Okta Assign Admin Role to User

arazzo: 1.0.1
info:
  title: Okta Assign Admin Role to User
  summary: Assign an administrator role to a user and verify the assignment.
  description: >-
    Grants administrative privileges to a user. The workflow assigns a standard
    Okta admin role to the user and then lists the user's assigned roles to
    confirm the new role is present. The user id is supplied once and reused
    across both steps. Every step spells out its request inline, including the
    SSWS API token header, so the flow can be read and executed without opening
    the underlying OpenAPI description.
  version: 1.0.0
  x-realizes-capability-ids:
  - BC-620.20
  x-capability-derivation:
    method: 'deterministic join: sourceDescriptions -> per-tag OpenAPI -> tag/capability edge. No classification at this step.'
    min_confidence: 0.7
    sources:
    - capability_id: BC-620.20
      capability_name: Identity & Access Management
      spec: okta-user-api-openapi.yml
      confidence: 0.95
    model: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0
sourceDescriptions:
- name: userApi
  url: ../openapi/okta-user-api-openapi.yml
  type: openapi
workflows:
- workflowId: assign-admin-role-to-user
  summary: Assign an admin role to a user and confirm it.
  description: >-
    Assigns a role of the supplied type to a user, then lists the user's roles
    to verify the assignment.
  inputs:
    type: object
    required:
    - oktaApiToken
    - userId
    - roleType
    properties:
      oktaApiToken:
        type: string
        description: Okta API token used for the SSWS Authorization header.
      userId:
        type: string
        description: The id of the user to grant the role to.
      roleType:
        type: string
        description: The admin role type (e.g. SUPER_ADMIN, ORG_ADMIN, USER_ADMIN, APP_ADMIN).
  steps:
  - stepId: assignRole
    description: >-
      Assign the supplied admin role type to the user.
    operationId: assignRoleToUser
    parameters:
    - name: Authorization
      in: header
      value: SSWS $inputs.oktaApiToken
    - name: userId
      in: path
      value: $inputs.userId
    requestBody:
      contentType: application/json
      payload:
        type: $inputs.roleType
    successCriteria:
    - condition: $statusCode == 201
    outputs:
      roleId: $response.body#/id
      roleStatus: $response.body#/status
  - stepId: listRoles
    description: >-
      List the user's assigned roles to confirm the new role is present.
    operationId: listAssignedRolesForUser
    parameters:
    - name: Authorization
      in: header
      value: SSWS $inputs.oktaApiToken
    - name: userId
      in: path
      value: $inputs.userId
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      roleCount: $response.body#/0/id
  outputs:
    userId: $inputs.userId
    roleId: $steps.assignRole.outputs.roleId