Access Request Status

The Access Request Status API returns a list of access request statuses based on the specified query parameters. Any token with any authority can request their own status. A token with ORG_ADMIN authority is required to call this API to get a list of statuses for other users.

Query Parameters

requested-for string
Filter the results by the identity for which the requests were made. me indicates the current user. Mutually exclusive with regarding-identity.
Example: 2c9180877b2b6ea4017b2c545f971429
requested-by string
Filter the results by the identity that made the requests. me indicates the current user. Mutually exclusive with regarding-identity.
Example: 2c9180877b2b6ea4017b2c545f971429
regarding-identity string
Filter the results by the specified identity which is either the requester or target of the requests. me indicates the current user. Mutually exclusive with requested-for and requested-by.
Example: 2c9180877b2b6ea4017b2c545f971429
count boolean
If true it will populate the X-Total-Count response header with the number of results that would be returned if limit and offset were ignored.
Example: false
limit int32
Possible values: <= 250
Default value: 250
Max number of results to return.
Example: 100
offset int32
Offset into the full result set. Usually specified with limit to paginate through the results. Defaults to 0 if not specified.
Example: 10
filters string
Filter results using the standard syntax described in V3 API Standard Collection Parameters
Filtering is supported for the following fields and operators:
accountActivityItemId: eq, in
Example: accountActivityItemId eq "2c918086771c86df0177401efcdf54c0"
sorters comma-separated
Sort results using the standard syntax described in V3 API Standard Collection Parameters
Sorting is supported for the following fields: created, modified, accountActivityItemId
Example: created

Responses

• 200
• 400
• 401
• 403
• 429
• 500

---

List of requested item status.

application/json

Schema

Example (from schema)

---

Schema

• Array [
name string

Human-readable display name of the item being requested.

type string

Possible values: [ACCESS_PROFILE, ROLE, ENTITLEMENT]

Type of requested object.

cancelledRequestDetails object nullable

Provides additional details for a request that has been cancelled.

comment string

Comment made by the owner when cancelling the associated request.

owner object

type DtoType

Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]

DTO type

id string

ID of the object to which this reference applies

name string

Human-readable display name of the object to which this reference applies

modified date-time

Date comment was added by the owner when cancelling the associated request

errorMessages array[] nullable

List of list of localized error messages, if any, encountered during the approval/provisioning process.

state RequestedItemStatusRequestState
Possible values: [EXECUTING, REQUEST_COMPLETED, CANCELLED, TERMINATED, PROVISIONING_VERIFICATION_PENDING, REJECTED, PROVISIONING_FAILED, NOT_ALL_ITEMS_PROVISIONED, ERROR]
Indicates the state of an access request:
• EXECUTING: The request is executing, which indicates the system is doing some processing.
• REQUEST_COMPLETED: Indicates the request has been completed.
• CANCELLED: The request was cancelled with no user input.
• TERMINATED: The request has been terminated before it was able to complete.
• PROVISIONING_VERIFICATION_PENDING: The request has finished any approval steps and provisioning is waiting to be verified.
• REJECTED: The request was rejected.
• PROVISIONING_FAILED: The request has failed to complete.
• NOT_ALL_ITEMS_PROVISIONED: One or more of the requested items failed to complete, but there were one or more successes.
• ERROR: An error occurred during request processing.
approvalDetails object[]
Approval details for each item.
Array [
forwarded boolean
True if the request for this item was forwarded from one owner to another.
originalOwner object
Base identity/workgroup reference object representing the original owner, if forwarded.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
currentOwner object
Base reference of approver that will make decision.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
reviewedBy object
The identity who has reviewed the approval.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
modified date-time
Time at which item was modified.
status ManualWorkItemState
Possible values: [PENDING, APPROVED, REJECTED, EXPIRED, CANCELLED, ARCHIVED]
Indicates the state of the request processing for this item:
• PENDING: The request for this item is awaiting processing.
• APPROVED: The request for this item has been approved.
• REJECTED: The request for this item was rejected.
• EXPIRED: The request for this item expired with no action taken.
• CANCELLED: The request for this item was cancelled with no user action.
• ARCHIVED: The request for this item has been archived after completion.
scheme ApprovalScheme
Possible values: [APP_OWNER, SOURCE_OWNER, MANAGER, ROLE_OWNER, ACCESS_PROFILE_OWNER, ENTITLEMENT_OWNER, GOVERNANCE_GROUP]
Describes the individual or group that is responsible for an approval step.
errorMessages object[]
If the request failed, includes any error messages that were generated.
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]
comment string
Comment, if any, provided by the approver.
removeDate date-time
The date the role or access profile is no longer assigned to the specified identity.
]
manualWorkItemDetails object[] nullable
Manual work items created for provisioning the item.
Array [
forwarded boolean
True if the request for this item was forwarded from one owner to another.
originalOwner object
Base identity/workgroup reference object representing the original owner, if forwarded.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
currentOwner object
Base reference of approver that will make decision.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
modified date-time
Time at which item was modified.
status ManualWorkItemState
Possible values: [PENDING, APPROVED, REJECTED, EXPIRED, CANCELLED, ARCHIVED]
Indicates the state of the request processing for this item:
• PENDING: The request for this item is awaiting processing.
• APPROVED: The request for this item has been approved.
• REJECTED: The request for this item was rejected.
• EXPIRED: The request for this item expired with no action taken.
• CANCELLED: The request for this item was cancelled with no user action.
• ARCHIVED: The request for this item has been archived after completion.
forwardHistory object[]
The history of approval forward action.
Array [
oldApproverName string
Display name of approver from whom the approval was forwarded.
newApproverName string
Display name of approver to whom the approval was forwarded.
comment string nullable
Comment made while forwarding.
modified date-time
Time at which approval was forwarded.
forwarderName string nullable
Display name of forwarder who forwarded the approval.
reassignmentType ReassignmentType
Possible values: [MANUAL_REASSIGNMENT, AUTOMATIC_REASSIGNMENT, AUTO_ESCALATION, SELF_REVIEW_DELEGATION]
The approval reassignment type.
• MANUAL_REASSIGNMENT: An approval with this reassignment type has been specifically reassigned by the approval task's owner, from their queue to someone else's.
• AUTOMATIC_REASSIGNMENT: An approval with this reassignment type has been automatically reassigned from another approver's queue, according to that approver's reassignment configuration. The approver's reassignment configuration may be set up to automatically reassign approval tasks for a defined (or possibly open-ended) period of time.
• AUTO_ESCALATION: An approval with this reassignment type has been automatically reassigned from another approver's queue, according to the request's escalation configuration. For more information about escalation configuration, refer to Setting Global Reminders and Escalation Policies.
• SELF_REVIEW_DELEGATION: An approval with this reassignment type has been automatically reassigned by the system to prevent self-review. This helps prevent situations like a requester being tasked with approving their own request. For more information about preventing self-review, refer to Self-review Prevention and Preventing Self-approval.
]
]
accountActivityItemId string

Id of associated account activity item.

requestType AccessRequestType

Possible values: [GRANT_ACCESS, REVOKE_ACCESS]

Access request type. Defaults to GRANT_ACCESS. REVOKE_ACCESS type can only have a single Identity ID in the requestedFor field.

modified date-time

When the request was last modified.

created date-time

When the request was created.

requester object

The identity that requested the item.

type DtoType

Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]

DTO type

id string

ID of the object to which this reference applies

name string

Human-readable display name of the object to which this reference applies

requestedFor object

The identity for whom the Access Request Status is requested for.

type DtoType

Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]

DTO type

id string

ID of the object to which this reference applies

name string

Human-readable display name of the object to which this reference applies

requesterComment object nullable

The requester's comment.

comment string

Content of the comment

author object

type DtoType

Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]

An enumeration of the types of DTOs supported within the IdentityNow infrastructure.

id string

ID of the author

name string

Human-readable display name of the identity making the comment

created date-time

Date and time comment was created

sodViolationContext object nullable
The details of the SOD violations for the associated approval.
state string
Possible values: [SUCCESS, ERROR]
The status of SOD violation check
uuid string
The id of the Violation check event
violationCheckResult object
The inner object representing the completed SOD Violation check
message object
If the request failed, includes any error message that was generated.
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
clientMetadata object
Arbitrary key-value pairs. They will never be processed by the IdentityNow system but will be returned on completion of the violation check.
property name* string
violationContexts object[]
Array [
policy object
Reference to the Policy that is being violated.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
conflictingAccessCriteria object
The object which contains the left and right hand side of the entitlements that got violated according to the policy.
leftCriteria object
criteriaList object[]
Array [
existing boolean
If the entitlement already belonged to the user or not.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
An enumeration of the types of DTOs supported within the IdentityNow infrastructure.
id string
Entitlement ID
name string
Entitlement name
]
rightCriteria object
criteriaList object[]
Array [
existing boolean
If the entitlement already belonged to the user or not.
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
An enumeration of the types of DTOs supported within the IdentityNow infrastructure.
id string
Entitlement ID
name string
Entitlement name
]
]
violatedPolicies object[]
A list of the Policies that were violated
Array [
type DtoType
Possible values: [ACCOUNT_CORRELATION_CONFIG, ACCESS_PROFILE, ACCESS_REQUEST_APPROVAL, ACCOUNT, APPLICATION, CAMPAIGN, CAMPAIGN_FILTER, CERTIFICATION, CLUSTER, CONNECTOR_SCHEMA, ENTITLEMENT, GOVERNANCE_GROUP, IDENTITY, IDENTITY_PROFILE, IDENTITY_REQUEST, LIFECYCLE_STATE, PASSWORD_POLICY, ROLE, RULE, SOD_POLICY, SOURCE, TAG, TAG_CATEGORY, TASK_RESULT, REPORT_RESULT, SOD_VIOLATION, ACCOUNT_ACTIVITY, WORKGROUP]
DTO type
id string
ID of the object to which this reference applies
name string
Human-readable display name of the object to which this reference applies
]
provisioningDetails object nullable

Provides additional details about provisioning for this request.

orderedSubPhaseReferences string

Ordered CSV of sub phase references to objects that contain more information about provisioning. For example, this can contain "manualWorkItemDetails" which indicate that there is further information in that object for this phase.

preApprovalTriggerDetails object nullable

Provides additional details about the pre-approval trigger for this request.

comment string

Comment left for the pre-approval decision

reviewer string

The reviewer of the pre-approval decision

decision string

Possible values: [APPROVED, REJECTED]

The decision of the pre-approval trigger

accessRequestPhases object[]
A list of Phases that the Access Request has gone through in order, to help determine the status of the request.
Array [
started date-time
The time that this phase started.
finished date-time
The time that this phase finished.
name string
The name of this phase.
state string
Possible values: [PENDING, EXECUTING, COMPLETED, CANCELLED]
The state of this phase.
result string
Possible values: [SUCCESSFUL, FAILED]
The state of this phase.
phaseReference string
A reference to another object on the RequestedItemStatus that contains more details about the phase. Note that for the Provisioning phase, this will be empty if there are no manual work items.
]
description string

Description associated to the requested object.

removeDate date-time nullable

When the role access is scheduled for removal.

cancelable boolean

True if the request can be canceled.

accessRequestId string

This is the account activity id.

clientMetadata object nullable
Arbitrary key-value pairs, if any were included in the corresponding access request
property name* string
• ]

[
  {
    "name": "AccessProfile1",
    "type": "ACCESS_PROFILE",
    "cancelledRequestDetails": {
      "comment": "Nisl quis ipsum quam quisque condimentum nunc ut dolor nunc.",
      "owner": {
        "type": "IDENTITY",
        "id": "2c91808568c529c60168cca6f90c1313",
        "name": "William Wilson"
      },
      "modified": "2019-12-20T09:17:12.192Z"
    },
    "errorMessages": [
      [
        {
          "locale": "en-US",
          "localeOrigin": "DEFAULT",
          "text": "The request was syntactically correct but its content is semantically invalid."
        }
      ]
    ],
    "state": "EXECUTING",
    "approvalDetails": [
      {
        "forwarded": false,
        "originalOwner": {
          "type": "IDENTITY",
          "id": "2c91808568c529c60168cca6f90c1313",
          "name": "William Wilson"
        },
        "currentOwner": {
          "type": "IDENTITY",
          "id": "2c91808568c529c60168cca6f90c1313",
          "name": "William Wilson"
        },
        "reviewedBy": {
          "type": "IDENTITY",
          "id": "2c91808568c529c60168cca6f90c1313",
          "name": "William Wilson"
        },
        "modified": "2019-08-23T18:52:57.398Z",
        "status": "PENDING",
        "scheme": "MANAGER",
        "errorMessages": [
          {
            "locale": "en-US",
            "localeOrigin": "DEFAULT",
            "text": "The request was syntactically correct but its content is semantically invalid."
          }
        ],
        "comment": "I approve this request",
        "removeDate": "2020-07-11T00:00:00Z"
      }
    ],
    "manualWorkItemDetails": [
      {
        "forwarded": true,
        "originalOwner": {
          "type": "IDENTITY",
          "id": "2c91808568c529c60168cca6f90c1313",
          "name": "William Wilson"
        },
        "currentOwner": {
          "type": "IDENTITY",
          "id": "2c91808568c529c60168cca6f90c1313",
          "name": "William Wilson"
        },
        "modified": "2019-08-23T18:52:57.398Z",
        "status": "PENDING",
        "forwardHistory": [
          {
            "oldApproverName": "Frank Mir",
            "newApproverName": "Al Volta",
            "comment": "Forwarding from Frank to Al",
            "modified": "2019-08-23T18:52:57.398Z",
            "forwarderName": "William Wilson",
            "reassignmentType": "AUTOMATIC_REASSIGNMENT"
          }
        ]
      }
    ],
    "accountActivityItemId": "2c9180926cbfbddd016cbfc7c3b10010",
    "requestType": "GRANT_ACCESS",
    "modified": "2019-08-23T18:52:59.162Z",
    "created": "2019-08-23T18:40:35.772Z",
    "requester": {
      "type": "IDENTITY",
      "id": "2c91808568c529c60168cca6f90c1313",
      "name": "William Wilson"
    },
    "requestedFor": {
      "type": "IDENTITY",
      "id": "2c91808568c529c60168cca6f90c1313",
      "name": "William Wilson"
    },
    "requesterComment": {
      "comment": "Et quam massa maximus vivamus nisi ut urna tincidunt metus elementum erat",
      "author": {
        "type": "IDENTITY",
        "id": "2c91808568c529c60168cca6f90c1313",
        "name": "Adam Kennedy"
      },
      "created": "2017-07-11T18:45:37.098Z"
    },
    "sodViolationContext": {
      "state": "SUCCESS",
      "uuid": "f73d16e9-a038-46c5-b217-1246e15fdbdd",
      "violationCheckResult": {
        "message": [
          {
            "locale": "en-US",
            "localeOrigin": "DEFAULT",
            "text": "An error has occurred during the SOD violation check"
          }
        ],
        "clientMetadata": {
          "requestedAppName": "test-app",
          "requestedAppId": "2c91808f7892918f0178b78da4a305a1"
        },
        "violationContexts": [
          {
            "policy": {
              "type": "IDENTITY",
              "id": "2c91808568c529c60168cca6f90c1313",
              "name": "William Wilson"
            },
            "conflictingAccessCriteria": {
              "leftCriteria": {
                "criteriaList": [
                  {
                    "existing": true,
                    "type": "IDENTITY",
                    "id": "2c918085771e9d3301773b3cb66f6398",
                    "name": "My HR Entitlement"
                  }
                ]
              },
              "rightCriteria": {
                "criteriaList": [
                  {
                    "existing": true,
                    "type": "IDENTITY",
                    "id": "2c918085771e9d3301773b3cb66f6398",
                    "name": "My HR Entitlement"
                  }
                ]
              }
            }
          }
        ],
        "violatedPolicies": [
          [
            {
              "type": "SOD_POLICY",
              "id": "69129440-422d-4a23-aadd-35c828d5bfda",
              "name": "HR Policy"
            }
          ]
        ]
      }
    },
    "provisioningDetails": {
      "orderedSubPhaseReferences": "manualWorkItemDetails"
    },
    "preApprovalTriggerDetails": {
      "comment": "Access is Approved",
      "reviewer": "John Doe",
      "decision": "APPROVED"
    },
    "accessRequestPhases": [
      {
        "started": "2020-07-11T00:00:00Z",
        "finished": "2020-07-12T00:00:00Z",
        "name": "APPROVAL_PHASE",
        "state": "COMPLETED",
        "result": "SUCCESSFUL",
        "phaseReference": "approvalDetails"
      }
    ],
    "description": "This is the Engineering role that engineers are granted.",
    "removeDate": "2019-10-23T00:00:00.000Z",
    "cancelable": true,
    "accessRequestId": "2b838de9-db9b-abcf-e646-d4f274ad4238",
    "clientMetadata": {
      "key1": "value1",
      "key2": "value2"
    }
  }
]

Client Error - Returned if the request body is invalid.

application/json

Schema

Example (from schema)

---

Schema

detailCode string

Fine-grained error code providing more detail of the error.

trackingId string

Unique tracking id for the error.

messages object[]
Generic localized reason for error
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]
causes object[]
Plain-text descriptive reasons to provide additional detail to the text provided in the messages field
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]

{
  "detailCode": "400.1 Bad Request Content",
  "trackingId": "e7eab60924f64aa284175b9fa3309599",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ],
  "causes": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ]
}

Unauthorized - Returned if there is no authorization header, or if the JWT token is expired.

application/json

Schema

Example (from schema)

---

Schema

error

A message describing the error

{
  "error": "JWT validation failed: JWT is expired"
}

Forbidden - Returned if the user you are running as, doesn't have access to this end-point.

application/json

Schema

Example (from schema)

403

---

Schema

detailCode string

Fine-grained error code providing more detail of the error.

trackingId string

Unique tracking id for the error.

messages object[]
Generic localized reason for error
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]
causes object[]
Plain-text descriptive reasons to provide additional detail to the text provided in the messages field
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]

{
  "detailCode": "400.1 Bad Request Content",
  "trackingId": "e7eab60924f64aa284175b9fa3309599",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ],
  "causes": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ]
}

An example of a 403 response object

{
  "detailCode": "403 Forbidden",
  "trackingId": "b21b1f7ce4da4d639f2c62a57171b427",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The server understood the request but refuses to authorize it."
    }
  ]
}

Too Many Requests - Returned in response to too many requests in a given period of time - rate limited. The Retry-After header in the response includes how long to wait before trying again.

application/json

Schema

Example (from schema)

---

Schema

message

A message describing the error

{
  "message": " Rate Limit Exceeded "
}

Internal Server Error - Returned if there is an unexpected error.

application/json

Schema

Example (from schema)

500

---

Schema

detailCode string

Fine-grained error code providing more detail of the error.

trackingId string

Unique tracking id for the error.

messages object[]
Generic localized reason for error
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]
causes object[]
Plain-text descriptive reasons to provide additional detail to the text provided in the messages field
Array [
locale string
The locale for the message text, a BCP 47 language tag.
localeOrigin LocaleOrigin
Possible values: [DEFAULT, REQUEST]
An indicator of how the locale was selected. DEFAULT means the locale is the system default. REQUEST means the locale was selected from the request context (i.e., best match based on the Accept-Language header). Additional values may be added in the future without notice.
text string
Actual text of the error message in the indicated locale.
]

{
  "detailCode": "400.1 Bad Request Content",
  "trackingId": "e7eab60924f64aa284175b9fa3309599",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ],
  "causes": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "The request was syntactically correct but its content is semantically invalid."
    }
  ]
}

An example of a 500 response object

{
  "detailCode": "500.0 Internal Fault",
  "trackingId": "b21b1f7ce4da4d639f2c62a57171b427",
  "messages": [
    {
      "locale": "en-US",
      "localeOrigin": "DEFAULT",
      "text": "An internal fault occurred."
    }
  ]
}

Loading...