group_target_roles

Creates, updates, deletes, gets or lists a group_target_roles resource.

Overview

Name	group_target_roles
Type	Resource
Id	okta.oauth2.group_target_roles

Fields

The following fields are returned by SELECT queries:

list_group_target_role_for_client

Name	Datatype	Description
id	string	Unique ID for the group (example: 0gabcd1234)
_embedded	object	Embedded resources related to the group
_links	object	Discoverable resources related to the group
created	string (date-time)	Timestamp when the group was created
lastMembershipUpdated	string (date-time)	Timestamp when the groups memberships were last updated
lastUpdated	string (date-time)	Timestamp when the group's profile was last updated
objectClass	array	Determines the group's profile
profile	object	Profile for any group that is not imported from Active Directory. Specifies the standard and custom profile properties for a group. The objectClass for these groups is okta:user_group. You can extend group profiles with custom properties, but you must first add the properties to the group profile schema before you can reference them. Use the Profile Editor in the Admin Console or the Schemas API to manage schema extensions. Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use best-practices to prevent cross-site scripting.
type	string	Determines how a group's profile and memberships are managed (APP_GROUP, BUILT_IN, OKTA_GROUP)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_group_target_role_for_client	select	clientId, roleAssignmentId, subdomain	after, limit	Lists all group targets for a USER_ADMIN, HELP_DESK_ADMIN, or GROUP_MEMBERSHIP_ADMIN role assignment to a client. If the role isn't scoped to specific group targets, Okta returns an empty array [].
assign_group_target_role_for_client	replace	clientId, roleAssignmentId, groupId, subdomain		Assigns a group target to a USER_ADMIN, HELP_DESK_ADMIN, or GROUP_MEMBERSHIP_ADMIN role assignment to a client app. When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets, but applies only to the specified target.
remove_group_target_role_from_client	delete	clientId, roleAssignmentId, groupId, subdomain		Unassigns a Group target from a USER_ADMIN, HELP_DESK_ADMIN, or GROUP_MEMBERSHIP_ADMIN role assignment to a client app. > Note: You can't remove the last group target from a role assignment. If you need a role assignment that applies to all groups, delete the role assignment with the target and create another one. See Unassign a client role.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
clientId	string	client_id of the app
groupId	string	The id of the group
roleAssignmentId	string	The id of the role assignment
subdomain	string	(default: my-org)
after	string	The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination and Link header.
limit	integer	A limit on the number of objects to return

SELECT examples

list_group_target_role_for_client

Lists all group targets for a USER_ADMIN, HELP_DESK_ADMIN, or GROUP_MEMBERSHIP_ADMIN role assignment to a client. If the role isn't scoped to specific group targets, Okta returns an empty array [].

SELECT
id,
_embedded,
_links,
created,
lastMembershipUpdated,
lastUpdated,
objectClass,
profile,
type
FROM okta.oauth2.group_target_roles
WHERE clientId = '{{ clientId }}' -- required
AND roleAssignmentId = '{{ roleAssignmentId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND after = '{{ after }}'
AND limit = '{{ limit }}'
;

REPLACE examples

assign_group_target_role_for_client

Assigns a group target to a USER_ADMIN, HELP_DESK_ADMIN, or GROUP_MEMBERSHIP_ADMIN role assignment to a client app. When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets, but applies only to the specified target.

REPLACE okta.oauth2.group_target_roles
SET 
-- No updatable properties
WHERE 
clientId = '{{ clientId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND groupId = '{{ groupId }}' --required
AND subdomain = '{{ subdomain }}' --required;

DELETE examples

remove_group_target_role_from_client

Unassigns a Group target from a USER_ADMIN, HELP_DESK_ADMIN, or GROUP_MEMBERSHIP_ADMIN role assignment to a client app.

> Note: You can't remove the last group target from a role assignment. If you need a role assignment that applies to all groups, delete the role assignment with the target and create another one. See Unassign a client role.

DELETE FROM okta.oauth2.group_target_roles
WHERE clientId = '{{ clientId }}' --required
AND roleAssignmentId = '{{ roleAssignmentId }}' --required
AND groupId = '{{ groupId }}' --required
AND subdomain = '{{ subdomain }}' --required
;