Oracle Operator Control API

openapi: 3.2.0
info:
  description: "Operator Access Control enables you to control the time duration and the actions an Oracle operator can perform on your Exadata Cloud@Customer infrastructure.\nUsing logging service, you can view a near real-time audit report of all actions performed by an Oracle operator. \n"
  title: Operator Access Control Operator Control API
  version: '20200630'
  x-provenance:
    method: harvested
    first_party: true
    publisher: Oracle
    source: https://docs.oracle.com/en-us/iaas/api/specs/9cf6d46a3ebf1062eb0a9b386e1727a9f1b39525782fc49580c4ba13b79c72fa.yaml
    harvested: '2026-08-04'
    note: Published by Oracle as the contract for the Operator Access Control API OCI service and stored verbatim; API Evangelist added only this provenance block.
  x-evidence:
  - url: https://docs.oracle.com/en-us/iaas/api/specs/index.json
    what: Oracle's own index of every OCI service specification
  - url: https://docs.oracle.com/en-us/iaas/api/specs/9cf6d46a3ebf1062eb0a9b386e1727a9f1b39525782fc49580c4ba13b79c72fa.yaml
    what: the harvested document for Operator Access Control API
servers:
- url: http://127.0.0.1/20200630
- url: https://127.0.0.1/20200630
tags:
- name: operatorControl
paths:
  /operatorControls:
    get:
      description: 'Lists the operator controls in the compartment.

        '
      operationId: ListOperatorControls
      parameters:
      - $ref: '#/components/parameters/CompartmentIdQueryParam'
      - $ref: '#/components/parameters/OperatorControlLifecycleStateQueryParam'
      - $ref: '#/components/parameters/OperatorControlQueryParam'
      - $ref: '#/components/parameters/PaginationLimitQueryParam'
      - $ref: '#/components/parameters/PaginationTokenQueryParam'
      - $ref: '#/components/parameters/SortOrderQueryParam'
      - $ref: '#/components/parameters/SortByQueryParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: Returns OperatorControlCollection object.
          headers:
            opc-next-page:
              description: 'For pagination of a list of items. When paging through a list, if this header appears in the response,

                then a partial list might have been returned. Include this value as the `page` parameter for the

                subsequent GET request to get the next batch of items.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperatorControlCollection'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Lists the operator controls in the compartment.
      tags:
      - operatorControl
      x-related-resource: '#/definitions/OperatorControl'
    post:
      description: 'Creates an Operator Control.

        '
      operationId: CreateOperatorControl
      parameters:
      - $ref: '#/components/parameters/RetryTokenHeader'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: Creates and Returns the operator control object.
          headers:
            etag:
              description: 'For optimistic concurrency control. See `if-match`.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperatorControl'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        409:
          $ref: '#/components/responses/409'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Creates a new Operator Control
      tags:
      - operatorControl
      x-related-resource: '#/definitions/OperatorControl'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOperatorControlDetails'
        description: Details for the new Operator Control.
        required: true
  /operatorControls/{operatorControlId}:
    delete:
      description: "Deletes an Operator Control. You cannot delete an Operator Control if it is assigned to govern any target resource currently or in the future.\nIn that case, first, delete all of the current and future assignments before deleting the Operator Control. An Operator Control that was previously assigned to a target \nresource is marked as DELETED following a successful deletion. However, it is not completely deleted from the system. This is to ensure auditing information for the accesses \ndone under the Operator Control is preserved for future needs. The system purges the deleted Operator Control only when all of the audit data associated with the \nOperator Control are also deleted. Therefore, you cannot reuse the name of the deleted Operator Control until the system purges the Operator Control.\n"
      operationId: DeleteOperatorControl
      parameters:
      - $ref: '#/components/parameters/OperatorControlIdentifierPathParam'
      - $ref: '#/components/parameters/DeleteOperatorDescQueryParam'
      - $ref: '#/components/parameters/IfMatchHeader'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        204:
          description: Successfully deleted the Operator Control object.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        412:
          $ref: '#/components/responses/412'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Deletes an operator control.
      tags:
      - operatorControl
      x-related-resource: '#/definitions/OperatorControl'
    get:
      description: Gets the Operator Control associated with the specified Operator Control ID.
      operationId: GetOperatorControl
      parameters:
      - $ref: '#/components/parameters/OperatorControlIdentifierPathParam'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: Returns the OperatorControl object
          headers:
            etag:
              description: 'For optimistic concurrency control. See `if-match`.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperatorControl'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Gets the Operator Control associated with the specified Operator Control ID.
      tags:
      - operatorControl
      x-related-resource: '#/definitions/OperatorControl'
    put:
      description: 'Modifies the existing OperatorControl for a given operator control id except the operator control id.

        '
      operationId: UpdateOperatorControl
      parameters:
      - $ref: '#/components/parameters/OperatorControlIdentifierPathParam'
      - $ref: '#/components/parameters/IfMatchHeader'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        200:
          description: Updates and returns the OperatorControl object with the updated details
          headers:
            etag:
              description: 'For optimistic concurrency control. See `if-match`.

                '
              schema:
                type: string
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OperatorControl'
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        409:
          $ref: '#/components/responses/409'
        412:
          $ref: '#/components/responses/412'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Modifies the existing OperatorControl for a given operator control id
      tags:
      - operatorControl
      x-related-resource: '#/definitions/OperatorControl'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOperatorControlDetails'
        description: Details for the new OperatorControl.
        required: true
  /operatorControls/{operatorControlId}/actions/changeCompartment:
    post:
      description: 'Moves the Operator Control resource into a different compartment. When provided, ''If-Match'' is checked against ''ETag'' values of the resource.

        '
      operationId: ChangeOperatorControlCompartment
      parameters:
      - $ref: '#/components/parameters/OperatorControlIdentifierPathParam'
      - $ref: '#/components/parameters/RetryTokenHeader'
      - $ref: '#/components/parameters/IfMatchHeader'
      - $ref: '#/components/parameters/RequestIdHeader'
      responses:
        204:
          description: The Operator Control resource has been successfully moved to the new compartment.
          headers:
            opc-request-id:
              description: 'Unique Oracle-assigned identifier for the request. If you need to contact

                Oracle about a particular request, please provide the request ID.

                '
              schema:
                type: string
        400:
          $ref: '#/components/responses/400'
        401:
          $ref: '#/components/responses/401'
        404:
          $ref: '#/components/responses/404'
        409:
          $ref: '#/components/responses/409'
        412:
          $ref: '#/components/responses/412'
        429:
          $ref: '#/components/responses/429'
        500:
          $ref: '#/components/responses/500'
        default:
          $ref: '#/components/responses/default'
      summary: Moves the Operator Control resource into a different compartment. When provided, 'If-Match' is checked against 'ETag' values of the resource.
      tags:
      - operatorControl
      x-related-resource: '#/definitions/OperatorControl'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ChangeOperatorControlCompartmentDetails'
        description: Moves the Operator Control resource into a different compartment.
        required: true
components:
  parameters:
    PaginationTokenQueryParam:
      description: The page token representing the page at which to start retrieving results. This is usually retrieved from a previous list call.
      in: query
      name: page
      schema:
        type: string
        maxLength: 1024
        minLength: 1
    SortByQueryParam:
      description: 'The field to sort by. Only one sort order may be provided. Default order for timeCreated is descending. Default order for displayName is ascending. If no value is specified timeCreated is default.

        '
      in: query
      name: sortBy
      schema:
        type: string
        enum:
        - timeCreated
        - displayName
        default: timeCreated
    CompartmentIdQueryParam:
      description: The ID of the compartment in which to list resources.
      in: query
      name: compartmentId
      required: true
      schema:
        type: string
    IfMatchHeader:
      description: 'For optimistic concurrency control. In the PUT or DELETE call

        for a resource, set the `if-match` parameter to the value of the

        etag from a previous GET or POST response for that resource.

        The resource will be updated or deleted only if the etag you

        provide matches the resource''s current etag value.

        '
      in: header
      name: if-match
      required: false
      schema:
        type: string
    PaginationLimitQueryParam:
      description: The maximum number of items to return.
      in: query
      name: limit
      schema:
        type: integer
        default: 10
        maximum: 1000
        minimum: 1
    OperatorControlIdentifierPathParam:
      description: unique OperatorControl identifier
      in: path
      name: operatorControlId
      required: true
      schema:
        type: string
    SortOrderQueryParam:
      description: The sort order to use, either 'asc' or 'desc'.
      in: query
      name: sortOrder
      x-obmcs-top-level-enum: '#/definitions/SortOrders'
      schema:
        type: string
        enum:
        - ASC
        - DESC
        default: DESC
    DeleteOperatorDescQueryParam:
      description: reason for deletion of OperatorControl.
      in: query
      name: description
      x-default-description: 'null'
      schema:
        type: string
        maxLength: 250
        minLength: 0
    OperatorControlLifecycleStateQueryParam:
      description: A filter to return only resources whose lifecycleState matches the given OperatorControl lifecycleState.
      in: query
      name: lifecycleState
      required: false
      x-default-description: 'null'
      x-obmcs-top-level-enum: '#/definitions/OperatorControlLifecycleStates'
      schema:
        type: string
        enum:
        - CREATED
        - ASSIGNED
        - UNASSIGNED
        - DELETED
    RetryTokenHeader:
      description: 'A token that uniquely identifies a request so it can be retried in case of a timeout or

        server error without risk of executing that same action again. Retry tokens expire after 24

        hours, but can be invalidated before then due to conflicting operations. For example, if a resource

        has been deleted and purged from the system, then a retry of the original creation request

        might be rejected.

        '
      in: header
      name: opc-retry-token
      required: false
      schema:
        type: string
        maxLength: 64
        minLength: 1
    RequestIdHeader:
      description: The client request ID for tracing.
      in: header
      name: opc-request-id
      schema:
        type: string
    OperatorControlQueryParam:
      description: A filter to return OperatorControl that match the entire display name given.
      in: query
      name: displayName
      x-default-description: 'null'
      schema:
        type: string
        maxLength: 255
        minLength: 1
  schemas:
    Error:
      description: Error Information.
      properties:
        code:
          description: A short error code that defines the error, meant for programmatic parsing.
          type: string
        message:
          description: A human-readable error string.
          type: string
      required:
      - code
      - message
    ChangeOperatorControlCompartmentDetails:
      description: Details of the new compartment to contain the operator control.
      properties:
        compartmentId:
          description: The OCID of the new compartment to contain the operator contol.
          maxLength: 255
          minLength: 1
          type: string
    OperatorControlCollection:
      description: Results of Operator Control search, which contains summary of the operator control.
      properties:
        items:
          description: contains OperatorControlSummary
          items:
            $ref: '#/components/schemas/OperatorControlSummary'
          type: array
      required:
      - items
      type: object
    OperatorControlSummary:
      description: Summary of the OperatorControl.
      properties:
        compartmentId:
          description: The OCID of the compartment that contains the operator control.
          type: string
        definedTags:
          additionalProperties:
            additionalProperties:
              description: 'The value of the tag. Only string, integer and boolean types are supported.

                '
              type: object
            description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace.

              '
            type: object
          description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace.

            '
          type: object
        freeformTags:
          additionalProperties:
            type: string
          description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.

            '
          type: object
        id:
          description: The OCID of the operator control.
          type: string
        isFullyPreApproved:
          description: Whether all operator actions are pre-approved. If yes, an access request associated with a resource governed by the operator control will be automatically approved by the system.
          type: boolean
        lifecycleState:
          description: The current lifecycle state of the operator control.
          enum:
          - CREATED
          - ASSIGNED
          - UNASSIGNED
          - DELETED
          type: string
          x-obmcs-top-level-enum: '#/definitions/OperatorControlLifecycleStates'
        operatorControlName:
          description: Name of the operator control.
          type: string
        timeOfCreation:
          description: 'Time when the operator control was created, expressed in [RFC 3339] (https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z''

            '
          format: date-time
          type: string
        timeOfDeletion:
          description: 'Time when the operator control was deleted, expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z''

            '
          format: date-time
          type: string
        timeOfModification:
          description: 'Time when the operator control was last modified, expressed in [RFC 3339] (https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z''

            '
          format: date-time
          type: string
      required:
      - id
      - operatorControlName
      type: object
    UpdateOperatorControlDetails:
      description: Information about the new operator control.
      properties:
        approverGroupsList:
          description: List of user groups who can approve an access request associated with a target resource under the governance of this operator control.
          items:
            type: string
          type: array
        approversList:
          description: List of users who can approve an access request associated with a target resource under the governance of this operator control.
          items:
            type: string
          type: array
        definedTags:
          additionalProperties:
            additionalProperties:
              description: 'The value of the tag. Only string, integer and boolean types are supported.

                '
              type: object
            description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace.

              '
            type: object
          description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace.

            '
          type: object
        description:
          description: Description of the operator control.
          type: string
        emailIdList:
          description: 'List of emailId.

            '
          items:
            type: string
          type: array
        freeformTags:
          additionalProperties:
            type: string
          description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.

            '
          type: object
        isFullyPreApproved:
          description: "Whether all the operator actions have been pre-approved. If yes, all access requests associated with a resource governed by this operator control \nwill be auto-approved.\n"
          type: boolean
        notificationTopicId:
          description: The OCID of the OCI Notification topic to publish messages related to this operator control.
          maxLength: 255
          minLength: 1
          type: string
        operatorControlName:
          description: Name of the operator control.
          maxLength: 255
          minLength: 1
          type: string
        preApprovedOpActionList:
          description: "List of pre-approved operator actions. Access requests associated with a resource governed by this operator control will be\nautomatically approved if the access request only contain operator actions in the pre-approved list.    \n"
          items:
            type: string
          type: array
        systemMessage:
          description: System message that would be displayed to the operator users on accessing the target resource under the governance of this operator control.
          type: string
      required:
      - operatorControlName
      - isFullyPreApproved
      - approverGroupsList
      type: object
    OperatorControl:
      description: 'Operator Access Control enables you to grant, audit, or revoke the access Oracle has to your Exadata Cloud@Customer infrastructure, and obtain audit reports of all actions taken by a human operator, in a near real-time manner.

        '
      properties:
        approvalRequiredOpActionList:
          description: "List of operator actions that need explicit approval. Any operator action not in the pre-approved list will require explicit\napproval. Access requests associated with a resource governed by this operator control will be\nrequire explicit approval if the access request contains any operator action in this list. \n"
          items:
            type: string
          type: array
        approverGroupsList:
          description: List of user groups who can approve an access request associated with a target resource under the governance of this operator control.
          items:
            type: string
          type: array
        approversList:
          description: List of users who can approve an access request associated with a target resource under the governance of this operator control.
          items:
            type: string
          type: array
        compartmentId:
          description: The OCID of the compartment that contains the operator control.
          maxLength: 255
          minLength: 1
          type: string
        definedTags:
          additionalProperties:
            additionalProperties:
              description: 'The value of the tag. Only string, integer and boolean types are supported.

                '
              type: object
            description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace.

              '
            type: object
          description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace.

            '
          type: object
        description:
          description: Description of operator control.
          type: string
        emailIdList:
          description: 'List of emailId.

            '
          items:
            type: string
          type: array
        freeformTags:
          additionalProperties:
            type: string
          description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.

            '
          type: object
        id:
          description: The OCID of the operator control.
          type: string
        isDefaultOperatorControl:
          description: 'Whether the operator control is a default Operator Control.

            '
          type: boolean
        isFullyPreApproved:
          description: "Whether all the operator actions have been pre-approved. If yes, all access requests associated with a resource governed by this operator control \nwill be auto-approved.\n"
          type: boolean
        lastModifiedInfo:
          description: Description associated with the latest modification of the operator control.
          type: string
        lifecycleState:
          description: The current lifecycle state of the operator control.
          enum:
          - CREATED
          - ASSIGNED
          - UNASSIGNED
          - DELETED
          type: string
          x-obmcs-top-level-enum: '#/definitions/OperatorControlLifecycleStates'
        notificationTopicId:
          description: The OCID of the OCI Notification topic to publish messages related to this operator control.
          maxLength: 255
          minLength: 1
          type: string
        operatorControlName:
          description: Name of the operator control. The name must be unique.
          maxLength: 255
          minLength: 1
          type: string
        preApprovedOpActionList:
          description: "List of pre-approved operator actions. Access requests associated with a resource governed by this operator control will be\nautomatically approved if the access request only contain operator actions in the pre-approved list.       \n"
          items:
            type: string
          type: array
        systemMessage:
          description: System message that would be displayed to the operator users on accessing the target resource under the governance of this operator control.
          type: string
        timeOfCreation:
          description: 'Time when the operator control was created expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z''

            '
          format: date-time
          type: string
        timeOfDeletion:
          description: 'Time when deleted expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339)timestamp format. Example: ''2020-05-22T21:10:29.600Z''.

            Note a deleted operator control still stays in the system, so that you can still audit operator actions associated with access requests

            raised on target resources governed by the deleted operator control.

            '
          format: date-time
          type: string
        timeOfModification:
          description: 'Time when the operator control was last modified expressed in [RFC 3339](https://tools.ietf.org/html/rfc3339) timestamp format. Example: ''2020-05-22T21:10:29.600Z''

            '
          format: date-time
          type: string
      required:
      - id
      - operatorControlName
      - compartmentId
      type: object
    CreateOperatorControlDetails:
      description: 'While creating the operator control, specify how operator actions are approved and the users who have the privilege of approving the operator actions associated with the Operator Control.


        You must specify which operator actions must be pre-approved. The rest of the operator actions associated with the Operator Control will require an explicit approval from the users selected either through the approver groups or individually.


        You must name your Operator Control appropriately so it reflects the resources that will be governed by the Operator Control. Neither the Operator Controls nor their assignments to resources are visible to the Oracle operators.

        '
      properties:
        approverGroupsList:
          description: List of user groups who can approve an access request associated with a resource governed by this operator control.
          items:
            type: string
          type: array
        approversList:
          description: List of users who can approve an access request associated with a resource governed by this operator control.
          items:
            type: string
          type: array
        compartmentId:
          description: The OCID of the compartment that contains this operator control.
          maxLength: 255
          minLength: 1
          type: string
        definedTags:
          additionalProperties:
            additionalProperties:
              description: 'The value of the tag. Only string, integer and boolean types are supported.

                '
              type: object
            description: 'Key-value pair representing predefined tags'' keys and values scoped to a namespace.

              '
            type: object
          description: 'Defined tags for this resource. Each key is predefined and scoped to a namespace.

            '
          type: object
        description:
          description: Description of the operator control.
          type: string
        emailIdList:
          description: 'List of emailId.

            '
          items:
            type: string
          type: array
        freeformTags:
          additionalProperties:
            type: string
          description: 'Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.

            '
          type: object
        isFullyPreApproved:
          description: "Whether all the operator actions have been pre-approved. If yes, all access requests associated with a resource governed by this operator control \nwill be auto-approved.        \n"
          type: boolean
        notificationTopicId:
          description: The OCID of the OCI Notification topic to publish messages related to this operator control.
          maxLength: 255
          minLength: 1
          type: string
        operatorControlName:
          description: Name of the operator control.
          maxLength: 255
          minLength: 1
          type: string
        preApprovedOpActionList:
          description: 'List of pre-approved operator actions. Access requests associated with a resource governed by this operator control will be

            auto-approved if the access request only contain operator actions in the pre-approved list.

            '
          items:
            type: string
          type: array
        systemMessage:
          description: This is the message that will be displayed to the operator users while accessing the system.
          type: string
      required:
      - operatorControlName
      - compartmentId
      - isFullyPreApproved
      - resourceType
      - approverGroupsList
      type: object
  responses:
    default:
      description: Unknown Error
      headers:
        opc-request-id:
          description: 'Unique Oracle-assigned identifier

# --- truncated at 32 KB (34 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/oracle/refs/heads/main/openapi/oracle-operatorcontrol-api-openapi.yml