assigned_roles

Creates, updates, deletes, gets or lists an assigned_roles resource.

Overview

Name	assigned_roles
Type	Resource
Id	okta.groups.assigned_roles

Fields

The following fields are returned by SELECT queries:

get_group_assigned_role

Name	Datatype	Description
id	string	Role assignment ID
_embedded	object	Optional embedded resources for the role assignment
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification.
assignmentType	string	Role assignment type (CLIENT, GROUP, USER)
created	string (date-time)	Timestamp when the object was created
label	string	Label for the role assignment
lastUpdated	string (date-time)	Timestamp when the object was last updated
resource-set	string	Resource set ID
role	string	Role ID
status	string	Status of the role assignment (ACTIVE, INACTIVE)
type	string	| Role type | Description | |------------------------------|-------------------------------------------------------------| | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based standard role | | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator standard role | | APP_ADMIN | Application Administrator standard role | | CUSTOM | Custom admin role | | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | | HELP_DESK_ADMIN | Help Desk Administrator standard role | | ORG_ADMIN | Organizational Administrator standard role | | READ_ONLY_ADMIN | Read-Only Administrator standard role | | REPORT_ADMIN | Report Administrator standard role | | SUPER_ADMIN | Super Administrator standard role | | USER_ADMIN | User Administrator standard role | | WORKFLOWS_ADMIN | Workflows Administrator IAM-based standard role | (ACCESS_CERTIFICATIONS_ADMIN, ACCESS_REQUESTS_ADMIN, API_ACCESS_MANAGEMENT_ADMIN, APP_ADMIN, CUSTOM, GROUP_MEMBERSHIP_ADMIN, HELP_DESK_ADMIN, ORG_ADMIN, READ_ONLY_ADMIN, REPORT_ADMIN, SUPER_ADMIN, USER_ADMIN, WORKFLOWS_ADMIN) (title: roleType)

list_group_assigned_roles

Name	Datatype	Description

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_group_assigned_role	select	groupId, roleAssignmentId, subdomain		Retrieves a role assigned to a group (identified by the groupId). The roleAssignmentId is the unique identifier for either a standard role group assignment object or a custom role resource set binding object.
list_group_assigned_roles	select	groupId, subdomain	expand	Lists all assigned roles of a group by groupId
assign_role_to_group	insert	groupId, subdomain, type, role, resource-set	disableNotifications	Assigns a standard role to a group. You can also assign a custom role to a group, but the preferred method to assign a custom role to a group is to create a binding between the custom role, the resource set, and the group. See Create a role resource set binding. > Notes: > * The request payload is different for standard and custom role assignments. > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.
unassign_role_from_group	delete	groupId, roleAssignmentId, subdomain		Unassigns a role assignment (identified by roleAssignmentId) from a group (identified by the groupId)

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
groupId	string	The id of the group
roleAssignmentId	string	The id of the role assignment
subdomain	string	(default: my-org)
disableNotifications	string	Grants the group third-party admin status when set to true
expand	string	An optional parameter used to return targets configured for the standard role assignment in the embedded property. Supported values: targets/groups or targets/catalog/apps

SELECT examples

get_group_assigned_role

Retrieves a role assigned to a group (identified by the groupId). The roleAssignmentId is the unique identifier for either a standard role group assignment object or a custom role resource set binding object.

SELECT
id,
_embedded,
_links,
assignmentType,
created,
label,
lastUpdated,
resource-set,
role,
status,
type
FROM okta.groups.assigned_roles
WHERE groupId = '{{ groupId }}' -- required
AND roleAssignmentId = '{{ roleAssignmentId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_group_assigned_roles

Lists all assigned roles of a group by groupId

SELECT
*
FROM okta.groups.assigned_roles
WHERE groupId = '{{ groupId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND expand = '{{ expand }}'
;

INSERT examples

assign_role_to_group

Assigns a standard role to a group.

You can also assign a custom role to a group, but the preferred method to assign a custom role to a group is to create a binding between the custom role, the resource set, and the group. See Create a role resource set binding.

> Notes:
> * The request payload is different for standard and custom role assignments.
> * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.

INSERT INTO okta.groups.assigned_roles (
type,
resource-set,
role,
groupId,
subdomain,
disableNotifications
)
SELECT 
'{{ type }}' /* required */,
'{{ resource-set }}' /* required */,
'{{ role }}' /* required */,
'{{ groupId }}',
'{{ subdomain }}',
'{{ disableNotifications }}'
RETURNING
id,
_embedded,
_links,
assignmentType,
created,
label,
lastUpdated,
resource-set,
role,
status,
type
;

Manifest

# Description fields are for documentation purposes
- name: assigned_roles
props:
  - name: groupId
    value: "{{ groupId }}"
    description: Required parameter for the assigned_roles resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the assigned_roles resource.
  - name: type
    value: "{{ type }}"
    description: |
      Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:
    valid_values: ['ACCESS_CERTIFICATIONS_ADMIN', 'ACCESS_REQUESTS_ADMIN', 'API_ACCESS_MANAGEMENT_ADMIN', 'APP_ADMIN', 'GROUP_MEMBERSHIP_ADMIN', 'HELP_DESK_ADMIN', 'ORG_ADMIN', 'READ_ONLY_ADMIN', 'REPORT_ADMIN', 'SUPER_ADMIN', 'USER_ADMIN', 'WORKFLOWS_ADMIN']
  - name: resource-set
    value: "{{ resource-set }}"
    description: |
      Resource set ID
  - name: role
    value: "{{ role }}"
    description: |
      Custom role ID
  - name: disableNotifications
    value: "{{ disableNotifications }}"
    description: Grants the group third-party admin status when set to `true`
    description: Grants the group third-party admin status when set to `true`

DELETE examples

unassign_role_from_group

Unassigns a role assignment (identified by roleAssignmentId) from a group (identified by the groupId)

DELETE FROM okta.groups.assigned_roles
WHERE groupId = '{{ groupId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND subdomain = '{{ subdomain }}' --required
;