policy_rules

Creates, updates, deletes, gets or lists a policy_rules resource.

Overview

Name	policy_rules
Type	Resource
Id	okta.policies.policy_rules

Fields

The following fields are returned by SELECT queries:

get_policy_rule

Name	Datatype	Description
id	string	Identifier for the rule
name	string	Name of the rule
_links	object
created	string (date-time)	Timestamp when the rule was created
lastUpdated	string (date-time)	Timestamp when the rule was last modified
priority	integer	Priority of the rule
status	string	Whether or not the rule is active. Use the activate query parameter to set the status of a rule. (ACTIVE, INACTIVE)
system	boolean	Specifies whether Okta created the policy rule (system=true). You can't delete policy rules that have system set to true.
type	string	Rule type (ACCESS_POLICY, DEVICE_SIGNAL_COLLECTION, ENTITY_RISK, IDP_DISCOVERY, MFA_ENROLL, PASSWORD, POST_AUTH_SESSION, PROFILE_ENROLLMENT, SIGN_ON, SESSION_VIOLATION_DETECTION, CLIENT_UPDATE, IDENTITY_CLAIM_SOURCING)

list_policy_rules

Name	Datatype	Description
id	string	Identifier for the rule
name	string	Name of the rule
_links	object
created	string (date-time)	Timestamp when the rule was created
lastUpdated	string (date-time)	Timestamp when the rule was last modified
priority	integer	Priority of the rule
status	string	Whether or not the rule is active. Use the activate query parameter to set the status of a rule. (ACTIVE, INACTIVE)
system	boolean	Specifies whether Okta created the policy rule (system=true). You can't delete policy rules that have system set to true.
type	string	Rule type (ACCESS_POLICY, DEVICE_SIGNAL_COLLECTION, ENTITY_RISK, IDP_DISCOVERY, MFA_ENROLL, PASSWORD, POST_AUTH_SESSION, PROFILE_ENROLLMENT, SIGN_ON, SESSION_VIOLATION_DETECTION, CLIENT_UPDATE, IDENTITY_CLAIM_SOURCING)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_policy_rule	select	policyId, ruleId, subdomain		Retrieves a policy rule
list_policy_rules	select	policyId, subdomain	limit	Lists all policy rules
create_policy_rule	insert	policyId, subdomain	activate, limit	Creates a policy rule > Note: You can't create additional rules for the PROFILE_ENROLLMENT, POST_AUTH_SESSION, CLIENT_UPDATE, or <x-lifecycle class="ea"></x-lifecycle> IDENTITY_CLAIM_SOURCING policies.
replace_policy_rule	replace	policyId, ruleId, subdomain		Replaces the properties for a policy rule identified by policyId and ruleId
delete_policy_rule	delete	policyId, ruleId, subdomain		Deletes a policy rule identified by policyId and ruleId
activate_policy_rule	exec	policyId, ruleId, subdomain		Activates a policy rule identified by policyId and ruleId
deactivate_policy_rule	exec	policyId, ruleId, subdomain		Deactivates a policy rule identified by policyId and ruleId

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
policyId	string	id of the policy
ruleId	string	id of the policy rule
subdomain	string	(default: my-org)
activate	string	Set this parameter to false to create an INACTIVE rule.
limit	string	Defines the number of policy rules returned. See Pagination.

SELECT examples

get_policy_rule

Retrieves a policy rule

SELECT
id,
name,
_links,
created,
lastUpdated,
priority,
status,
system,
type
FROM okta.policies.policy_rules
WHERE policyId = '{{ policyId }}' -- required
AND ruleId = '{{ ruleId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
;

list_policy_rules

Lists all policy rules

SELECT
id,
name,
_links,
created,
lastUpdated,
priority,
status,
system,
type
FROM okta.policies.policy_rules
WHERE policyId = '{{ policyId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND limit = '{{ limit }}'
;

INSERT examples

create_policy_rule

Creates a policy rule

> Note: You can't create additional rules for the PROFILE_ENROLLMENT, POST_AUTH_SESSION, CLIENT_UPDATE, or <x-lifecycle class="ea"></x-lifecycle> IDENTITY_CLAIM_SOURCING policies.

INSERT INTO okta.policies.policy_rules (
name,
priority,
status,
system,
type,
policyId,
subdomain,
activate,
limit
)
SELECT 
'{{ name }}',
{{ priority }},
'{{ status }}',
{{ system }},
'{{ type }}',
'{{ policyId }}',
'{{ subdomain }}',
'{{ activate }}',
'{{ limit }}'
RETURNING
id,
name,
_links,
created,
lastUpdated,
priority,
status,
system,
type
;

Manifest

# Description fields are for documentation purposes
- name: policy_rules
props:
  - name: policyId
    value: "{{ policyId }}"
    description: Required parameter for the policy_rules resource.
  - name: subdomain
    value: "{{ subdomain }}"
    description: Required parameter for the policy_rules resource.
  - name: name
    value: "{{ name }}"
    description: |
      Name of the rule
  - name: priority
    value: {{ priority }}
    description: |
      Priority of the rule
  - name: status
    value: "{{ status }}"
    description: |
      Whether or not the rule is active. Use the `activate` query parameter to set the status of a rule.
    valid_values: ['ACTIVE', 'INACTIVE']
  - name: system
    value: {{ system }}
    description: |
      Specifies whether Okta created the policy rule (`system=true`). You can't delete policy rules that have `system` set to `true`.
    default: false
  - name: type
    value: "{{ type }}"
    description: |
      Rule type
    valid_values: ['ACCESS_POLICY', 'DEVICE_SIGNAL_COLLECTION', 'ENTITY_RISK', 'IDP_DISCOVERY', 'MFA_ENROLL', 'PASSWORD', 'POST_AUTH_SESSION', 'PROFILE_ENROLLMENT', 'SIGN_ON', 'SESSION_VIOLATION_DETECTION', 'CLIENT_UPDATE', 'IDENTITY_CLAIM_SOURCING']
  - name: activate
    value: "{{ activate }}"
    description: Set this parameter to `false` to create an `INACTIVE` rule.
    description: Set this parameter to `false` to create an `INACTIVE` rule.
  - name: limit
    value: "{{ limit }}"
    description: Defines the number of policy rules returned. See [Pagination](https://developer.okta.com/docs/api/#pagination).
    description: Defines the number of policy rules returned. See [Pagination](https://developer.okta.com/docs/api/#pagination).

REPLACE examples

replace_policy_rule

Replaces the properties for a policy rule identified by policyId and ruleId

REPLACE okta.policies.policy_rules
SET 
name = '{{ name }}',
priority = {{ priority }},
status = '{{ status }}',
system = {{ system }},
type = '{{ type }}'
WHERE 
policyId = '{{ policyId }}' --required
AND ruleId = '{{ ruleId }}' --required
AND subdomain = '{{ subdomain }}' --required
RETURNING
id,
name,
_links,
created,
lastUpdated,
priority,
status,
system,
type;

DELETE examples

delete_policy_rule

Deletes a policy rule identified by policyId and ruleId

DELETE FROM okta.policies.policy_rules
WHERE policyId = '{{ policyId }}' --required
AND ruleId = '{{ ruleId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

Lifecycle Methods

activate_policy_rule

Activates a policy rule identified by policyId and ruleId

EXEC okta.policies.policy_rules.activate_policy_rule 
@policyId='{{ policyId }}' --required, 
@ruleId='{{ ruleId }}' --required, 
@subdomain='{{ subdomain }}' --required
;

deactivate_policy_rule

Deactivates a policy rule identified by policyId and ruleId

EXEC okta.policies.policy_rules.deactivate_policy_rule 
@policyId='{{ policyId }}' --required, 
@ruleId='{{ ruleId }}' --required, 
@subdomain='{{ subdomain }}' --required
;