Opal Security non-human-identities API

openapi: 3.1.0
info:
  contact:
    email: hello@opal.dev
    name: Opal Team
    url: https://www.opal.dev/
  description: The Opal API is a RESTful API that allows you to interact with the Opal Security platform programmatically.
  title: Opal access-rules non-human-identities API
  version: '1.0'
servers:
- description: Production
  url: https://api.opal.dev/v1
tags:
- name: non-human-identities
  description: Operations related to non-human identities
paths:
  /non-human-identities:
    get:
      description: Returns a list of non-human identities for your organization.
      operationId: get_nhis
      parameters:
      - description: The pagination cursor value.
        example: cD0yMDIxLTAxLTA2KzAzJTNBMjQlM0E1My40MzQzMjYlMkIwMCUzQTAw
        explode: true
        in: query
        name: cursor
        required: false
        schema:
          type: string
        style: form
      - description: Number of results to return per page. Default is 200.
        example: 200
        explode: true
        in: query
        name: page_size
        required: false
        schema:
          type: integer
          maximum: 1000
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResourcesList'
          description: One page worth non-human identities in your organization.
      security:
      - BearerAuth: []
      tags:
      - non-human-identities
components:
  schemas:
    Resource:
      description: '# Resource Object

        ### Description

        The `Resource` object is used to represent a resource.


        ### Usage Example

        Update from the `UPDATE Resources` endpoint.'
      example:
        resource_id: f454d283-ca87-4a8a-bdbb-df212eca5353
        app_id: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
        description: This resource represents AWS IAM role "SupportUser".
        admin_owner_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        remote_id: 318038399
        remote_name: repo-name
        max_duration: 120
        require_manager_approval: false
        require_support_ticket: false
        parent_resource_id: f454d283-ca67-4a8a-bdbb-df212eca5345
        ancestor_resource_ids:
        - f454d283-ca67-4a8a-bdbb-df212eca5345
        descendant_resource_ids:
        - f454d283-ca67-4a8a-bdbb-df212eca5345
      properties:
        resource_id:
          description: The ID of the resource.
          example: f454d283-ca87-4a8a-bdbb-df212eca5353
          format: uuid
          type: string
        app_id:
          description: The ID of the app.
          example: b5a5ca27-0ea3-4d86-9199-2126d57d1fbd
          format: uuid
          type: string
        name:
          description: The name of the resource.
          example: mongo-db-prod
          type: string
        description:
          description: A description of the resource.
          example: This resource represents AWS IAM role "SupportUser".
          type: string
        admin_owner_id:
          description: The ID of the owner of the resource.
          example: 7c86c85d-0651-43e2-a748-d69d658418e8
          format: uuid
          type: string
        remote_resource_id:
          description: The ID of the resource on the remote system.
          example: 318038399
          type: string
        remote_resource_name:
          description: The name of the resource on the remote system.
          example: repo-name
          type: string
        resource_type:
          $ref: '#/components/schemas/ResourceTypeEnum'
        max_duration:
          description: The maximum duration for which the resource can be requested (in minutes).
          type: integer
          example: 120
        recommended_duration:
          description: The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        extensions_duration_in_minutes:
          description: The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.
          type: integer
          example: 120
        require_manager_approval:
          description: A bool representing whether or not access requests to the resource require manager approval.
          example: false
          type: boolean
          deprecated: true
        require_support_ticket:
          description: A bool representing whether or not access requests to the resource require an access ticket.
          example: false
          type: boolean
        require_mfa_to_approve:
          description: A bool representing whether or not to require MFA for reviewers to approve requests for this resource.
          example: false
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this resource.
          example: false
          type: boolean
        require_mfa_to_connect:
          description: A bool representing whether or not to require MFA to connect to this resource.
          example: false
          type: boolean
        auto_approval:
          description: A bool representing whether or not to automatically approve requests to this resource.
          example: false
          type: boolean
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        is_requestable:
          description: A bool representing whether or not to allow access requests to this resource.
          example: false
          type: boolean
        parent_resource_id:
          description: The ID of the parent resource.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4305
          format: uuid
          type: string
        configuration_template_id:
          description: The ID of the associated configuration template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        request_configurations:
          type: array
          items:
            $ref: '#/components/schemas/RequestConfiguration'
          description: A list of configurations for requests to this resource.
        request_configuration_list:
          description: A list of configurations for requests to this resource. Deprecated in favor of `request_configurations`.
          deprecated: true
          items:
            $ref: '#/components/schemas/RequestConfiguration'
          type: array
        ticket_propagation:
          $ref: '#/components/schemas/TicketPropagationConfiguration'
        custom_request_notification:
          description: Custom request notification sent upon request approval.
          type: string
          maxLength: 800
          nullable: true
        risk_sensitivity:
          description: The risk sensitivity level for the resource. When an override is set, this field will match that.
          readOnly: true
          allOf:
          - $ref: '#/components/schemas/RiskSensitivityEnum'
        risk_sensitivity_override:
          allOf:
          - $ref: '#/components/schemas/RiskSensitivityEnum'
        metadata:
          description: JSON metadata about the remote resource. Only set for items linked to remote systems. See [this guide](https://docs.opal.dev/reference/end-system-objects) for details.
          deprecated: true
          example: "{\n  \"okta_directory_role\":\n    {\n      \"role_id\": \"SUPER_ADMIN-b52aa037-4a35-4ac3-9350-f6260fd12345\",\n      \"role_type\": \"SUPER_ADMIN\",\n    },\n}"
          type: string
        remote_info:
          $ref: '#/components/schemas/ResourceRemoteInfo'
        ancestor_resource_ids:
          description: List of resource IDs that are ancestors of this resource.
          type: array
          items:
            format: uuid
            type: string
          example:
          - f454d283-ca67-4a8a-bdbb-df212eca5345
          - f454d283-ca67-4a8a-bdbb-df212eca5346
        descendant_resource_ids:
          description: List of resource IDs that are descendants of this resource.
          type: array
          items:
            format: uuid
            type: string
          example:
          - f454d283-ca67-4a8a-bdbb-df212eca5347
          - f454d283-ca67-4a8a-bdbb-df212eca5348
        last_successful_sync:
          readOnly: true
          description: Information about the last successful sync of this resource.
          $ref: '#/components/schemas/SyncTask'
      required:
      - resource_id
      type: object
    RDSEngineEnum:
      type: string
      description: The database engine for the RDS instance.
      enum:
      - MYSQL
      - POSTGRESQL
    RequestConfiguration:
      description: '# Request Configuration Object

        ### Description

        The `RequestConfiguration` object is used to represent a request configuration.


        ### Usage Example

        Returned from the `GET Request Configurations` endpoint.'
      example:
        request_configuration_id: 7c86c85d-0651-43e2-a748-d69d658418e8
        organization_id: w86c85d-0651-43e2-a748-d69d658418e8
        created_at: 2021-01-06 20:00:00+00:00
        updated_at: 2021-01-06 20:00:00+00:00
        condition:
          group_id: 1b978423-db0a-4037-a4cf-f79c60cb67b3
        allow_requests: true
        auto_approval: false
        require_mfa_to_request: false
        max_duration_minutes: 120
        recommended_duration_minutes: 120
        require_support_ticket: false
        reviewer_stages:
        - reviewer_stage_id: 7c86c85d-0651-43e2-a748-d69d658418e8
          owner_ids:
          - 37cb7e41-12ba-46da-92ff-030abe0450b1
          - 37cb7e41-12ba-46da-92ff-030abe0450b2
          stage: 1
        priority: 1
      type: object
      properties:
        condition:
          description: The condition for the request configuration.
          $ref: '#/components/schemas/Condition'
        allow_requests:
          description: A bool representing whether or not to allow requests for this resource.
          example: true
          type: boolean
        auto_approval:
          description: A bool representing whether or not to automatically approve requests for this resource.
          example: false
          type: boolean
        require_mfa_to_request:
          description: A bool representing whether or not to require MFA for requesting access to this resource.
          example: false
          type: boolean
        max_duration_minutes:
          description: The maximum duration for which the resource can be requested (in minutes).
          type: integer
          example: 120
        recommended_duration_minutes:
          description: The recommended duration for which the resource should be requested (in minutes). -1 represents an indefinite duration.
          type: integer
          example: 120
        require_support_ticket:
          description: A bool representing whether or not access requests to the resource require an access ticket.
          example: false
          type: boolean
        extensions_duration_in_minutes:
          description: The duration for which access can be extended (in minutes). Set to 0 to disable extensions. When > 0, extensions are enabled for the specified duration.
          type: integer
          example: 120
        request_template_id:
          description: The ID of the associated request template.
          example: 06851574-e50d-40ca-8c78-f72ae6ab4304
          format: uuid
          type: string
        reviewer_stages:
          description: The list of reviewer stages for the request configuration.
          items:
            $ref: '#/components/schemas/ReviewerStage'
          type: array
        priority:
          description: The priority of the request configuration.
          example: 1
          type: integer
      required:
      - organization_id
      - allow_requests
      - auto_approval
      - require_mfa_to_request
      - require_support_ticket
      - priority
    Condition:
      description: '# Condition Object

        ### Description

        The `Condition` object is used to represent a condition.


        ### Usage Example

        Used to match request configurations to users in `RequestConfiguration`'
      example:
        group_ids:
        - 1b978423-db0a-4037-a4cf-f79c60cb67b3
      type: object
      properties:
        group_ids:
          description: The list of group IDs to match.
          example:
          - 1b978423-db0a-4037-a4cf-f79c60cb67b3
          items:
            type: string
            format: uuid
          type: array
        role_remote_ids:
          description: The list of role remote IDs to match.
          example:
          - arn:aws:iam::590304332660:role/AdministratorAccess
          type: array
          items:
            type: string
    ResourceRemoteInfo:
      description: Information that defines the remote resource. This replaces the deprecated remote_id and metadata fields.
      properties:
        databricks_account_service_principal:
          description: Remote info for Databricks account service principal.
          properties:
            application_id:
              description: The application ID of the service principal.
              example: 00000000-0000-0000-0000-000000000000
              type: string
            resource_id:
              description: The resource ID of the service principal.
              example: 00000000-0000-0000-0000-000000000000
              type: string
          type: object
          required:
          - application_id
          - resource_id
        azure_subscription:
          description: Remote info for Azure subscription.
          properties:
            resource_id:
              description: The ARM resource ID of the subscription.
              example: /subscriptions/00000000-0000-0000-0000-000000000000
              type: string
          type: object
          required:
          - resource_id
        azure_resource_group:
          description: Remote info for Azure resource group.
          properties:
            resource_id:
              description: The ARM resource ID of the resource group.
              example: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg
              type: string
          type: object
          required:
          - resource_id
        azure_management_group:
          description: Remote info for Azure management group.
          properties:
            resource_id:
              description: The ARM resource ID of the management group.
              example: /providers/Microsoft.Management/managementGroups/my-mg
              type: string
          type: object
          required:
          - resource_id
        azure_virtual_machine:
          description: Remote info for Azure virtual machine.
          properties:
            resource_id:
              description: The ARM resource ID of the virtual machine.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Compute/virtualMachines/vm01
              type: string
          type: object
          required:
          - resource_id
        azure_storage_account:
          description: Remote info for Azure storage account.
          properties:
            resource_id:
              description: The ARM resource ID of the storage account.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/sa01
              type: string
          type: object
          required:
          - resource_id
        azure_storage_container:
          description: Remote info for Azure storage container.
          properties:
            resource_id:
              description: The ARM resource ID of the storage container.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/sa01/blobServices/default/containers/c01
              type: string
          type: object
          required:
          - resource_id
        azure_sql_server:
          description: Remote info for Azure SQL server.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL server.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/servers/sqldev01
              type: string
          type: object
          required:
          - resource_id
        azure_sql_database:
          description: Remote info for Azure SQL database.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL database.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/servers/sqldev01/databases/db01
              type: string
          type: object
          required:
          - resource_id
        azure_sql_managed_instance:
          description: Remote info for Azure SQL managed instance.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL managed instance.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/managedInstances/mi01
              type: string
          type: object
          required:
          - resource_id
        azure_sql_managed_database:
          description: Remote info for Azure SQL managed database.
          properties:
            resource_id:
              description: The ARM resource ID of the SQL managed database.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.Sql/managedInstances/mi01/databases/midb01
              type: string
          type: object
          required:
          - resource_id
        azure_user_assigned_managed_identity:
          description: Remote info for Azure user assigned managed identity.
          properties:
            resource_id:
              description: The ARM resource ID of the user assigned managed identity.
              example: /subscriptions/0000/resourceGroups/rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id01
              type: string
          type: object
          required:
          - resource_id
        azure_enterprise_app:
          description: Remote info for Azure Enterprise App.
          properties:
            resource_id:
              description: The remote application identifier (service principal or application object ID).
              example: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
              type: string
          type: object
          required:
          - resource_id
        azure_entra_id_role:
          description: Remote info for Azure Entra ID role.
          properties:
            resource_id:
              description: The remote role identifier from Entra (object ID).
              example: 11111111-2222-3333-4444-555555555555
              type: string
          type: object
          required:
          - resource_id
        aws_organizational_unit:
          description: Remote info for AWS organizational unit.
          properties:
            parent_id:
              description: The id of the parent organizational unit.
              example: ou-1234
              type: string
            organizational_unit_id:
              description: The id of the AWS organizational unit that is being created.
              example: ou-1234
              type: string
          type: object
          required:
          - organizational_unit_id
        aws_account:
          description: Remote info for AWS account.
          properties:
            account_id:
              description: The id of the AWS account.
              example: 234234234234
              type: string
            organizational_unit_id:
              description: The id of the AWS organizational unit. Required only if customer has OUs enabled.
              example: ou-1234
              type: string
          type: object
          required:
          - account_id
        aws_permission_set:
          description: Remote info for AWS Identity Center permission set.
          properties:
            arn:
              description: The ARN of the permission set.
              example: arn:aws:sso:::permissionSet/asdf-32139302d201d32/ps-f03323201211e1b9
              type: string
            account_id:
              description: The ID of an AWS account to which this permission set is provisioned.
              example: 234234234234
              type: string
          type: object
          required:
          - arn
          - account_id
        aws_iam_role:
          description: Remote info for AWS IAM role.
          properties:
            arn:
              description: The ARN of the IAM role.
              example: arn:aws:iam::179308207300:role/MyRole
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
          - arn
        aws_ec2_instance:
          description: Remote info for AWS EC2 instance.
          properties:
            instance_id:
              description: The instanceId of the EC2 instance.
              example: i-13f1a1e2899f9e93a
              type: string
            region:
              description: The region of the EC2 instance.
              example: us-east-2
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
          - instance_id
          - region
        aws_rds_cluster:
          description: Remote info for AWS RDS cluster.
          properties:
            cluster_id:
              description: The clusterId of the RDS cluster.
              example: demo-mysql-cluster
              type: string
            region:
              description: The region of the RDS cluster.
              example: us-east-2
              type: string
            resource_id:
              description: The resourceId of the RDS cluster.
              example: cluster-AOO8V0XUCNU13XLZXQDQRSN0NQ
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
            database_name:
              description: The name of the database in the RDS cluster. This can be the value of the tag `opal:database-name` or the database name.
              example: mydatabase
              type: string
            engine:
              allOf:
              - $ref: '#/components/schemas/RDSEngineEnum'
          type: object
          required:
          - cluster_id
          - region
          - resource_id
          - account_id
          - database_name
          - engine
        aws_rds_instance:
          description: Remote info for AWS RDS instance.
          properties:
            instance_id:
              description: The instanceId of the RDS instance.
              example: demo-mysql-db
              type: string
            region:
              description: The region of the RDS instance.
              example: us-east-2
              type: string
            resource_id:
              description: The resourceId of the RDS instance.
              example: db-AOO8V0XUCNU13XLZXQDQRSN0NQ
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
          - instance_id
          - region
          - resource_id
        aws_eks_cluster:
          description: Remote info for AWS EKS cluster.
          properties:
            arn:
              description: The ARN of the EKS cluster.
              example: arn:aws:eks:us-east-2:234234234234:cluster/testcluster
              type: string
            account_id:
              description: The id of the AWS account. Required for AWS Organizations.
              example: 234234234234
              type: string
          type: object
          required:
          - arn
        custom_connector:
          description: Remote info for a custom connector resource.
          properties:
            remote_resource_id:
              description: The id of the resource in the end system
              example: 01fa7402-01d8-103b-8deb-5f3a0ab7884
              type: string
            can_have_usage_events:
              description: A bool representing whether or not the resource can have usage data.
              example: false
              type: boolean
          type: object
          required:
          - remote_resource_id
          - can_have_usage_events
        gcp_organization:
          description: Remote info for GCP organization.
          properties:
            organization_id:
              description: The id of the organization.
              example: organizations/898931321
              type: string
          type: object
          required:
          - organization_id
        gcp_bucket:
          description: Remote info for GCP bucket.
          properties:
            bucket_id:
              description: The id of the bucket.
              example: example-bucket-898931321
              type: string
          type: object
          required:
          - bucket_id
        gcp_compute_instance:
          description: Remote info for GCP compute instance.
          properties:
            instance_id:
              description: The id of the instance.
              example: example-instance-898931321
              type: string
            project_id:
              description: The id of the project the instance is in.
              example: example-project-898931321
              type: string
            zone:
              description: The zone the instance is in.
              example: us-central1-a
              type: string
          type: object
          required:
          - instance_id
          - project_id
          - zone
        gcp_big_query_dataset:
          description: Remote info for GCP BigQuery Dataset.
          properties:
            project_id:
              description: The id of the project the dataset is in.
              example: example-project-898931321
              type: string
            dataset_id:
              description: The id of the dataset.
              example: example-dataset-898931321
              type: string
          type: object
          required:
          - project_id
          - dataset_id
        gcp_big_query_table:
          description: Remote info for GCP BigQuery Table.
          properties:
            project_id:
              description: The id of the project the table is in.
              example: example-project-898931321
              type: string
            dataset_id:
              description: The id of the dataset the table is in.
              example: example-dataset-898931321
              type: string
            table_id:
              description: The id of the table.
              example: example-table-898931321
              type: string
          type: object
          required:
          - project_id
          - dataset_id
          - table_id
        gcp_folder:
          description: Remote info for GCP folder.
          properties:
            folder_id:
              description: The id of the folder.
              example: folder/898931321
              type: string
          type: object
          required:
          - folder_id
        gcp_gke_cluster:
          description: Remote info for GCP GKE cluster.
          properties:
            cluster_name:
              description: The name of the GKE cluster.
              example: example-cluster-898931321
              type: string
          type: object
          required:
          - cluster_name
        gcp_project:
          description: Remote info for GCP project.
          properties:
            project_id:
              description: The id of the project.
              example: example-project-898931321
              type: string
          type: object
          required:
          - project_id
        gcp_sql_instance:
          description: Remote info for GCP SQL instance.
          properties:
            instance_id:
              description: The id of the SQL instance.
              example: example-sql-898931321
              type: string
            project_id:
              description: The id of the project the instance is in.
              example: example-project-898931321
              type: string
          type: object
          required:
          - instance_id
          - project_id
        gcp_service_account:
          description: Remote info for a GCP service account.
          properties:
            email:
              description: The email of the service account.
              example: production@project.iam.gserviceaccount.com
              type: string
            service_account_id:
              description: The id of the service account.
              example: 103561576023829460000
              type: string
            project_id:
              description: The id of the project the service account is in.
              example: example-project-898931321
              type: string
          type: object
          required:
          - email
          - service_account_id
          - project_id
        google_workspace_role:
          description: Remote info for GCP workspace role.
          properties:
            role_id:
              description: The id of the role.
              example: google-workspace-role:01234567890123456
              type: string
          type: object
          required:
          - role_id
        github_repo:
          description: Remote info for GitHub repository.
          properties:
            repo_id:
              deprecated: true
              description: The id of the repository.
              example: 898931321
              type: string
            repo_name:
              description: The name of the repository.
              example: Opal Security
              type: string
            org_name:
              description: GitHub repo's org name, required only for Enterprise.
              type: string
          type: object
          required:
          - repo_name
        github_org_role:
          description: Remote info for GitHub organization role.
          properties:
            role_id:
              description: The id of the role.
              example: 112233
              type: string
            org_name:
              description: GitHub org role's org name, required only for Enterprise.
              type: string
          type: object
          required:
          - role_id
        github_org:
          description: Remote info for GitHub organization.
          properties:
            org_name:
              description: The name of the organization.
              example: Opal Security
              type: string
          type: object
          required:
          - org_name
        github_enterprise_role:
          description: Remote info for GitHub Enterprise role.
          properties:
            role_id:
              description: The id of the role.
              example: 112233
              type: string
          type: object
          required:
          - role_id
        gitlab_project:
          description: Remote info for Gitlab project.
          properties:
            project_id:
              description: The id of the project.
              example: 898931321
              type: string
          type: object
          required:
          - project_id
        okta_app:
          description: Remote info for Okta directory app.
          properties:
            app_id:
              description: The id of the app.
              example: a9dfas0f678asdf67867
              type: string
          type: object
          required:
          - app_id
        okta_standard_role:
          description: Remote info for Okta directory standard role.
          properties:
            role_type:
              description: The type of the standard role.
              example: ORG_ADMIN
              type: string
          type: object
 

# --- truncated at 32 KB (49 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/opal-security/refs/heads/main/openapi/opal-security-non-human-identities-api-openapi.yml