rules

Creates, updates, deletes, gets or lists a rules resource.

Overview

Name	rules
Type	Resource
Id	okta.groups.rules

Fields

The following fields are returned by SELECT queries:

get_group_rule

Name	Datatype	Description
id	string	ID of the group rule
name	string	Name of the group rule
_embedded	object	This object appears with embedded resources related to the group rule if you use the expand query parameter
actions	object	Defines which users and groups to assign
conditions	object	Defines group rule conditions
created	string (date-time)	Creation date for group rule
lastUpdated	string (date-time)	Date group rule was last updated
status	string	Status of group rule. You can't update the status of a rule from INACTIVE to ACTIVE. You must use the activate and deactivate lifecycle operations. (ACTIVE, INACTIVE, INVALID)
type	string	Type to indicate a group rule operation. Only group_rule is allowed.

list_group_rules

Name	Datatype	Description
id	string	ID of the group rule
name	string	Name of the group rule
_embedded	object	This object appears with embedded resources related to the group rule if you use the expand query parameter
actions	object	Defines which users and groups to assign
conditions	object	Defines group rule conditions
created	string (date-time)	Creation date for group rule
lastUpdated	string (date-time)	Date group rule was last updated
status	string	Status of group rule. You can't update the status of a rule from INACTIVE to ACTIVE. You must use the activate and deactivate lifecycle operations. (ACTIVE, INACTIVE, INVALID)
type	string	Type to indicate a group rule operation. Only group_rule is allowed.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_group_rule	select	groupRuleId, subdomain	expand	Retrieves a specific group rule by ID from your org
list_group_rules	select	subdomain	limit, after, search, expand	Lists all group rules for your org
create_group_rule	insert	subdomain		Creates a group rule to dynamically add users to the specified group if they match the condition. > Note: Group rules are created with the status set to 'INACTIVE'.
replace_group_rule	replace	groupRuleId, subdomain		Replaces a group rule > Notes: You can only update rules with a group whose status is set to INACTIVE. > > You currently can't update the actions section.
delete_group_rule	delete	groupRuleId, subdomain	removeUsers	Deletes a specific group rule by groupRuleId
activate_group_rule	exec	groupRuleId, subdomain		Activates a specific group rule by ID from your org
deactivate_group_rule	exec	groupRuleId, subdomain		Deactivates a specific group rule by ID from your org

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
groupRuleId	string	The id of the group rule
subdomain	string	(default: my-org)
after	string	Specifies the pagination cursor for the next page of rules
expand	string	If specified, returns the mapping of group IDs to group names in the _embedded object.
limit	integer (int32)	Specifies the number of rule results in a page
removeUsers	string	If set to true, removes users from groups assigned by this rule
search	string	Specifies the keyword to search rules for

SELECT examples

get_group_rule

Retrieves a specific group rule by ID from your org

SELECT
id,
name,
_embedded,
actions,
conditions,
created,
lastUpdated,
status,
type
FROM okta.groups.rules
WHERE groupRuleId = '{{ groupRuleId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND expand = '{{ expand }}'
;

list_group_rules

Lists all group rules for your org

SELECT
id,
name,
_embedded,
actions,
conditions,
created,
lastUpdated,
status,
type
FROM okta.groups.rules
WHERE subdomain = '{{ subdomain }}' -- required
AND limit = '{{ limit }}'
AND after = '{{ after }}'
AND search = '{{ search }}'
AND expand = '{{ expand }}'
;

INSERT examples

create_group_rule

Creates a group rule to dynamically add users to the specified group if they match the condition.
> Note: Group rules are created with the status set to 'INACTIVE'.

INSERT INTO okta.groups.rules (
actions,
conditions,
name,
type,
subdomain
)
SELECT 
'{{ actions }}',
'{{ conditions }}',
'{{ name }}',
'{{ type }}',
'{{ subdomain }}'
RETURNING
id,
name,
_embedded,
actions,
conditions,
created,
lastUpdated,
status,
type
;

Manifest

# Description fields are for documentation purposes
- name: rules
props:
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the rules resource.
  - name: actions
    description: |
      Defines which users and groups to assign
    value:
      assignUserToGroups:
        groupIds:
          - "{{ groupIds }}"
  - name: conditions
    description: |
      Defines group rule conditions
    value:
      expression:
        type: "{{ type }}"
        value: "{{ value }}"
      people:
        groups:
          exclude:
            - "{{ exclude }}"
        users:
          exclude:
            - "{{ exclude }}"
  - name: name
    value: "{{ name }}"
    description: |
      Name of the group rule
  - name: type
    value: "{{ type }}"
    valid_values: ['group_rule']

REPLACE examples

replace_group_rule

Replaces a group rule
> Notes: You can only update rules with a group whose status is set to INACTIVE.
>
> You currently can't update the actions section.

REPLACE okta.groups.rules
SET 
actions = '{{ actions }}',
conditions = '{{ conditions }}',
name = '{{ name }}',
status = '{{ status }}',
type = '{{ type }}'
WHERE 
groupRuleId = '{{ groupRuleId }}' --required
AND subdomain = '{{ subdomain }}' --required
RETURNING
id,
name,
_embedded,
actions,
conditions,
created,
lastUpdated,
status,
type;

DELETE examples

delete_group_rule

Deletes a specific group rule by groupRuleId

DELETE FROM okta.groups.rules
WHERE groupRuleId = '{{ groupRuleId }}' --required
AND subdomain = '{{ subdomain }}' --required
AND removeUsers = '{{ removeUsers }}'
;

Lifecycle Methods

activate_group_rule

Activates a specific group rule by ID from your org

EXEC okta.groups.rules.activate_group_rule 
@groupRuleId='{{ groupRuleId }}' --required, 
@subdomain='{{ subdomain }}' --required
;

deactivate_group_rule

Deactivates a specific group rule by ID from your org

EXEC okta.groups.rules.deactivate_group_rule 
@groupRuleId='{{ groupRuleId }}' --required, 
@subdomain='{{ subdomain }}' --required
;