Console. 3. Retrieve your API key from API Settings. ## API Key Considerations


    This API key is associated to the currently logged in administrator. Other admins will have different API keys. **WARNING** Please keep this API key secret, as it grants full access to any data accessible via your JumpCloud console account. You can also reset your API key in the same location in the JumpCloud Admin Console. ## Recycling or Resetting Your API Key


    In order to revoke access with the current API key, simply reset your API key. This will render all calls using the previous API key inaccessible. Your API key will be passed in as a header with the header name "x-api-key". ```bash

    curl -H "x-api-key: [YOUR_API_KEY_HERE]" "https://console.jumpcloud.com/api/v2/systemgroups"

    ```


    # System Context


    * Introduction

    * Supported endpoints

    * Response codes

    * Authentication

    * Additional examples

    * Third party


    ## Introduction


    JumpCloud System Context Authorization is an alternative way to authenticate with a subset of JumpCloud''s REST APIs. Using this method, a system can manage its information and resource associations, allowing modern auto provisioning environments to scale as needed. **Notes:**


    * The following documentation applies to Linux Operating Systems only. * Systems that have been automatically enrolled using Apple''s Device Enrollment Program (DEP) or systems enrolled using the User Portal install are not eligible to use the System Context API to prevent unauthorized access to system groups and resources. If a script that utilizes the System Context API is invoked on a system enrolled in this way, it will display an error. ## Supported Endpoints


    JumpCloud System Context Authorization can be used in conjunction with Systems endpoints found in the V1 API and certain System Group endpoints found in the v2 API.'
  title: JumpCloud Roles API
  version: '2.0'
servers:
- url: https://console.jumpcloud.com/api/v2
  description: United States (US)
  x-jc-region: us
- url: https://console.eu.jumpcloud.com/api/v2
  description: European Union (EU)
  x-jc-region: eu
- url: https://console.in.jumpcloud.com/api/v2
  description: India (IN)
  x-jc-region: in
tags:
- name: Roles
paths:
  /roles:
    get:
      summary: List all roles
      description: 'Returns a paginated list of all roles.


        Catalog visibility depends on authenticated organization/provider context.


        Organization-scoped requests (Direct, OU, MSP customer org) return the

        organization catalog. MSP provider-only requests return either the provider

        management catalog or, when `purpose=assignment`, the provider assignment

        catalog.


        Route availability is context-dependent: MSP provider-only requests require

        SP-10009-custom-role-mtp; all other contexts require na-1377-customroles-api.'
      operationId: roles_list
      parameters:
      - $ref: '#/components/parameters/trait_filter_filter'
      - $ref: '#/components/parameters/trait_limit_limit'
      - $ref: '#/components/parameters/trait_skip_skip'
      - $ref: '#/components/parameters/trait_sort_sort'
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-org-id'
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-provider-id'
      - $ref: '#/components/parameters/trait_listCount_x-total-count'
      - name: purpose
        in: query
        required: false
        description: When set to `assignment` in MSP provider context (authenticated MSP provider without organization context), returns the provider assignment catalog (system roles plus all provider-owned custom roles). Ignored for organization-scoped requests.
        schema:
          type: string
          enum:
          - assignment
      responses:
        '200':
          description: Successfully retrieved roles.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RoleList'
        '401':
          $ref: '#/components/responses/trait_standardErrors_401'
        '403':
          $ref: '#/components/responses/trait_standardErrors_403'
        '404':
          $ref: '#/components/responses/trait_standardErrors_404'
        '500':
          $ref: '#/components/responses/trait_standardErrors_500'
      security:
      - x-api-key: []
      x-scopes:
      - roles.readonly
      - roles
      tags:
      - Roles
      x-codeSamples:
      - lang: Shell
        source: "curl --request GET \\\n  --url 'https://console.jumpcloud.com/api/v2/roles?filter=SOME_ARRAY_VALUE&limit=SOME_INTEGER_VALUE&skip=SOME_INTEGER_VALUE&sort=SOME_ARRAY_VALUE&purpose=SOME_STRING_VALUE' \\\n  --header 'x-api-key: REPLACE_KEY_VALUE' \\\n  --header 'x-org-id: SOME_STRING_VALUE' \\\n  --header 'x-provider-id: SOME_STRING_VALUE' \\\n  --header 'x-total-count: SOME_INTEGER_VALUE'"
      - lang: Python
        source: "import requests\n\nurl = \"https://console.jumpcloud.com/api/v2/roles\"\n\nquerystring = {\"filter\":\"SOME_ARRAY_VALUE\",\"limit\":\"SOME_INTEGER_VALUE\",\"skip\":\"SOME_INTEGER_VALUE\",\"sort\":\"SOME_ARRAY_VALUE\",\"purpose\":\"SOME_STRING_VALUE\"}\n\nheaders = {\n    \"x-org-id\": \"SOME_STRING_VALUE\",\n    \"x-provider-id\": \"SOME_STRING_VALUE\",\n    \"x-total-count\": \"SOME_INTEGER_VALUE\",\n    \"x-api-key\": \"REPLACE_KEY_VALUE\"\n}\n\nresponse = requests.request(\"GET\", url, headers=headers, params=querystring)\n\nprint(response.text)"
      - lang: Powershell
        source: '$headers=@{}

          $headers.Add("x-org-id", "SOME_STRING_VALUE")

          $headers.Add("x-provider-id", "SOME_STRING_VALUE")

          $headers.Add("x-total-count", "SOME_INTEGER_VALUE")

          $headers.Add("x-api-key", "REPLACE_KEY_VALUE")

          $response = Invoke-RestMethod -Uri ''https://console.jumpcloud.com/api/v2/roles?filter=SOME_ARRAY_VALUE&limit=SOME_INTEGER_VALUE&skip=SOME_INTEGER_VALUE&sort=SOME_ARRAY_VALUE&purpose=SOME_STRING_VALUE'' -Method GET -Headers $headers'
    post:
      summary: Create a new role
      description: Creates a new role with the specified permissions.
      operationId: roles_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleCreate'
      responses:
        '201':
          description: Role created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/trait_standardErrors_400'
        '401':
          $ref: '#/components/responses/trait_standardErrors_401'
        '403':
          $ref: '#/components/responses/trait_standardErrors_403'
        '404':
          $ref: '#/components/responses/trait_standardErrors_404'
        '409':
          $ref: '#/components/responses/trait_standardErrors_409'
        '500':
          $ref: '#/components/responses/trait_standardErrors_500'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - x-api-key: []
      x-scopes:
      - roles
      tags:
      - Roles
      x-codeSamples:
      - lang: Shell
        source: "curl --request POST \\\n  --url https://console.jumpcloud.com/api/v2/roles \\\n  --header 'content-type: application/json' \\\n  --header 'x-api-key: REPLACE_KEY_VALUE' \\\n  --data '{\"name\":\"string\",\"scopes\":[\"string\"],\"providerId\":\"string\",\"organizationIds\":[\"string\"],\"description\":\"string\"}'"
      - lang: Python
        source: "import requests\n\nurl = \"https://console.jumpcloud.com/api/v2/roles\"\n\npayload = {\n    \"name\": \"string\",\n    \"scopes\": [\"string\"],\n    \"providerId\": \"string\",\n    \"organizationIds\": [\"string\"],\n    \"description\": \"string\"\n}\nheaders = {\n    \"x-api-key\": \"REPLACE_KEY_VALUE\",\n    \"content-type\": \"application/json\"\n}\n\nresponse = requests.request(\"POST\", url, json=payload, headers=headers)\n\nprint(response.text)"
      - lang: Powershell
        source: '$headers=@{}

          $headers.Add("x-api-key", "REPLACE_KEY_VALUE")

          $headers.Add("content-type", "application/json")

          $response = Invoke-RestMethod -Uri ''https://console.jumpcloud.com/api/v2/roles'' -Method POST -Headers $headers -ContentType ''application/json'' -Body ''{"name":"string","scopes":["string"],"providerId":"string","organizationIds":["string"],"description":"string"}'''
  /roles/{role_id}:
    parameters:
    - description: ObjectID of the role.
      in: path
      name: role_id
      required: true
      schema:
        type: string
    get:
      summary: Get a specific role
      description: Returns a specific role by its ID.
      operationId: roles_get
      parameters:
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-org-id'
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-provider-id'
      responses:
        '200':
          description: Successfully retrieved the role.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '401':
          $ref: '#/components/responses/trait_standardErrors_401'
        '403':
          $ref: '#/components/responses/trait_standardErrors_403'
        '404':
          $ref: '#/components/responses/trait_standardErrors_404'
        '409':
          $ref: '#/components/responses/trait_standardErrors_409'
        '500':
          $ref: '#/components/responses/trait_standardErrors_500'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - x-api-key: []
      x-scopes:
      - roles.readonly
      - roles
      tags:
      - Roles
      x-codeSamples:
      - lang: Shell
        source: "curl --request GET \\\n  --url https://console.jumpcloud.com/api/v2/roles/{role_id} \\\n  --header 'x-api-key: REPLACE_KEY_VALUE' \\\n  --header 'x-org-id: SOME_STRING_VALUE' \\\n  --header 'x-provider-id: SOME_STRING_VALUE'"
      - lang: Python
        source: "import requests\n\nurl = \"https://console.jumpcloud.com/api/v2/roles/{role_id}\"\n\nheaders = {\n    \"x-org-id\": \"SOME_STRING_VALUE\",\n    \"x-provider-id\": \"SOME_STRING_VALUE\",\n    \"x-api-key\": \"REPLACE_KEY_VALUE\"\n}\n\nresponse = requests.request(\"GET\", url, headers=headers)\n\nprint(response.text)"
      - lang: Powershell
        source: '$headers=@{}

          $headers.Add("x-org-id", "SOME_STRING_VALUE")

          $headers.Add("x-provider-id", "SOME_STRING_VALUE")

          $headers.Add("x-api-key", "REPLACE_KEY_VALUE")

          $response = Invoke-RestMethod -Uri ''https://console.jumpcloud.com/api/v2/roles/{role_id}'' -Method GET -Headers $headers'
    put:
      summary: Update a role
      description: Updates an existing role with the specified ID.
      operationId: roles_update
      parameters:
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-org-id'
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-provider-id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RoleUpdate'
      responses:
        '200':
          description: Successfully retrieved the role.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Role'
        '400':
          $ref: '#/components/responses/trait_standardErrors_400'
        '401':
          $ref: '#/components/responses/trait_standardErrors_401'
        '403':
          $ref: '#/components/responses/trait_standardErrors_403'
        '404':
          $ref: '#/components/responses/trait_standardErrors_404'
        '409':
          $ref: '#/components/responses/trait_standardErrors_409'
        '500':
          $ref: '#/components/responses/trait_standardErrors_500'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - x-api-key: []
      x-scopes:
      - roles
      tags:
      - Roles
      x-codeSamples:
      - lang: Shell
        source: "curl --request PUT \\\n  --url https://console.jumpcloud.com/api/v2/roles/{role_id} \\\n  --header 'content-type: application/json' \\\n  --header 'x-api-key: REPLACE_KEY_VALUE' \\\n  --header 'x-org-id: SOME_STRING_VALUE' \\\n  --header 'x-provider-id: SOME_STRING_VALUE' \\\n  --data '{\"name\":\"string\",\"scopes\":[\"string\"],\"providerId\":\"string\",\"organizationIds\":[\"string\"],\"description\":\"string\",\"organizations\":{\"add\":[\"string\"],\"remove\":[\"string\"]}}'"
      - lang: Python
        source: "import requests\n\nurl = \"https://console.jumpcloud.com/api/v2/roles/{role_id}\"\n\npayload = {\n    \"name\": \"string\",\n    \"scopes\": [\"string\"],\n    \"providerId\": \"string\",\n    \"organizationIds\": [\"string\"],\n    \"description\": \"string\",\n    \"organizations\": {\n        \"add\": [\"string\"],\n        \"remove\": [\"string\"]\n    }\n}\nheaders = {\n    \"x-org-id\": \"SOME_STRING_VALUE\",\n    \"x-provider-id\": \"SOME_STRING_VALUE\",\n    \"x-api-key\": \"REPLACE_KEY_VALUE\",\n    \"content-type\": \"application/json\"\n}\n\nresponse = requests.request(\"PUT\", url, json=payload, headers=headers)\n\nprint(response.text)"
      - lang: Powershell
        source: '$headers=@{}

          $headers.Add("x-org-id", "SOME_STRING_VALUE")

          $headers.Add("x-provider-id", "SOME_STRING_VALUE")

          $headers.Add("x-api-key", "REPLACE_KEY_VALUE")

          $headers.Add("content-type", "application/json")

          $response = Invoke-RestMethod -Uri ''https://console.jumpcloud.com/api/v2/roles/{role_id}'' -Method PUT -Headers $headers -ContentType ''application/json'' -Body ''{"name":"string","scopes":["string"],"providerId":"string","organizationIds":["string"],"description":"string","organizations":{"add":["string"],"remove":["string"]}}'''
    delete:
      summary: Delete a role
      description: Deletes a role with the specified ID.
      operationId: roles_delete
      parameters:
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-org-id'
      - $ref: '#/components/parameters/trait_multiTenantRequestHeaders_x-provider-id'
      responses:
        '204':
          description: Role deleted successfully
        '400':
          $ref: '#/components/responses/trait_standardErrors_400'
        '401':
          $ref: '#/components/responses/trait_standardErrors_401'
        '403':
          $ref: '#/components/responses/trait_standardErrors_403'
        '404':
          $ref: '#/components/responses/trait_standardErrors_404'
        '409':
          $ref: '#/components/responses/trait_standardErrors_409'
        '500':
          $ref: '#/components/responses/trait_standardErrors_500'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
      - x-api-key: []
      x-scopes:
      - roles
      tags:
      - Roles
      x-codeSamples:
      - lang: Shell
        source: "curl --request DELETE \\\n  --url https://console.jumpcloud.com/api/v2/roles/{role_id} \\\n  --header 'x-api-key: REPLACE_KEY_VALUE' \\\n  --header 'x-org-id: SOME_STRING_VALUE' \\\n  --header 'x-provider-id: SOME_STRING_VALUE'"
      - lang: Python
        source: "import requests\n\nurl = \"https://console.jumpcloud.com/api/v2/roles/{role_id}\"\n\nheaders = {\n    \"x-org-id\": \"SOME_STRING_VALUE\",\n    \"x-provider-id\": \"SOME_STRING_VALUE\",\n    \"x-api-key\": \"REPLACE_KEY_VALUE\"\n}\n\nresponse = requests.request(\"DELETE\", url, headers=headers)\n\nprint(response.text)"
      - lang: Powershell
        source: '$headers=@{}

          $headers.Add("x-org-id", "SOME_STRING_VALUE")

          $headers.Add("x-provider-id", "SOME_STRING_VALUE")

          $headers.Add("x-api-key", "REPLACE_KEY_VALUE")

          $response = Invoke-RestMethod -Uri ''https://console.jumpcloud.com/api/v2/roles/{role_id}'' -Method DELETE -Headers $headers'
components:
  responses:
    trait_standardErrors_401:
      description: Unauthenticated
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    trait_standardErrors_400:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorDetails'
    trait_standardErrors_500:
      description: Internal Server Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    trait_standardErrors_409:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    trait_standardErrors_404:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    trait_standardErrors_403:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  parameters:
    trait_skip_skip:
      description: The offset into the records to return.
      in: query
      name: skip
      required: false
      schema:
        type: integer
        minimum: 0
        default: 0
    trait_listCount_x-total-count:
      in: header
      name: x-total-count
      schema:
        type: integer
    trait_filter_filter:
      description: 'A filter to apply to the query.


        **Filter structure**: `<field>:<operator>:<value>`.


        **field** = Populate with a valid field from an endpoint response.


        **operator** =  Supported operators are: eq, ne, gt, ge, lt, le, between, search, in.

        _Note: v1 operators differ from v2 operators._


        **value** = Populate with the value you want to search for. Is case sensitive. Supports wild cards.


        **EX:** `GET /api/v2/groups?filter=name:eq:Test+Group`'
      in: query
      name: filter
      style: form
      explode: false
      schema:
        type: array
        items:
          type: string
        default: []
    trait_multiTenantRequestHeaders_x-org-id:
      description: Organization identifier that can be obtained from console settings.
      in: header
      name: x-org-id
      schema:
        type: string
    trait_multiTenantRequestHeaders_x-provider-id:
      description: Multi-tenant Provider identifier that can be obtained from console settings.
      in: header
      name: x-provider-id
      required: false
      schema:
        type: string
    trait_sort_sort:
      description: 'The comma separated fields used to sort the collection.

        Default sort is ascending, prefix with `-` to sort descending.

        '
      in: query
      name: sort
      style: form
      explode: false
      schema:
        type: array
        items:
          type: string
        default: []
    trait_limit_limit:
      description: The number of records to return at once. Limited to 100.
      in: query
      name: limit
      schema:
        type: integer
        default: 10
  schemas:
    RoleCreate:
      title: RoleCreate
      type: object
      properties:
        name:
          type: string
          description: Name of the role
        scopes:
          type: array
          description: List of permission scopes to assign to this role
          items:
            type: string
        providerId:
          type: string
          description: ID of the provider to associate with this role
        organizationIds:
          type: array
          description: List of organization IDs to associate with this role
          items:
            type: string
        description:
          type: string
          description: Description of the role and its purpose
      required:
      - name
      - scopes
    ErrorDetails:
      allOf:
      - $ref: '#/components/schemas/Error'
      - type: object
        properties:
          details:
            description: 'Describes a list of objects with more detailed information of the given error. Each detail schema is according to one of the messages defined in Google''s API: https://github.com/googleapis/googleapis/blob/master/google/rpc/error_details.proto'
            type: array
            items:
              type: object
              additionalProperties: true
              description: Object according to Google's API.
    RoleList:
      title: RoleList
      type: object
      properties:
        totalCount:
          type: integer
          format: uint64
          description: Total number of roles available.
        results:
          type: array
          description: List of roles
          items:
            $ref: '#/components/schemas/Role'
    Role:
      title: Role
      type: object
      properties:
        id:
          type: string
          description: ID of the role
        name:
          type: string
          description: Name of the role
        scopes:
          type: array
          description: List of permission scopes associated with this role.
          items:
            type: string
        providerId:
          type: string
          description: ID of the provider associated with this role.
        organizationIds:
          type: array
          description: List of organization IDs this role is associated with.
          items:
            type: string
        description:
          type: string
          description: Description of the role and its purpose
        createdBy:
          type: string
          description: ID of the user who created this role
        lastUpdatedBy:
          type: string
          description: ID of the user who last updated this role
        isCustom:
          type: boolean
          description: Indicates if this is a custom role (true) or a system role (false)
        ownerType:
          type: string
          description: Owner of the custom role. Set to `provider` for provider-owned (MSP) custom roles; omitted for organization-owned roles.
          enum:
          - provider
          readOnly: true
      required:
      - name
      - scopes
    RoleUpdate:
      title: RoleUpdate
      type: object
      properties:
        name:
          type: string
          description: Updated name of the role
        scopes:
          type: array
          description: Updated list of permission scopes for this role
          items:
            type: string
        providerId:
          type: string
          description: ID of the provider to associate with this role
        organizationIds:
          type: array
          description: List of organization IDs to associate with this role
          items:
            type: string
        description:
          type: string
          description: Description of the role and its purpose
        organizations:
          type: object
          description: Organization distribution delta for provider-owned custom roles.
          properties:
            add:
              type: array
              items:
                type: string
            remove:
              type: array
              items:
                type: string
    Error:
      title: Error
      type: object
      x-examples: {}
      description: ''
      properties:
        code:
          format: int32
          type: integer
          description: HTTP status code
        message:
          type: string
          description: Error message
        status:
          type: string
          description: HTTP status description
  securitySchemes:
    x-api-key:
      description: API key used to authenticate requests.
      in: header
      name: x-api-key
      type: apiKey
x-tagGroups:
- name: API Reference
  tags:
  - Access Requests
  - Access Risk Settings
  - Active Directory
  - Administrators
  - Agent Groups
  - Agents
  - Aggregated Policy Stats
  - App Catalog
  - Apple MDM
  - Applications
  - Assets
  - Authentication Policies
  - Bulk Job Requests
  - Commands
  - Custom Emails
  - Directories
  - Directory Insights
  - Duo
  - Email Subscriptions
  - FeatureTrials
  - G Suite
  - G Suite Import
  - GCEP
  - Google EMM
  - Graph
  - Groups
  - IP Lists
  - Identity Providers
  - Identity Risk
  - Image
  - LDAP Servers
  - Logos
  - Managed Service Provider
  - Microsoft MDM
  - Monitoring and Alerting
  - Notifications Channels
  - Object Storage
  - Office 365
  - Office 365 Import
  - Organization Feature Settings
  - Organizations
  - Password Manager
  - Password Policy
  - Password Vault
  - PasswordManagerItem
  - Policies
  - Policy Group Associations
  - Policy Group Members & Membership
  - Policy Group Templates
  - Policy Groups
  - Policytemplates
  - Privileged Access
  - Providers
  - Push Verification
  - RADIUS Servers
  - Reports
  - Roles
  - Rules
  - SCIM Import
  - SaaS App Management
  - Samba Domains
  - Sample Data
  - Saved Views
  - Scope Groups
  - Service Accounts
  - Slack Notifications
  - Software Apps
  - Subscriptions
  - System Group Associations
  - System Group Members & Membership
  - System Groups
  - System Insights
  - Systems
  - Systems Organization Settings
  - Translation Rules
  - User Group Associations
  - User Group Members & Membership
  - User Groups
  - Users
  - Webhook Notifications
  - Webhook Notifications Channels
  - Workday Import
  - Workflows
  - fde
  - mdm
x-scopes:
- accessmanagement
- accessmanagement.readonly
- accessrequest
- accessrequest.readonly
- administratorLinks
- administrators
- administrators.readonly
- agents
- agents.create
- agents.credentials.delete
- agents.credentials.readonly
- agents.credentials.update
- agents.delete
- agents.readonly
- agents.state
- agents.state.activate
- agents.state.suspend
- agents.update
- anonymous
- applications
- applications.readonly
- applications.update
- assets
- assets.readonly
- associations
- associations.applications
- associations.applications.readonly
- associations.authn
- associations.authn.readonly
- associations.commands
- associations.commands.readonly
- associations.directories
- associations.directories.readonly
- associations.groups
- associations.groups.readonly
- associations.radius
- associations.radius.readonly
- associations.readonly
- associations.self
- associations.systems
- associations.systems.readonly
- associations.users
- associations.users.readonly
- authn
- authn.readonly
- billing
- commandrunner.legacy
- commands
- commands.readonly
- directories
- directories.readonly
- directoryinsights.readonly
- groups
- groups.readonly
- groups.self
- healthmonitoring.alerts
- healthmonitoring.alerts.readonly
- healthmonitoring.rules
- healthmonitoring.rules.readonly
- identityrisk
- identityrisk.readonly
- mdm
- mdm.readonly
- mfa
- mfa.readonly
- notifications.channels
- notifications.channels.readonly
- notifications.subscriptions
- notifications.subscriptions.readonly
- organizations
- organizations.billing
- organizations.readonly
- pam
- pam.backup
- pam.blocking-rules.create
- pam.blocking-rules.delete
- pam.blocking-rules.readonly
- pam.blocking-rules.update
- pam.jump-servers.create
- pam.jump-servers.delete
- pam.jump-servers.readonly
- pam.jump-servers.update
- pam.manage-all-privileged-resources
- pam.overview
- pam.privileged-credentials.create
- pam.privileged-credentials.delete
- pam.privileged-credentials.readonly
- pam.privileged-credentials.update
- pam.privileged-databases.create
- pam.privileged-databases.delete
- pam.privileged-databases.readonly
- pam.privileged-databases.update
- pam.privileged-servers.create
- pam.privileged-servers.delete
- pam.privileged-servers.readonly
- pam.privileged-servers.update
- pam.privileged-websites.create
- pam.privileged-websites.delete
- pam.privileged-websites.readonly
- pam.privileged-websites.update
- pam.readonly
- pam.resource-managers.create
- pam.resource-managers.delete
- pam.resource-managers.readonly
- pam.resource-managers.update
- pam.session-history
- pam.user-groups.create
- pam.user-groups.delete
- pam.user-groups.readonly
- pam.user-groups.update
- partners
- partners.readonly
- passwordmanager
- passwordmanager.readonly
- protect
- providers
- providers.readonly
- radius
- radius.readonly
- reports
- reports.readonly
- roles
- roles.readonly
- saas
- saas.readonly
- serviceaccounts
- serviceaccounts.readonly
- subscriptions.readonly
- support
- support.readonly
- systeminsights.readonly
- systems
- systems.management
- systems.readonly
- transfer
- users
- users.create
- users.password
- users.password.expire
- users.properties
- users.properties.update
- users.readonly
- users.self
- users.state
- users.state.delete
- users.state.readonly
- users.state.unlock
- users.state.update
- workflows
- workflows.readonly