Skip to main content

Create a Campaign Template

POST 
/campaign-templates

Use this API to create a certification campaign template based on campaign.

Request​

Body

required

    id string

    Id of the campaign template

    name stringrequired

    This template's name. Has no bearing on generated campaigns' names.

    description stringrequired

    This template's description. Has no bearing on generated campaigns' descriptions.

    deadlineDuration string

    The time period during which the campaign should be completed, formatted as an ISO-8601 Duration. When this template generates a campaign, the campaign's deadline will be the current date plus this duration. For example, if generation occurred on 2020-01-01 and this field was "P2W" (two weeks), the resulting campaign's deadline would be 2020-01-15 (the current date plus 14 days).

    campaign

    object

    required

    name stringrequired

    The campaign name. If this object is part of a template, special formatting applies; see the /campaign-templates/{id}/generate endpoint documentation for details.

    description stringnullablerequired

    The campaign description. If this object is part of a template, special formatting applies; see the /campaign-templates/{id}/generate endpoint documentation for details.

    deadline date-time

    The campaign's completion deadline. This date must be in the future in order to activate the campaign. If you try to activate a campaign with a deadline of today or in the past, you will receive a 400 error response.

    type stringrequired

    Possible values: [MANAGER, SOURCE_OWNER, SEARCH, ROLE_COMPOSITION, MACHINE_ACCOUNT]

    The type of campaign. Could be extended in the future.

    emailNotificationEnabled boolean

    Enables email notification for this campaign

    autoRevokeAllowed boolean

    Allows auto revoke for this campaign

    recommendationsEnabled boolean

    Enables IAI for this campaign. Accepts true even if the IAI product feature is off. If IAI is turned off then campaigns generated from this template will indicate false. The real value will then be returned if IAI is ever enabled for the org in the future.

    correlatedStatus string

    Possible values: [CORRELATED, UNCORRELATED]

    The correlatedStatus of the campaign. Only SOURCE_OWNER campaigns can be Uncorrelated. An Uncorrelated certification campaign only includes Uncorrelated identities (An identity is uncorrelated if it has no accounts on an authoritative source).

    filter

    object

    Determines which items will be included in this campaign. The default campaign filter is used if this field is left blank.

    id string

    The ID of whatever type of filter is being used.

    type string

    Possible values: [CAMPAIGN_FILTER, RULE]

    Type of the filter

    name string

    Name of the filter

    sunsetCommentsRequired boolean

    Default value: true

    Determines if comments on sunset date changes are required.

    sourceOwnerCampaignInfo

    object

    Must be set only if the campaign type is SOURCE_OWNER.

    sourceIds string[]

    The list of sources to be included in the campaign.

    searchCampaignInfo

    object

    Must be set only if the campaign type is SEARCH.

    type stringrequired

    Possible values: [IDENTITY, ACCESS]

    The type of search campaign represented.

    description string

    Describes this search campaign. Intended for storing the query used, and possibly the number of identities selected/available.

    reviewer

    object

    If specified, this identity or governance group will be the reviewer for all certifications in this campaign. The allowed DTO types are IDENTITY and GOVERNANCE_GROUP.

    type string

    Possible values: [GOVERNANCE_GROUP, IDENTITY]

    The reviewer's DTO type.

    id string

    The reviewer's ID.

    name string

    The reviewer's name.

    query string

    The scope for the campaign. The campaign will cover identities returned by the query and identities that have access items returned by the query. One of query or identityIds must be set.

    identityIds string[]

    Possible values: <= 1000

    A direct list of identities to include in this campaign. One of identityIds or query must be set.

    accessConstraints

    object[]

    Possible values: <= 1000

    Further reduces the scope of the campaign by excluding identities (from query or identityIds) that do not have this access.

  • Array [

    • type stringrequired

    Possible values: [ENTITLEMENT, ACCESS_PROFILE, ROLE]

    Type of Access

    ids string[]

    Must be set only if operator is SELECTED.

    operator stringrequired

    Possible values: [ALL, SELECTED]

    Used to determine whether the scope of the campaign should be reduced for selected ids or all.

  • ]

    • roleCompositionCampaignInfo

    object

    Optional configuration options for role composition campaigns.

    reviewer

    object

    If specified, this identity or governance group will be the reviewer for all certifications in this campaign. The allowed DTO types are IDENTITY and GOVERNANCE_GROUP.

    type string

    Possible values: [GOVERNANCE_GROUP, IDENTITY]

    The reviewer's DTO type.

    id string

    The reviewer's ID.

    name string

    The reviewer's name.

    roleIds string[]

    Optional list of roles to include in this campaign. Only one of roleIds and query may be set; if neither are set, all roles are included.

    remediatorRef

    object

    required

    This determines who remediation tasks will be assigned to. Remediation tasks are created for each revoke decision on items in the campaign. The only legal remediator type is 'IDENTITY', and the chosen identity must be a Role Admin or Org Admin.

    type stringrequired

    Possible values: [IDENTITY]

    Legal Remediator Type

    id stringrequired

    The ID of the remediator.

    query string

    Optional search query to scope this campaign to a set of roles. Only one of roleIds and query may be set; if neither are set, all roles are included.

    description string

    Describes this role composition campaign. Intended for storing the query used, and possibly the number of roles selected/available.

    machineAccountCampaignInfo

    object

    Must be set only if the campaign type is MACHINE_ACCOUNT.

    sourceIds string[]

    The list of sources to be included in the campaign.

    reviewerType string

    Possible values: [ACCOUNT_OWNER]

    The reviewer's type.

    mandatoryCommentRequirement string

    Possible values: [ALL_DECISIONS, REVOKE_ONLY_DECISIONS, NO_DECISIONS]

    Determines whether comments are required for decisions during certification reviews. You can require comments for all decisions, revoke-only decisions, or no decisions. By default, comments are not required for decisions.

Responses​

Created successfully.

Schema

    id string

    Id of the campaign template

    name stringrequired

    This template's name. Has no bearing on generated campaigns' names.

    description stringrequired

    This template's description. Has no bearing on generated campaigns' descriptions.

    created date-timerequired

    Creation date of Campaign Template

    modified date-timenullablerequired

    Modification date of Campaign Template

    scheduled boolean

    Indicates if this campaign template has been scheduled.

    ownerRef

    object

    The owner of this template, and the owner of campaigns generated from this template via a schedule. This field is automatically populated at creation time with the current user.

    id string

    Id of the owner

    type string

    Possible values: [IDENTITY]

    Type of the owner

    name string

    Name of the owner

    email string

    Email of the owner

    deadlineDuration string

    The time period during which the campaign should be completed, formatted as an ISO-8601 Duration. When this template generates a campaign, the campaign's deadline will be the current date plus this duration. For example, if generation occurred on 2020-01-01 and this field was "P2W" (two weeks), the resulting campaign's deadline would be 2020-01-15 (the current date plus 14 days).

    campaign

    object

    required

    id string

    Id of the campaign

    name stringrequired

    The campaign name. If this object is part of a template, special formatting applies; see the /campaign-templates/{id}/generate endpoint documentation for details.

    description stringnullablerequired

    The campaign description. If this object is part of a template, special formatting applies; see the /campaign-templates/{id}/generate endpoint documentation for details.

    deadline date-time

    The campaign's completion deadline. This date must be in the future in order to activate the campaign. If you try to activate a campaign with a deadline of today or in the past, you will receive a 400 error response.

    type stringrequired

    Possible values: [MANAGER, SOURCE_OWNER, SEARCH, ROLE_COMPOSITION, MACHINE_ACCOUNT]

    The type of campaign. Could be extended in the future.

    emailNotificationEnabled boolean

    Enables email notification for this campaign

    autoRevokeAllowed boolean

    Allows auto revoke for this campaign

    recommendationsEnabled boolean

    Enables IAI for this campaign. Accepts true even if the IAI product feature is off. If IAI is turned off then campaigns generated from this template will indicate false. The real value will then be returned if IAI is ever enabled for the org in the future.

    status string

    Possible values: [PENDING, STAGED, CANCELING, ACTIVATING, ACTIVE, COMPLETING, COMPLETED, ERROR, ARCHIVED]

    The campaign's current status.

    correlatedStatus string

    Possible values: [CORRELATED, UNCORRELATED]

    The correlatedStatus of the campaign. Only SOURCE_OWNER campaigns can be Uncorrelated. An Uncorrelated certification campaign only includes Uncorrelated identities (An identity is uncorrelated if it has no accounts on an authoritative source).

    created date-time

    Created time of the campaign

    totalCertifications int32

    The total number of certifications in this campaign.

    completedCertifications int32

    The number of completed certifications in this campaign.

    alerts

    object[]

    A list of errors and warnings that have accumulated.

  • Array [

    • level string

    Possible values: [ERROR, WARN, INFO]

    Denotes the level of the message

    localizations

    object[]

  • Array [

    • locale stringnullable

    The locale for the message text, a BCP 47 language tag.

    localeOrigin LocaleOrigin (string)nullable

    Possible values: [DEFAULT, REQUEST, null]

    An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.

    text string

    Actual text of the error message in the indicated locale.

  • ]

  • ]

    • modified date-time

    Modified time of the campaign

    filter

    object

    Determines which items will be included in this campaign. The default campaign filter is used if this field is left blank.

    id string

    The ID of whatever type of filter is being used.

    type string

    Possible values: [CAMPAIGN_FILTER, RULE]

    Type of the filter

    name string

    Name of the filter

    sunsetCommentsRequired boolean

    Default value: true

    Determines if comments on sunset date changes are required.

    sourceOwnerCampaignInfo

    object

    Must be set only if the campaign type is SOURCE_OWNER.

    sourceIds string[]

    The list of sources to be included in the campaign.

    searchCampaignInfo

    object

    Must be set only if the campaign type is SEARCH.

    type stringrequired

    Possible values: [IDENTITY, ACCESS]

    The type of search campaign represented.

    description string

    Describes this search campaign. Intended for storing the query used, and possibly the number of identities selected/available.

    reviewer

    object

    If specified, this identity or governance group will be the reviewer for all certifications in this campaign. The allowed DTO types are IDENTITY and GOVERNANCE_GROUP.

    type string

    Possible values: [GOVERNANCE_GROUP, IDENTITY]

    The reviewer's DTO type.

    id string

    The reviewer's ID.

    name string

    The reviewer's name.

    query string

    The scope for the campaign. The campaign will cover identities returned by the query and identities that have access items returned by the query. One of query or identityIds must be set.

    identityIds string[]

    Possible values: <= 1000

    A direct list of identities to include in this campaign. One of identityIds or query must be set.

    accessConstraints

    object[]

    Possible values: <= 1000

    Further reduces the scope of the campaign by excluding identities (from query or identityIds) that do not have this access.

  • Array [

    • type stringrequired

    Possible values: [ENTITLEMENT, ACCESS_PROFILE, ROLE]

    Type of Access

    ids string[]

    Must be set only if operator is SELECTED.

    operator stringrequired

    Possible values: [ALL, SELECTED]

    Used to determine whether the scope of the campaign should be reduced for selected ids or all.

  • ]

    • roleCompositionCampaignInfo

    object

    Optional configuration options for role composition campaigns.

    reviewer

    object

    If specified, this identity or governance group will be the reviewer for all certifications in this campaign. The allowed DTO types are IDENTITY and GOVERNANCE_GROUP.

    type string

    Possible values: [GOVERNANCE_GROUP, IDENTITY]

    The reviewer's DTO type.

    id string

    The reviewer's ID.

    name string

    The reviewer's name.

    roleIds string[]

    Optional list of roles to include in this campaign. Only one of roleIds and query may be set; if neither are set, all roles are included.

    remediatorRef

    object

    required

    This determines who remediation tasks will be assigned to. Remediation tasks are created for each revoke decision on items in the campaign. The only legal remediator type is 'IDENTITY', and the chosen identity must be a Role Admin or Org Admin.

    type stringrequired

    Possible values: [IDENTITY]

    Legal Remediator Type

    id stringrequired

    The ID of the remediator.

    name string

    The name of the remediator.

    query string

    Optional search query to scope this campaign to a set of roles. Only one of roleIds and query may be set; if neither are set, all roles are included.

    description string

    Describes this role composition campaign. Intended for storing the query used, and possibly the number of roles selected/available.

    machineAccountCampaignInfo

    object

    Must be set only if the campaign type is MACHINE_ACCOUNT.

    sourceIds string[]

    The list of sources to be included in the campaign.

    reviewerType string

    Possible values: [ACCOUNT_OWNER]

    The reviewer's type.

    sourcesWithOrphanEntitlements

    object[]

    A list of sources in the campaign that contain "orphan entitlements" (entitlements without a corresponding Managed Attribute). An empty list indicates the campaign has no orphan entitlements. Null indicates there may be unknown orphan entitlements in the campaign (the campaign was created before this feature was implemented).

  • Array [

    • id string

    Id of the source

    type string

    Possible values: [SOURCE]

    Type

    name string

    Name of the source

  • ]

    • mandatoryCommentRequirement string

    Possible values: [ALL_DECISIONS, REVOKE_ONLY_DECISIONS, NO_DECISIONS]

    Determines whether comments are required for decisions during certification reviews. You can require comments for all decisions, revoke-only decisions, or no decisions. By default, comments are not required for decisions.

Loading...