client_roles

Creates, updates, deletes, gets or lists a client_roles resource.

Overview

Name	client_roles
Type	Resource
Id	okta.oauth2.client_roles

Fields

The following fields are returned by SELECT queries:

retrieve_client_role

Name	Datatype	Description
id	string	Role assignment ID
_embedded	object	Optional embedded resources for the role assignment
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification.
assignmentType	string	Role assignment type (CLIENT, GROUP, USER)
created	string (date-time)	Timestamp when the object was created
label	string	Label for the role assignment
lastUpdated	string (date-time)	Timestamp when the object was last updated
resource-set	string	Resource set ID
role	string	Role ID
status	string	Status of the role assignment (ACTIVE, INACTIVE)
type	string	| Role type | Description | |------------------------------|-------------------------------------------------------------| | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based standard role | | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator standard role | | APP_ADMIN | Application Administrator standard role | | CUSTOM | Custom admin role | | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | | HELP_DESK_ADMIN | Help Desk Administrator standard role | | ORG_ADMIN | Organizational Administrator standard role | | READ_ONLY_ADMIN | Read-Only Administrator standard role | | REPORT_ADMIN | Report Administrator standard role | | SUPER_ADMIN | Super Administrator standard role | | USER_ADMIN | User Administrator standard role | | WORKFLOWS_ADMIN | Workflows Administrator IAM-based standard role | (ACCESS_CERTIFICATIONS_ADMIN, ACCESS_REQUESTS_ADMIN, API_ACCESS_MANAGEMENT_ADMIN, APP_ADMIN, CUSTOM, GROUP_MEMBERSHIP_ADMIN, HELP_DESK_ADMIN, ORG_ADMIN, READ_ONLY_ADMIN, REPORT_ADMIN, SUPER_ADMIN, USER_ADMIN, WORKFLOWS_ADMIN) (title: roleType)

list_roles_for_client

Name	Datatype	Description

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
retrieve_client_role	select	clientId, roleAssignmentId, subdomain		Retrieves a role assignment (identified by roleAssignmentId) for a client app (identified by clientId)
list_roles_for_client	select	clientId, subdomain		Lists all roles assigned to a client app identified by clientId
assign_role_to_client	insert	clientId, subdomain, type, role, resource-set		Assigns a standard role to a client app. You can also assign a custom role to a client app, but the preferred method to assign a custom role to a client is to create a binding between the custom role, the resource set, and the client app. See Create a role resource set binding. > Notes: > * The request payload is different for standard and custom role assignments. > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.
delete_role_from_client	delete	clientId, roleAssignmentId, subdomain		Unassigns a role assignment (identified by roleAssignmentId) from a client app (identified by clientId)

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
clientId	string	client_id of the app
roleAssignmentId	string	The id of the role assignment
subdomain	string	(default: my-org)

SELECT examples

retrieve_client_role

Retrieves a role assignment (identified by roleAssignmentId) for a client app (identified by clientId)

SELECT
id,
_embedded,
_links,
assignmentType,
created,
label,
lastUpdated,
resource-set,
role,
status,
type
FROM okta.oauth2.client_roles
WHERE clientId = '{{ clientId }}' -- required
AND roleAssignmentId = '{{ roleAssignmentId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_roles_for_client

Lists all roles assigned to a client app identified by clientId

SELECT
*
FROM okta.oauth2.client_roles
WHERE clientId = '{{ clientId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

INSERT examples

assign_role_to_client

Assigns a standard role to a client app.

You can also assign a custom role to a client app, but the preferred method to assign a custom role to a client is to create a binding between the custom role, the resource set, and the client app. See Create a role resource set binding.

> Notes:
> * The request payload is different for standard and custom role assignments.
> * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.

INSERT INTO okta.oauth2.client_roles (
type,
resource-set,
role,
clientId,
subdomain
)
SELECT 
'{{ type }}' /* required */,
'{{ resource-set }}' /* required */,
'{{ role }}' /* required */,
'{{ clientId }}',
'{{ subdomain }}'
RETURNING
id,
_embedded,
_links,
assignmentType,
created,
label,
lastUpdated,
resource-set,
role,
status,
type
;

Manifest

# Description fields are for documentation purposes
- name: client_roles
props:
  - name: clientId
    value: "{{ clientId }}"
    description: Required parameter for the client_roles resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the client_roles resource.
  - name: type
    value: "{{ type }}"
    description: |
      Specify a [standard admin role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](https://developer.okta.com/docs/api/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:
    valid_values: ['ACCESS_CERTIFICATIONS_ADMIN', 'ACCESS_REQUESTS_ADMIN', 'API_ACCESS_MANAGEMENT_ADMIN', 'APP_ADMIN', 'GROUP_MEMBERSHIP_ADMIN', 'HELP_DESK_ADMIN', 'ORG_ADMIN', 'READ_ONLY_ADMIN', 'REPORT_ADMIN', 'SUPER_ADMIN', 'USER_ADMIN', 'WORKFLOWS_ADMIN']
  - name: resource-set
    value: "{{ resource-set }}"
    description: |
      Resource set ID
  - name: role
    value: "{{ role }}"
    description: |
      Custom role ID

DELETE examples

delete_role_from_client

Unassigns a role assignment (identified by roleAssignmentId) from a client app (identified by clientId)

DELETE FROM okta.oauth2.client_roles
WHERE clientId = '{{ clientId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND subdomain = '{{ subdomain }}' --required
;