app_instance_targets

Creates, updates, deletes, gets or lists an app_instance_targets resource.

Overview

Name	app_instance_targets
Type	Resource
Id	okta.groups.app_instance_targets

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
assign_app_instance_target_to_app_admin_role_for_group	replace	groupId, roleAssignmentId, appName, appId, subdomain		Assigns an app instance target to an APP_ADMIN role assignment to a group. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. > Note: You can target a mixture of both OIN app and app instance targets, but you can't assign permissions to manage all instances of an OIN app and then assign a subset of permissions to the same app. > For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.
unassign_app_instance_target_to_app_admin_role_for_group	delete	groupId, roleAssignmentId, appName, appId, subdomain		Unassigns an app instance target from an APP_ADMIN role assignment to a group > Note: You can't remove the last app instance target from a role assignment. > If you need a role assignment that applies to all apps, delete the APP_ADMIN role assignment with the target and create another one. See Unassign a group role.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
appId	string	Application ID
appName	string	Name of the app definition (the OIN catalog app key name)
groupId	string	The id of the group
roleAssignmentId	string	The id of the role assignment
subdomain	string	(default: my-org)

REPLACE examples

assign_app_instance_target_to_app_admin_role_for_group

Assigns an app instance target to an APP_ADMIN role assignment to a group. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment.
The role no longer applies to all app targets, but applies only to the specified target.

> Note: You can target a mixture of both OIN app and app instance targets, but you can't assign permissions to manage all instances of an OIN app and then assign a subset of permissions to the same app.
> For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.

REPLACE okta.groups.app_instance_targets
SET 
-- No updatable properties
WHERE 
groupId = '{{ groupId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND appName = '{{ appName }}' --required
AND appId = '{{ appId }}' --required
AND subdomain = '{{ subdomain }}' --required;

DELETE examples

unassign_app_instance_target_to_app_admin_role_for_group

Unassigns an app instance target from an APP_ADMIN role assignment to a group

> Note: You can't remove the last app instance target from a role assignment.
> If you need a role assignment that applies to all apps, delete the APP_ADMIN role assignment with the target and create another one. See Unassign a group role.

DELETE FROM okta.groups.app_instance_targets
WHERE groupId = '{{ groupId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND appName = '{{ appName }}' --required
AND appId = '{{ appId }}' --required
AND subdomain = '{{ subdomain }}' --required
;