grants

Creates, updates, deletes, gets or lists a grants resource.

Overview

Name	grants
Type	Resource
Id	okta.users.grants

Fields

The following fields are returned by SELECT queries:

list_grants_for_user_and_client

Grant object that represents an app consent scope grant

Name	Datatype	Description
id	string	ID of the Grant object (example: oag3ih1zrm1cBFOiq0h6)
_embedded	object	Embedded resources related to the Grant
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
clientId	string	Client ID of the app integration (example: oag3ih1zrm1cBFOiq0h6)
created	string (date-time)	Timestamp when the object was created (example: 2017-03-28T01:11:10.000Z)
createdBy	object	User that created the object
issuer	string	The issuer of your org authorization server. This is typically your Okta domain. (example: https://my_test_okta_org.oktapreview.com)
lastUpdated	string (date-time)	Timestamp when the object was last updated
scopeId	string	The name of the Okta scope for which consent is granted (example: okta.users.read)
source	string	User type source that granted consent (ADMIN, END_USER) (example: ADMIN)
status	string	Status (ACTIVE, REVOKED) (example: ACTIVE)
userId	string	User ID that granted consent (if source is END_USER) (example: 00u5t60iloOHN9pBi0h7)

get_user_grant

Name	Datatype	Description
id	string	ID of the Grant object (example: oag3ih1zrm1cBFOiq0h6)
_embedded	object	Embedded resources related to the Grant
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
clientId	string	Client ID of the app integration (example: oag3ih1zrm1cBFOiq0h6)
created	string (date-time)	Timestamp when the object was created (example: 2017-03-28T01:11:10.000Z)
createdBy	object	User that created the object
issuer	string	The issuer of your org authorization server. This is typically your Okta domain. (example: https://my_test_okta_org.oktapreview.com)
lastUpdated	string (date-time)	Timestamp when the object was last updated
scopeId	string	The name of the Okta scope for which consent is granted (example: okta.users.read)
source	string	User type source that granted consent (ADMIN, END_USER) (example: ADMIN)
status	string	Status (ACTIVE, REVOKED) (example: ACTIVE)
userId	string	User ID that granted consent (if source is END_USER) (example: 00u5t60iloOHN9pBi0h7)

list_user_grants

Grant object that represents an app consent scope grant

Name	Datatype	Description
id	string	ID of the Grant object (example: oag3ih1zrm1cBFOiq0h6)
_embedded	object	Embedded resources related to the Grant
_links	object	Specifies link relations (see Web Linking) available using the JSON Hypertext Application Language specification. This object is used for dynamic discovery of related resources and lifecycle operations.
clientId	string	Client ID of the app integration (example: oag3ih1zrm1cBFOiq0h6)
created	string (date-time)	Timestamp when the object was created (example: 2017-03-28T01:11:10.000Z)
createdBy	object	User that created the object
issuer	string	The issuer of your org authorization server. This is typically your Okta domain. (example: https://my_test_okta_org.oktapreview.com)
lastUpdated	string (date-time)	Timestamp when the object was last updated
scopeId	string	The name of the Okta scope for which consent is granted (example: okta.users.read)
source	string	User type source that granted consent (ADMIN, END_USER) (example: ADMIN)
status	string	Status (ACTIVE, REVOKED) (example: ACTIVE)
userId	string	User ID that granted consent (if source is END_USER) (example: 00u5t60iloOHN9pBi0h7)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_grants_for_user_and_client	select	userId, clientId, subdomain	expand, after, limit	Lists all grants for a specified user and client
get_user_grant	select	userId, grantId, subdomain	expand	Retrieves a grant for the specified user
list_user_grants	select	userId, subdomain	scopeId, expand, after, limit	Lists all grants for the specified user
revoke_grants_for_user_and_client	delete	userId, clientId, subdomain		Revokes all grants for the specified user and client
revoke_user_grant	delete	userId, grantId, subdomain		Revokes one grant for a specified user
revoke_user_grants	delete	userId, subdomain		Revokes all grants for a specified user

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
clientId	string	client_id of the app
grantId	string	Grant ID
subdomain	string	(default: my-org)
userId	string	ID of an existing Okta user
after	string	The cursor to use for pagination. It is an opaque string that specifies your current location in the list and is obtained from the Link response header. See Pagination.
expand	string	Valid value: scope. If specified, scope details are included in the _embedded attribute.
limit	integer (int32)	Specifies the number of grants to return
scopeId	string	The scope ID to filter on

SELECT examples

list_grants_for_user_and_client

Lists all grants for a specified user and client

SELECT
id,
_embedded,
_links,
clientId,
created,
createdBy,
issuer,
lastUpdated,
scopeId,
source,
status,
userId
FROM okta.users.grants
WHERE userId = '{{ userId }}' -- required
AND clientId = '{{ clientId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND expand = '{{ expand }}'
AND after = '{{ after }}'
AND limit = '{{ limit }}'
;

get_user_grant

Retrieves a grant for the specified user

SELECT
id,
_embedded,
_links,
clientId,
created,
createdBy,
issuer,
lastUpdated,
scopeId,
source,
status,
userId
FROM okta.users.grants
WHERE userId = '{{ userId }}' -- required
AND grantId = '{{ grantId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND expand = '{{ expand }}'
;

list_user_grants

Lists all grants for the specified user

SELECT
id,
_embedded,
_links,
clientId,
created,
createdBy,
issuer,
lastUpdated,
scopeId,
source,
status,
userId
FROM okta.users.grants
WHERE userId = '{{ userId }}' -- required
AND subdomain = '{{ subdomain }}' -- required
AND scopeId = '{{ scopeId }}'
AND expand = '{{ expand }}'
AND after = '{{ after }}'
AND limit = '{{ limit }}'
;

DELETE examples

revoke_grants_for_user_and_client

Revokes all grants for the specified user and client

DELETE FROM okta.users.grants
WHERE userId = '{{ userId }}' --required
AND clientId = '{{ clientId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

revoke_user_grant

Revokes one grant for a specified user

DELETE FROM okta.users.grants
WHERE userId = '{{ userId }}' --required
AND grantId = '{{ grantId }}' --required
AND subdomain = '{{ subdomain }}' --required
;

revoke_user_grants

Revokes all grants for a specified user

DELETE FROM okta.users.grants
WHERE userId = '{{ userId }}' --required
AND subdomain = '{{ subdomain }}' --required
;